Alphabetical List of Tools

Alphabetical List of Tools by File Name

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Tools are listed by their file name, followed by their full name. If the full name begins with a different letter than the file name, the tool is also listed by its full name, followed by its file name. Hold the cursor over the name of a tool for a brief description.

A

Acldiag.exe (ACL Diagnostics)

Active Directory Administration Tool (Ldp.exe)

Active Directory Replication Monitor (Replmon.exe)

Addiag.exe (Application Deployment Diagnosis)

B

No entries

C

Compatadmin.exe (Compatibility Administration Tool)

D

Depends.exe (Dependency Walker)

Dfsutil.exe (Distributed File System Utility)

Dhcploc.exe (DHCP Server Locator Utility)

Diruse.exe (Directory Disk Usage)

Dmdiag.exe (Disk Manager Diagnostics)

Dnscmd.exe (DNS Server Troubleshooting Tool)

Dsacls.exe

E

Efsinfo.exe (Encrypting File System Information)

Exctrlst.exe (Extensible Performance Counter List)

F

Filever.exe (File Version)

Ftonline.exe

G

Getsid.exe (Get Security ID)

Gflags.exe (Global Flags Editor)

H, I, J, K

No entries

L

Ldp.exe (Active Directory Administration Tool)

M

Memory Pool Monitor (Poolmon.exe)

Memsnap.exe (Memory Profiling Tool)

Movetree.exe (Move Users)

Msicuu.exe (Windows Installer Cleanup Utility)

Msizap.exe (Windows Installer Zapper)

N

Netcap.exe (Network Monitor Capture Utility)

Netdiag.exe (Network Connectivity Tester)

Netdom.exe (Windows Domain Manager)

Nltest.exe

O

Oh.exe (Open Handles)

P

Pageheap.exe (Page Heap)

Performance Data Block Dump Utility (Showperf.exe)

Pfmon.exe (Page Fault Monitor)

Pmon.exe (Process Resource Monitor)

Poolmon.exe (Memory Pool Monitor)

PPTP Ping (Point-to-Point Tunneling Protocol Ping Utilities)

Pstat.exe (Process and Thread Status)

Q

Qfixapp.exe (Quick Fix Application)

R

Repadmin.exe (Replication Diagnostics Tool)

Replmon.exe (Active Directory Replication Monitor)

S

Sdcheck.exe (Security Descriptor Check Utility)

Setx.exe

Showperf.exe (Performance Data Block Dump Utility)

SIDWalker (Security Administration Tools)

Snmputilg.exe (SNMP Troubleshooting Tool)

Spcheck.exe (Service Pack Check)

T, U, V

No entries

W

Windows Domain Manager (Netdom.exe)

Windows Installer Cleanup Utility (Msicuu.exe)

Windows Installer Zapper (Msizap.exe)

X

Xcacls.exe

X, Y, Z

No entries

©1985-2001 Microsoft Corporation. All rights reserved.


Introduction to Support Tools

The Windows Support Tools assist support personnel and network administrators to manage their networks and to troubleshoot problems. They are not installed with the Windows operating system; you must install them separately from the \Support\Tools folder of the Windows CD. This Help file provides information on the tools and shortcuts for opening or running these tools.

Getting Help on tools

To find Help for a tool

  • Click A-Z List on the button bar or click Alphabetical List of Tools on the Contents tab to display a list of tools by the tool's file name.
  • Click a category on the Contents tab and then click the tool's file name.
  • Use the Index tab to locate a tool by either tool name or file name.

Each tool is covered in a main Help topic. Links to associated topics covering syntax, examples, or other features of the tool are available at the top of each topic for that tool. Tools with Windows interfaces may include a separate Help file available from the Help menu in the tool window. For command-line tools, Help is also available by typing FileName /? at the command prompt.

An extensive Glossary is available from the Contents tab. Links to glossary definitions that appear as pop-up windows are formatted in underlined dark green text.

Understanding notation and terminology

The following topics cover the conventions for usage and notation that are observed in this document:

Procedural conventions

Notational conventions

This documentation assumes you are already familiar with the Windows operating system. For more general information about Windows, including keyboard equivalents to menu and mouse actions, see Windows Help.

Printing topics

When you print from HTML Help, a dialog box opens asking whether you want to print the selected topic or to print the selected heading and all subtopics. Printing the selected topic is recommended. If you print a heading and subtopics, you may encounter error messages and special formatting will be lost, but the topics still print.


Notational Conventions

Convention | Meaning
bold | In syntax, characters that you type exactly as shown, including commands and switches. In text, menu names and menu commands are also bold.
bold monospace | Commands that you must type exactly as shown to get the results being discussed.
italic | Variables for which you supply a specific value. For example, Filename.ext represents any valid file name.
Initial Capitals
(Filename.ext) 		Names of files should begin with an initial capital letter, for example, Filename.ext. Paths and folders can be uppercase, lowercase, or mixed, according to how they actually appear in a standard installation of the application or the operating system.
ALL CAPITALS | Used for acronyms.
monospace
Examples of code.
[ ] (square brackets) | In syntax descriptions, square brackets enclose optional items. If you include the item, type only the information between them, not the square brackets themselves.
{choice1 | choice2} (braces) | In syntax descriptions, braces enclose items which require a choice, such as {yes | no}. Type only one of the choices, not the braces or the dividing line.

Introduction


Procedural Conventions

Convention | Meaning
type | An instruction to type information means to press the key or keys and then press the ENTER key.
select | An instruction to select information means to highlight folders, file names, text boxes, menu bars, and options, or to select options in a dialog box.
+ | A plus sign ( + ) between two or more key names indicates that you must press the keys at the same time; for example, ALT + TAB.
, | A comma ( , ) between two or more key names indicates that you must press each key consecutively; for example, ALT, F, X.
Note | Alerts you to supplementary information.
Caution | Alerts you to possible data loss, breaches of security, or other more serious problems.

Introduction


Related Information on the Internet

There are many Microsoft Internet sites that provide information and updates regarding Windows XP, Windows 2000, Windows NT, Windows 98, and the Windows Resource Kits.

If you have an Internet connection and a Web browser, you can click the following links to visit these sites.

Windows Resource Kits Web Site

Windows Resource Kits (http://go.microsoft.com/fwlink/?LinkId=286) Web site

Windows Web Sites

Microsoft Windows (http://go.microsoft.com/fwlink/?LinkId=1681) Web site

Windows 2000 Server (http://go.microsoft.com/fwlink/?LinkId=623) Web site

Windows NT Server (http://go.microsoft.com/fwlink/?LinkId=624) Web site

Windows NT Workstation (http://go.microsoft.com/fwlink/?LinkId=626) Web site

Microsoft Product Support Services (http://go.microsoft.com/fwlink/?LinkId=1679) Web site

Microsoft Windows Hardware Compatibility List (http://go.microsoft.com/fwlink/?LinkId=1637) Web site.

Other Microsoft Web Sites of Interest

Microsoft Knowledge Base Search (http://go.microsoft.com/fwlink/?LinkId=1633) Web site.

Microsoft Internet Explorer (http://go.microsoft.com/fwlink/?LinkId=293) Web site

Microsoft TechNet (http://go.microsoft.com/fwlink/?LinkId=1631) Web site

MSDN (http://go.microsoft.com/fwlink/?LinkId=1630) Web site

Microsoft Home Page

For any other information about Microsoft products, point your browser to:

Microsoft home page (http://go.microsoft.com/fwlink/?LinkId=1681) Web site


Acldiag.exe: ACL Diagnostics
Overview | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool detects and reports discrepancies in the Access Control Lists (ACLs) of objects in Active Directory. It can also reapply a security delegation template to an ACL, eliminating special permissions and restoring incomplete delegations.

With AclDiag, you can:

  • Display the Access Control Entries (ACEs) in the ACL, and inheritance and audit settings.
  • Display the effective permissions of users and groups to an Active Directory object.
  • Compare the ACL for an object in Active Directory to the default permissions defined in the schema.
  • Compare the ACL of an Active Directory object to a delegation template.
  • Reapply the delegation template to the ACL of an Active Directory object.

System Requirements

  • AclDiag runs on Windows 2000 and on Windows XP Professional.
  • The user must have permission to read permissions on Active Directory objects. To reapply a delegation template, the user must have permission to modify permissions to the Active Directory object.

File Required

  • Acldiag.exe

For more information

For more information about Active Directory, see the Active Directory Overview (http://go.microsoft.com/fwlink/?LinkId=1646).


AclDiag Syntax
Overview | Syntax | Examples | Related Tools Open Command Prompt

One Step acldiag "LDAP-URL" [/geteffective:{user | group | *}] [/schema] [/chkdeleg [/fixdeleg]] [/skip] [/tdo]

Parameters

Note

  • If you specify an object without additional parameters, AclDiag lists the Access Control Entries (ACEs) in the ACL, and inheritance and audit settings.
LDAP-URL
Identifies the Active Directory object to investigate. Enter the LDAP URL for an object in Active Directory. The LDAP URL format consists of the name of the LDAP server followed by the distinguished name of the object. The string must be enclosed in quotation marks.

For example, "LDAP://domain.test.microsoft.com/CN=Test Admin,CN=Users,DC=domain,DC=test,DC=microsoft,DC=com"

/geteffective:{User | Group | *}
Adds an effective rights diagnosis to the display. The effective rights diagnosis displays the effective permissions to the object held by specified users or groups. Effective permissions are the permissions that are enforced after precedence is applied and conflicts in rights are resolved.
Value | Description
User | Group | Displays the effective permissions held by the specified user or group.
* Displays the effective permissions of all users and groups in the access control list (ACL) for the object.
/schema
Adds a schema diagnosis to the display. The schema diagnosis reports whether the object ACL includes the ACEs that are in the schema defaults.
/chkdeleg
Adds a delegation diagnosis to the display. The delegation diagnosis reports whether the object ACL includes the ACEs that are in the delegation template. A status of misconfigured indicates that at least one, but not all, ACEs in a delegation template (and in the schema default) are included in the ACL.
/fixdeleg
Directs AclDiag to reapply the delegation template to the object ACL, eliminating special permissions and restoring incomplete delegations. When the specified object inherits delegated permissions, this parameter reapplies the delegation template to the object for which the delegated permissions are explictly defined.

Note

  • This parameter is effective only when used with the /chkdeleg parameter. Without /chkdeleg, /fixdeleg is ignored, but AclDiag does not report an error.
/skip
Omits the security description from the display. The security description is a list of the ACEs in the object ACL.
/tdo
Displays output in tab-delimited format. Fixed-width format is the default. Tab-delimited format is useful when the output is destined for a database or spreadsheet.


AclDiag Examples
Overview | Syntax | Examples | Related Tools Open Command Prompt

To display the ACL of a user object in Active Directory, type

acldiag "LDAP://domain1.test.microsoft.com/CN=Test Admin,CN=Users,DC=domain1,DC=test,DC=microsoft,DC=com"

To display a schema analysis of a computer object in Active Directory, type

acldiag "LDAP://domain1.test.microsoft.com/CN=MACHINE-TEST,CN=Computers,DC=domain1,DC=test,DC=microsoft,DC=com" /schema

To display the ACL, the effective permissions for all users, and the delegation analysis of a computer object in tab-delimited format, type:

acldiag "LDAP://domain1.test.microsoft.com/CN=MACHINE-TEST,CN=Computers,DC=domain1,DC=test,DC=microsoft,DC=com" /chkdeleg /geteffective:* /tdo

To reapply a delegation template to a group object, type

acldiag "LDAP://domain1.test.microsoft.com/"CN=Domain Computers,CN=Users,DC=domain1,DC=test,DC=microsoft,DC=com" /chkdeleg /fixdeleg


Dsacls.exe: DsAcls
Overview | Syntax | Examples | Related Tools Open Command Prompt

Displays and changes permissions (access control entries) in the Access Control List (ACL) of objects in Active Directory.

DsAcls is the command-line equivalent of the Security tab in the Properties dialog box for an Active Directory object in Active Directory tools, such as Active Directory Users and Computers. You can use either tool to view and change permissions to an Active Directory object.

Note

  • The ACEs that you add by using DsAcls must be object-specific permissions that override the default permissions defined in the Active Directory schema for that object type. Do not add ACEs unless you are well-informed about security for Active Directory objects.

System Requirements

  • DsAcls runs on Windows 2000 and on Windows XP Professional.
  • To view an ACL, the user must have permission to read permissions on Active Directory objects. To change an ACL, the user must have permission to write permissions to the Active Directory object.

Files required

  • Dsacls.exe


DsAcls Syntax
Overview | Syntax | Examples | Related Tools Open Command Prompt

One Step dsacls "[\\Computer\]ObjectDN" [/A] [/D PermissionStatement [PermissionStatement...]] [/G PermissionStatement [PermissionStatement...]] [/I:{T | S | P}] [/N] [/P:{Y | N}] [/R {user | group} [{user | group}...]] [/S [/T]] [/?]

Note

  • If you specify an object without additional parameters, DsAcls displays the Access Control Entries (ACEs) in the ACL.
"[\\Computer\]ObjectDN"
Identifies the Active Directory object to investigate. Type the distinguished name of the object. To specify an object on a remote computer, type the computer name followed by the distinguished name. This parameter must be enclosed in quotation marks.

For example, "CN=Jeff Akers,CN=Users,DC=domain,DC=test,DC=microsoft,DC=com" or
"\\Server01\CN=Jeff Akers,CN=Users,DC=domain,DC=test,DC=microsoft,DC=com"

/A
Adds ownership and auditing information to the display.
/D PermissionStatement [PermissionStatement...]
Denies the specified permissions to the user or group.

You can deny permissions to multiple users in each /D parameter, for example: /D Domain1\User1:CCDC Domain1\User2:DC;computer

/G PermissionStatement [PermissionStatement...]
Grants specified permissions to user or group.

You can grant permissions to multiple users in each /G parameter, for example: /G Domain1\User1:CCDC Domain1\User2:DC;computer

/I:{T | S | P}
Specifies the objects to which the permissions are applied. This parameter determines whether the permissions are inheritable. T is the default.
T | This object and subobjects.
S | Subobjects only.
P | Propagate inheritable permissions one level only.
/N
Provides that the specified ACE replace the ACEs in the ACL. By default, the ACE is added to the ACL.
/P:{Y | N}
Determines whether the object can inherit permissions from its parent objects. If you omit this parameter, the inheritance properties of the object are not changed.
Y | The object is protected and cannot inherit permissions.
N | The object is not protected and can inherit permissions.

Note

  • This parameter changes a property of the object, not of an ACE. To determine whether an ACE is inheritable, use the /I parameter.
/R {user | group}
Deletes all ACEs for the specified users or groups.

User can be specified as user@domain or domain\user. Group can be specified as group@domain or domain\group.

You can delete ACEs for multiple users and groups in a single /R parameter, for example, /R Domain1\User1 Domain1\User2

/S
Restores the security on the object to the default for that object class as defined in Active Directory schema.
/T
Restores the security on the tree of objects to the default for each object class. This parameter is valid only with the /S parameter.
/?
Displays help for DsAcls.

Syntax for PermissionStatement

PermissionStatements must have the following format:

{User | Group}:Permissions[;{ObjectType | Property}][;InheritedObjectType]

where:
{User | Group}
Specifies the user or group to whom the rights apply. User can be specified as user@domain or domain\user. Group can be specified as group@domain or domain\group.
{ObjectType | Property}
Limits the permission to the specified object type or property. Enter the display name of the object type or of the property. If an object type or property is not specified, the permission applies to all object types and properties.

For example, /G Domain\User:CC permits the user to create all types of child objects, but /G Domain\User:CC;computer permits the user to create only child computer objects.

InheritedObjectType
Limits inheritance of the permission to the specified the type of object. Enter the display name of the object type. If an object type is not specified, the permission can be inherited by all object types. This parameter is used only when permissions are inheritable.

For example, /G Domain\User:CC permits all types of objects to inherit the permission, but /G Domain\User:CC;;user permits only user objects to inherit the permission.

Permissions
Type one or more of the following values (without spaces).
Generic Permissions | Description
GR | Generic Read
GE | Generic Execute
GW | Generic Write
GA | Generic All
Specific Permissions | Description
SD | Delete
DT | Delete an object and all of its children
RC | Read security information
WD | Change security information
WO | Change owner information
LC | List the children of an object
CC Create child object

If {Object | Property} is not specified to define a specific child-object type, this applies to all types of child objects; otherwise, it applies to the specified child-object type.

DC Delete a child object

If {Object | Property} is not specified to define a specific child-object type, this applies to all types of child objects; otherwise, it applies to the specified child-object type.

WS Write to self object

Meaningful only on Group objects and when {Object | Property} is a "member.".

RP Read property

If {Object | Property} is not specified to define a specific property, this applies to all properties of the object; otherwise, it applies to the specified property of the object.

WP Write property

If {Object | Property} is not specified to define a specific property, this applies to all properties of the object; otherwise, it applies to the specified property of the object.
CA Control access right

If {Object | Property} is not specified to define the specific extended right for control access, this applies to all meaningful control accesses on the object; otherwise, it applies to the specific extended right for that object.

LO List the object access.

Can be used to grant list access to a specific object if List Children (LC) is not granted to the parent as well. Can also be denied on specific objects to hide those objects if the user/group has LC on the parent.

Note

  • Active Directory does not enforce this permission by default. The Active Directory must be configured to check for this permission.


DsAcls Examples
Overview | Syntax | Examples | Related Tools Open Command Prompt

Examples of valid permissions

SDRCWDWO;;user

Delete, read security information, change security information and change ownership permissions on objects of type "user".

CCDC;group;

Create child and delete child permissions to create or delete objects of type "group".

RPWP;telephonenumber;

Read property and write property permissions on telephone number property.


Ldp.exe: Active Directory Administration Tool
Overview | Notes | UI | Examples | Related Tools Open Command Prompt

This graphical utility is a Lightweight Directory Access Protocol (LDAP) client that allows users to perform operations (such as connect, bind, search modify, add, delete) against any LDAP compatible directory, such as Active Directory. Use LDP to view objects stored in Active Directory along with their metadata, such as security descriptors and replication metadata.

Note

  • LDP is a GUI-based, Windows Explorer-like utility with a scope pane on the left that is used for navigating through the Active Directory namespace, and a details pane on the right that is used for displaying the results of the LDAP operations. Any text displayed in the details pane can be selected with the mouse and "copied" to the clipboard.

Corresponding UI

LDP comes with its own user interface.

Concepts

It is highly recommended that you read the Understanding LDAP whitepaper on the Microsoft Web site before continuing with this document. (http://go.microsoft.com/fwlink/?LinkId=1647)

System Requirements

The following are the system requirements for LDP:

  • A connection to an LDAP server.

Files Required

  • LDP.exe


LDP Notes
Overview | Notes | UI | Examples | Related Tools Open Command Prompt

Finding Required and Optional Values for an Attribute

The schema defines objects as well as the attributes and permissible values for each. Schema classes that contain attribute information about objects can be viewed. Search the cn=Schema,cn=Configuration,dc=ForestRootDomain for classSchema objects to view this information.

Understanding Bind Options for LDAP Authentication

There are several authentication methods available in LDP that allow a client to bind to an LDAP server. The best method depends on several factors.

Method | Description
Simple | Clear text password. Try not to use this as it is not secure.
MSN | MSN (Microsoft Network) authentication. This package may bring up UI to prompt the user for MSN credentials.
DPA | Normandy authentication, new MSN authentication. Same usage as MSN.
NTLM | NT domain authentication. Use NULL credentials and attempt to use default logged in user credentials.
Sicily | Negotiate with the server for any of: MSN, DPA, NTLM. Should be used for LDAPv2 servers only.
Negotiate | Use GSSAPI Negotiate package to negotiate security package of either Kerberos V5 or NTLM (or any other package the client and server negotiate). Pass in NULL credentials to specify default logged in user. If Negotiate package is not installed on server or client, this will fall back to Sicily negotiation.


LDP UI
Overview | Notes | UI | Examples | Related Tools Open Command Prompt

To start LDP

The LDP dialog box consists of two panes. The scope pane on the left side lists the base object and any child objects. The details pane lists the results of the LDAP operations.

Connection Menu

The Connection menu Options:

Option | Description
Connect | Opens a dialog box that opens a session with a specified LDAP server. A connection must be established with an LDAP server before any other LDAP commands can be run. Enter the appropriate port number for the service you are connecting to. By default LDAP uses TCP for a connection-oriented session. To use UDP for a connectionless session, select the Connectionless checkbox. By default a successful connection results in the display of the RootDSE information in the detail pane.
Bind | Opens a dialog box that authenticates to a specified LDAP server. Enter a username and password of an account that has permissions to the LDAP server. If you enter an invalid user, then you will be connected with anonymous credentials. As a shortcut, use the Bind option without using the Connect option to connect, and authenticate with server last connected to.
Advance | Opens the a dialog box that sets options for the authentication methods. See Bind under the Options menu.
Disconnect | Terminates an open session with a specified LDAP server. Closing the LDP application automatically disconnects any open sessions.
New | Keeps the currently connected session, but clears the details pane. The keyboard shortcut for this action is CTRL+N. By default the details pane is accumulative.
Open | Opens text files and places the information in the details pane.
Save | Saves changes to a previously saved file.
Save as | Saves the contents of the details pane to a text file. Use the Open command to view the contents of this file in the details pane later.
Print | Prints the details pane.

NOTE

  • LDP can only connect to one LDAP server at a time. Using the Connect command while connected to a server will disconnect the current session.

Browse Menu

The Browse menu Options:

Add

Opens a dialog box that adds objects to Active Directory. The full distinguished name of the object must be entered, as well as all of the mandatory attributes for the class of object being added.

Option | Description
DN | Enter the full distinguished name of the new object.
Attribute | Enter the required or optional attribute.
Values | Enter the value(s) associated with the attribute. Separate multiple values for a single attribute with a semicolon. No spaces are required.
Enter | Click this button to add the entered attribute and value(s) to the Entry List section of the dialog box, and clear the Attribute and Value input boxes. Continue entering attributes and values until all required and desired optional attributes are on the Entry List.
Insert File | Opens a dialog box that allows a text file with the appropriate attributes and values to be used.
Entry List | Displays entered attributes and values.
Edit | Opens a dialog box that allows changes to the selected entry from the Entry List.
Remove | Deletes the selected entry from the Entry List.
Extended | Select this checkbox if the object being added is part of an extended control.
Synchronous | By default this checkbox is selected, requiring LDP to wait for a response from the destination server before continuing. Clear this checkbox to allow LDP to continue before a response is received. Clear this checkbox when slow WAN connections are causing LDP commands to timeout.
Run | Click this button to add the current attributes and values in the Entry List to Active Directory. If LDP encounters any errors, then the object will not be added and the error will display in the details pane.
Delete | Opens a dialog box that allows an object from Active Directory to be deleted. Attributes can be deleted only if they are defined as optional and contain no values. Use the Edit command to delete an attributes values.

DN

Option | Description
Dn | Enter the full distinguished name of the new object.
Extended | Select this checkbox if the object being deleted is part of an extended control.
Synchronous | By default this checkbox is selected, requiring LDP to wait for a response from the destination server before continuing. Clear this checkbox to allow LDP to continue before a response is received. Clear this checkbox when slow WAN connections are causing LDP commands to timeout.
Recursive (client) | Deletes all objects in a container, but does not delete the container.

Modify

Opens a dialog box that allows changes to the attributes of an object stored in Active Directory.

Option | Description
Dn | Enter the full distinguished name of the new object.
Attribute | Enter the required or optional attribute.
Values | Enter the value(s) associated with the attribute. Separate multiple values for a single attribute with a semicolon. No spaces are required.
Insert Files | Opens a dialog box that allows a text file with the appropriate attributes and values to be used.
Enter | Click this button to add the entered attribute and value(s) to the Entry List section of the dialog box, and to clear the Attribute and Value input boxes. Continue entering attributes and values until all required and desired optional attributes are on the Entry List.
Operation Section | Choose between Add, Delete, and Replace. Choose Add to add a new value to an existing attribute. Choose Delete to permanently remove an attribute from the listed object. Attributes containing data cannot be deleted. Also, attempting to delete required attributes results in an error. Choose Replace to replace an existing value with another. Choose Replace to change listed values for an existing attribute.
Entry List Section | Displays existing attributes and values for an object.
Edit | Opens a dialog box that allows changes to the selected entry from the Entry List.
Synchronous | By default this checkbox is selected requiring LDP to wait for a response from the destination server before continuing. Clear this checkbox to allow LDP to continue before a response is received. Clear this checkbox when slow WAN connections are causing LDP commands to timeout.
Extended | Select this checkbox if the object being modified is part of an extended control.
Run | Click this button to send the edited values in the Entry List to Active Directory.

Modify RDN

Opens a dialog box that allows changes to an object's relative distinguished name. This option is designed to modify leaf objects only. If you rename the container portion of the distinguished name, then the object will be moved to the container that is named.

Option | Description
Old DN | Enter the current distinguished name of the object.
New DN | Enter the new distinguished name for the object.
Delete Old | Specifies that the old distinguished name should be removed from the LDAP directory. This checkbox is selected by default.
Synchronous | By default this checkbox is selected, requiring LDP to wait for a response from the destination server before continuing. Clear this checkbox to allow LDP to continue before a response is received. Clear this checkbox when slow WAN connections are causing LDP commands to timeout.
Extended rename | Select this checkbox if the object being renamed is part of an extended control.
Run | Click this button to send the change to Active Directory.

Search

Opens a dialog box that creates a customized search filter, and performs the search on the directory information tree. The search base must be specified as a distinguished name, and the filter must be a valid LDAP filter. Items returned from a search are separated by >> characters.

Option | Description
Base DN | Enter a distinguished name to specify where the search should start from.
Filter | Enter the search criteria separated by LDAP search filters. Enter attributes and values to find an object or set of objects. Note: LDAP search filters are defined in RFC 2254, and in the Knoweldge Base Article Q255602 "Browsing and Querying Using the LDP Utility" at Microsoft Product Support Services (http://www.microsoft.com/).
Scope Section | Specifies how many levels the search should encompass.
Base | Searches the base object only.
One Level | Searches objects immediately subordinate to the base object, but does not search the base object.
Subtree | Searches the entire subtree, from the base object down to all child objects.
Options Button | Opens the Search Options dialog box. Allows the application of filters that allows some entries and excludes others from the search, and allows controls that affect how the search is processed. See the Options menu for more details.
Run | Click this button to send the search request to Active Directory.

Compare

Opens a dialog box that allows the user to compare the value of an object's attribute with a specified value. The result returned is either true or false.

Option | Description
DN | Enter the full distinguished name of the object whose value(s) will be compared.
Attribute | Enter attribute to be compared.
Values | Enter the value(s) that will be compared with the existing value in Active Directory. Separate multiple values for a single attribute with a semicolon. No spaces are required.
Synchronous | By default this checkbox is selected, requiring LDP to wait for a response from the destination server before continuing. Clear the checkbox to allow LDP to continue before a response is received. Clear this checkbox when slow WAN connections are causing LDP commands to timeout.
Run | Starts the comparison.

Extended Op

Opens a dialog box that allows the user to submit an extended operation to an LDAP Directory by specifying an LDAP Object identifier (OID) and an applicable value.

Option | Description
Oid | Enter the Object ID number.
Data | Enter the value of the OID attribute.
Controls | See Controls under the Option menu.
Send | Submits the extended operation to Active Directory.

GetLastError

Calls the LDAP Getlasterror function.

Security

Opens a dialog box that allows the user to submit an extended operation to an LDAP Directory by specifying an LDAP Object identifier (OID) and an applicable value.

Option | Description
Security Descriptor | Opens a dialog box that allows the viewing of access permissions on an object.
User Rights | Not implemented yet.

Replication

Opens a dialog box that allows the user to submit an extended operation to an LDAP Directory by specifying an LDAP Object identifier (OID) and an applicable value.

Option | Description
View Metadata | Opens a dialog box that allows the viewing of replication metadata of an object. This command is useful in identifying whether the objects are up to date and replicated between domain controllers.

Process Pending

Opens a dialog box that shows the list of requests that are not finished processing.

View Menu

The View menu Options:

Option | Description
Status Bar | Shows or hides the Status Bar located along the bottom of the LDAP window.
Tree | Opens a dialog box that specifies the base object in the scope pane. A default base object can be entered in the General Options dialog box in the Auto Base DN Query input box. By default this input box is blank and no object is listed in the scope pane.
Enterprise Configuration | Opens the Live Enterprise Tree dialog box that shows a graphic display of all domains and domain controllers in the enterprise. The dialog box indicates whether the domain controllers are online or offline by marking offline domain controllers with a red X.
Auto Refresh (min): | Enter the number of minutes that LDP should wait before refreshing the display.
Refresh | Manually refreshes the display.

Options Menu

The Options menu Options:

Bind Options

Option | Description
Function Type | Specifies a category of authentication that LDP will use when choosing authentication methods.
Generic | Specifies that a standard authentication protocol will be used.
Simple | Specifies that no authentication protocol will be used and the password will be sent in clear text.
Extended | Not available.
Method | Selects the type of authentication that LDP will use when passing credentials.
Synchronous | Use this checkbox to specify that the authenticating server must respond immediately to requests. This option only works with Simple authentication.
Use auth. identit | Allows the use of alternate authentication credentials. All authentication methods except simple require synchronous calls.

Search Options

Option | Description
Time Limit | Specifies the number of milliseconds that the search can take on the server. By default the maximum is 120 seconds.
Size Limit | Specifies the maximum number of bytes that the search can return. Entering a null value does not place a maximum size on the data returned.
Timeout (s) | Specifies the number of seconds that LDP will wait for the LDAP server to respond to a search request.
Timeout (ms) | Specifies the number of milliseconds that LDP will wait for the LDAP server to respond to a search request.
Page Size | Limits each page of returned data to the specified number of bytes.
Attributes | Specifies which attributes will be returned in the search. Separate multiple attributes with a semicolon. Use the asterisk (*) wildcard character to indicate all attributes.
Search Call Type | Specifies a call type to be used in the search. If the search will take some time, then selecting async allows you to perform other tasks while waiting for the search to complete.
Attributes Only | Select this checkbox to return only attributes of objects. The distinguished name will not be returned.
Chase Referrals | Performs a search for objects found in external LDAP driectories. By default, objects' external LDAP directories' trusts will only return a referral instead of the actual object.
Display Results | Displays a detailed list of objects returned by the search. By default only a success or failure, and the number of objects found, is displayed.
Sort Keys | Selecting this button will open the Sort Keys Option dialog box. See Sort Keys in the Options menu.
Controls | Selecting this button will open the Controls Option dialog box.

Pending Options

Opens a dialog box that places filters on the list of processes that have not yet completed.

Option | Description
All search results | Specifies that all search results will be displayed.
Blocking | Clear this checkbox to set a time limit.
Time Limit (sec): | Specifies a time limit in seconds.
Time Limit (millisec): | Specifies a time limit milliseconds

General Options

Option | Description
Value Parsing Section |
Binary | Displays the LDAP information in its native numerical format.
String | Converts the LDAP information from its native format to ASCII characters,so that it is more readable when displayed. This is the default setting. Values that are too long to be converted are still displayed in binary form.
LDAP Version Section | Specifies which version of LDAP the server is using. The default is version 3.
DN Processing Section | Converts the distinguished names, displayed into component parts, by extending the data types that LDP returns when performing a command. This option is useful for LDP developers.

Buffer Size Section

Option | Description
Page | Specifies the number of lines returned that will be displayed by LDP per command.
Line | Specifies the number of characters returned that will be displayed by LDP per command.
Auto default NC query | Specifies that LDP should query the default naming context when a connection to the LDAP server is made. The default naming context is the RootDSE. This setting is used when the distinguished name value in the View|Tree dialog box is left blank.

Virtual List View (VLV) Section

Option | Description
Auto VLV browse when continer size is greater than: | Selecting this checkbox displays a pop-up window of a virtual list view, whenever the object count is greater than the value displayed in the input box. The default value is 100.

Connection Options

Opens a dialog box that allows the value of any option to be changed.

Option Name | Enter the name of the option whose value will be reset.
Value | Enter the new value for the specified option.
Set | Sends the information to the LDAP Directory.

TLS Options

Starts or stops a secure session with the LDAP server using Transport Level Security (TLS).

Controls Option

Use LDAP controls to extend the functionality of LDAP.
The Object Identifier must be specified when implementing a control. To obtain a list of Object Identifiers, view the supportedControls property in the RootDSE of a domain controller. Individual controls are described in the Understanding LDAP whitepaper published by Microsoft (http://www.microsoft.com/).

NOTE

  • Only server controls can be sent to a server. Client controls only work with LDAP APIs.
  • To view a list of extended LDAP controls, search for the Knowledge Base article Q222560 "Windows 2000 Extended LDAP Controls" at Microsoft Product Support Services (http://www.microsoft.com/).

Sort Keys Option

Sort Keys is a type of control that formats the display of search results.

For more information find sortKeyRequestControl in the Understanding LDAP whitepaper published by Microsoft (http://www.microsoft.com/).

Utilities Menu

The Utilities menu Options:

Large Integer Converter For developers to convert large integers into High and Low parts.

NOTE

  • LDP can only connect to one LDAP server at a time. Using the Connect command while connected to a server will disconnect the current session.


LDP Examples

LDP UI
Overview | Notes | UI | Examples | Related Tools Open Command Prompt

Example 1: Add a New Object to an LDAP Directory

The following example uses LDP to add a user to Active Directory.

  1. Click the Browse menu and select Add.
  2. In the Add dialog box, enter the distinguished name of the new object in the Dn input box.
  3. In the Edit Entry section, add the new attributes and values. Click Enter after typing in each attribute and associated value:
    4. Attribute | Value
userAccountControl | 512
ObjectClass | User
SamAccountName | Testuser2
  4. Click Edit to add the attribute or value combination to the Entry List box.
  5. Once all the attributes are entered, click Run to add the information to Active Directory using LDAP APIs.

Example 2: Search an LDAP Directory

The following example performs several searches on Active Directory.

  1. Click the Browse menu and select Search.

    The Search dialog box opens.

  2. In this search, the LDAP directory is Active Directory, and for usernames it contains a givenName attribute for first names, and an attribute of sn for last names. To search for all users that have a first name of John and a last name of either Smith or Jones, use the following filter:

    (&(objectClass=user)(givenName=John)(|(sn=Smith)(sn=Jones))))

  3. To search for users that have a lastname of Jones, but filter out those users that have a first name of John or Jane, and also filter out users that have not logged on at least 100 times. The exclamation point (!) is the NOT operator.

    (&(objectClass=user)(sn=Jones)(!givenName=John)(!givenName=Jane)(!logonCount<=100))

    4. Note

    • To search for reserved characters as part of an attribute value, you must precede the reserved character with an escape character. Use the following escape characters to represent the associated characters:
    Character | Escape characters
* | 2a
( | 28
) | 29
\ | 5c
NUL | 00
  4. To search for all of the users whose display names end in a close parenthesis character, use the following search:

    (&(objectClass=user)(displayName=*\29))

  5. Queries support asterisk wildcards (*). To search for all users who have a surname that starts with the letter J:

    (&(objectClass=user)(sn=j*))

  6. The following search is for users whose home directories are G:\Accounting. The attribute name is home-directories:

    (&(objectClass=user)(home-directory=G:\5cACCOUNTING*))

Example 3: Control the Returns on a Search of an LDAP Directory

The following example uses the Search Options dialog box to control which attributes are displayed in a search. Just a few attributes are displayed, and the rest are filtered so that they are not displayed in the details window of LDP.

  1. In the Attributes input box, enter the attributes to display. Enter the following:
    "memberof;range:1-20"objectClass;objectGUID

    A range is specified for the memberof attribute. A semicolon is also used to do this so that the entire section must be separated from the rest of the attributes by quotes.

    2. Note

    • Separate attributes with a semicolon. No spaces are necessary. All other attributes will be filtered out of the display.
  2. All searches will display only the memberof, objectClass, and objectGUID attributes in the details pane.

    3. Note

    • To return all attributes, replace any existing list of attributes with the asterisk wildcard character (*).

Example 4: Viewing Replication Metadata for an Object

The following example uses LDP to list the replication metadata for an object in Active Directory.

  1. Click the Browse menu and select Replication|View Metadata.

    The View Metadata dialog box opens.

  2. Enter the distinguished name of the object in the Object Dn input box.
  3. Click OK
AttID | Ver | Loc.USN | Originating DSA | Org.USN | Org.Time/Date
0 | 1 | 3693 | 9fad4c38-2d76-44b2-84f6-f2fe384f8450 | 3693 | 2000-12-29 09:15.02
3 | 1 | 3693 | 9fad4c38-2d76-44b2-84f6-f2fe384f8450 | 3693 | 2000-12-29 09:15.02
d | 1 | 3693 | 9fad4c38-2d76-44b2-84f6-f2fe384f8450 | 3693 | 2000-12-29 09:15.02
20001 | 1 | 3693 | 9fad4c38-2d76-44b2-84f6-f2fe384f8450 | 3693 | 2000-12-29 09:15.02
20002 | 1 | 3693 | 9fad4c38-2d76-44b2-84f6-f2fe384f8450 | 3693 | 2000-12-29 09:15.02


Movetree.exe: Active Directory Object Manager
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool allows administrators to move Active Directory objects such as organizational units and users between domains in a single forest. These types of operations are performed to support domain consolidation or organizational restructuring operations.

MoveTree allows an organizational unit to be moved with all of the linked Group Policy objects in the old domain intact. The Group Policy object link is moved and continues to work, and clients receive their Group Policy settings from the Group Policy objects located in the old domain.

Corresponding UI

To move users or groups within a Windows XP Professional domain (for example, from one organizational unit to another), use Active Directory Users and Computers, a Microsoft Management Console snap-in that is part of the Windows XP Professional operating system.

Note

  • You must install Adminpak.msi before you can see the Active Directory Users and Computers snap-in in Adminstrative Tools.

Concepts

For more information on Active Directory, see Using Active Directory in Help and Support Center.

System Requirements

The following are the system requirements for MoveTree:

  • Windows XP Professional
  • Administrator rights

Files required

  • Movetree.dll
  • Movetree.exe


MoveTree Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Before Using MoveTree

Before using MoveTree you should do the following to maintain peak performance:

  1. Review all Group Policy objects that apply to a particular organizational unit, and make a note of the Group Policy settings they contain.
  2. Recreate the Group Policy objects, linked to the moved organizational unit in the new domain, with the desired settings.
  3. Make sure to remove the Group Policy objects linked from the old domain.

MoveTree Limitations

While MoveTree can move some Active Directory objects between domains, certain objects cannot be moved. MoveTree is also unable to move certain associated data that may exist externally to Active Directory.

Detailed Limitations

Local and Domain Global Groups

Local and Domain Global groups are not moved during a MoveTtee operation. During a MoveTree operation, all security principals (for example, user accounts and groups) maintain their security identity. This means that resources that were previously protected with ACLs do not have to have these ACLs reset. Provided that user and group memberships are maintained, security of access to resources is also maintained.

Universal Groups

Universal groups are moved intact during a MoveTree operation. However, because of group membership rules, only empty Domain Local and Global groups can be moved. Therefore it is important to save and recreate the memberships of Domain Local and Global groups to maintain the existing resource access permissions.

Computer Objects

Computer objects are not moved during a MoveTree operation. Use Netdom, another Windows XP Professional Support Tool, to move computer accounts between domains and to join computers to domains.

Associated Data

Associated data that is not moved during a MoveTree operation includes policies, profiles, logon scripts, and users' personal data. Use additional scripts or management tools, such as the Remote Administration Scripts (included in the Windows 2000 Resource Kit), in conjunction with MoveTree to perform these additional steps.

MoveTree cannot move the following objects:

  • system objects (identified by the objectClass being marked as systemOnly)
  • objects in the configuration or schema naming contexts
  • objects in the special containers in the domain: Builtin, ForeignSecurityPrincipal, System, LostAndFound
  • domain controllers or any object whose parent is a domain controller
  • any object with the same name as an object that already exists in the target domain

MoveTree may fail due to some of the following error conditions:

  • The source domain controller cannot transfer the RID role owner.
  • The source object is locked due to another operation in progress (for example, if another user is currently creating child objects under the source object that is selected for the move operation).
  • Either the source or destination domain have invalid credentials.
  • The destination knows the source object is deleted but the source does not (for example, the source object had been deleted on a different domain controller, but due to replication latency, the source domain controller has not yet received the deletion event).
  • There is a failure at the destination domain controller (for example, Disk Full).
  • A Security Accounts Manager (SAM) constraint is met (for example, Duplicate SAM Account Name or source object password length does not meet the password restrictions in the target domain).
  • The source and destination have a schema mismatch.

When a MoveTree Operation is Paused or Halted

During a MoveTree operation, if the process is paused or halted, then any objects that have yet to be moved remain in an orphan container in the Lost And Found container in the source domain. The Lost And Found container can be viewed in the Active Directory Users and Computers snap-in (a Windows XP Professional administrative tool) when the Advanced View menu option is selected. The orphan container is named using the globally unique identifier (GUID) of the parent container being moved and can be readily identified; it will contain the objects that were selected for the MoveTree operation.

For example, if an organizational unit called "Sales" was being moved, and it has an object GUID of {123-abc}, and the MoveTree operation were halted, then the tree structure would look like this:

Lost + Found
         {123-abc}
               Sales

MoveTree ErrorLevels

MoveTree returns ErrorLevel 0 for success and ErrorLevels 1 through 5 for different kinds of failure. These values can be used as criteria for branching, when the tool is used in a batch file; see Example 5: Use MoveTree in a Batch File in MoveTree Examples.

Error Level | Meaning
0 | Success
1 | Error – command line syntax
2 | Error – directory conflict (duplicate names, insufficient privilege, name conflict, immovable object)
3 | Error - network error (DC unavailable)
4 | Error – system resource (Low VM, disk space)
5 | Error – internal processing error


MoveTree Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

One Step movetree {/start | /startnocheck | /continue | /check} /s SrcDSA /d DstDSA /sdn SrcDN /ddn DstDN [/u [Domain\]Username /p Password] [/verbose] [{/? | /help}]

Parameters

/start
Starts a MoveTree operation. This command includes a /check operation by default (to start a MoveTree operation with no check, use /startnocheck). MoveTree tries to continue the operation until it completes; if there is a network fault or if the destination domain controller becomes unavailable, then MoveTree pauses the operation. If an operation has been paused, then it may be continued using the /continue command.
/startnocheck
Starts a MoveTree operation with no /check.
/continue
Continues the execution of a previously paused or failed MoveTree operation. This allows the MoveTree operation to continue even if a network fault or a domain controller error has interrupted the initial operation. Specifying /sdn SrcDN is optional for this command.
/check
Performs a test run of the MoveTree operation, checking the whole tree without moving any objects. This enables the administrator to determine if there is sufficent disk space on the destination server, if there are any conflicts with object names or if there are any objects that could not be moved (such as Domain Local or Global groups). The administrator may then take remedial action before performing the actual move.

The /check command returns an error if any of the following conditions are met:

  • The user does not have the necessary permissions to create objects in the destination container.
  • The destination server does not have sufficient disk space to continue the operation.
  • A relative distinguished name conflict exists on the destination server.
  • There is a samAccountName conflict for any object that would be moved.
  • Any objects cannot be moved because they are built-in accounts, or they are either a Domain Local or a Global group.
  • Any computer objects would be moved. To move computer accounts and join the computers to the domain, use NetDom, a Windows 2000 Support Tool.
/s SrcDSA
Specifies the fully qualified primary DNS name of the source server in the domain from which the objects are being moved (for example, Server1.Marketing.Microsoft.Com). Required for all MoveTree commands.
/d DstDSA
Specifies the fully qualified primary DNS name of the destination server in the domain to which the objects are being moved (for example, Server2.Sales.Microsoft.Com). Required for all MoveTree commands.
/sdn SrcDN
Specifies the distinguished name of the source sub-tree (the object being moved) (for example, OU=Promotions,DC=Marketing,DC=Microsoft,DC=Com). Required for the /start, /startnocheck, and /check commands; optional for /continue.
/ddn DstDN
Specifies the distinguished name of the destination sub-tree (to which the object is being moved) (for example, OU=Promotions,DC=Sales,DC=Microsoft,DC=Com). Required for all MoveTree commands.
/u [Domain\]Username /p Password
Runs MoveTree under the credentials of a valid Username and Password. Optionally, a Domain can be specified as well. If these optional arguments are not provided, MoveTree uses the credentials of the currently logged-on user.
/verbose
Runs MoveTree in verbose mode, which displays more details about the operation as it runs. Optional.
/? or /help
Displays this information on a command-line syntax screen.


MoveTree Examples
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

These examples assume the following scenario:

In the Marketing domain, there is a server called "Server1" and an organizational unit called "Promotions". In the Sales domain, there is a server called "Server2". The desired operation is to move the "Promotions" organizational unit from the Marketing domain to the Sales domain, and rename the new organizational unit "Sales Promotions".

Example 1: Perform MoveTree Operation Test Run and Move

You want to move the Promotions organizational unit from the Marketing domain to the Sales domain and rename the Promotions organizational unit to Sales Promotions. You decide that you want to do a test run and only perform the move if the test executes without errors. Type the following at the command line:

movetree /start /s Server1.Marketing.Microsoft.Com /d Server2.Sales.Microsoft.com /sdn OU=Promotions,DC=Marketing,DC=Microsoft,DC=Com /ddn OU=Sales Promotions,DC=Sales,DC=Microsoft,DC=Com

Example 2: Move Tree without Test

You want to move the Promotions organizational unit from the Marketing domain to the Sales domain and rename the Promotions organizational unit to Sales Promotions. You decide to do the move without doing a test run first. Type the following at the command line:

movetree /startnocheck /s Server1.Marketing.Microsoft.Com /d Server2.Sales.Microsoft.Com /sdn OU=Promotions,DC=Sales,DC=Microsoft,DC=Com /ddn OU=Sales Promotions,DC=Sales,DC=Microsoft,DC=Com

Example 3: Resume a Failed MoveTree Operation

A previous MoveTree operation between Server1 in the Marketing domain and Server2 in the Sales domain failed while the objects were being moved into the "Sales Promotion" organizational unit. To resume a failed the failed operation, type the following at the command line:

movetree /continue /s Server1.Marketing.Microsoft.Com /d Server2.Sales.Microsoft.Com /ddn OU=Sales Promotions,DC=Sales,DC=Microsoft,DC=Com

Example 4: Test a MoveTree Operation

Eventually you would like to move the Promotions organizational unit from the Marketing domain to the Sales domain, renaming it to Sales Promotions. You decide to do a test run and get verbose output to study before you perform the actual move. To perform this test using the credentials of Microsoft\administrator with the password "********" type the following at the command line:

movetree /check /s Server1.Marketing.Microsoft.Com /d Server2.Sales.Microsoft.Com /sdn OU=Promotions,DC=Sales,DC=Microsoft,DC=Com /ddn OU=Sales Promotions,DC=Sales,DC=Microsoft,DC=Com /verbose /u Microsoft\administrator /p ********

Example 5: Use MoveTree in a Batch File

You want to move the Promotions organizational unit from the Marketing domain to the Sales domain and rename the Promotions organizational unit to Sales Promotions. You decide that you want to do a test run and only perform the move if the test executes without errors, but you would like to do this from a batch file. Create a batch file with the following content:

movetree /check
 /s Server1.Marketing.Microsoft.Com
 /d Server2.Sales.Microsoft.Com
 /sdn OU=Promotions,DC=Marketing,DC=Microsoft,DC=Com
 /ddn OU=Sales Promotions,DC=Sales,DC=Microsoft,DC=Com
if errorlevel 0 goto start
goto exit
:start
movetree /start
 /s Server1.Marketing.Microsoft.Com
 /d Server2.Sales.Microsoft.Com
 /sdn OU=Promotions,DC=Marketing,DC=Microsoft,DC=Com
 /ddn OU=Sales Promotions ,DC=Sales,DC=Microsoft,DC=Com
:exit

For more information about error in MoveTree, see MoveTree ErrorLevels in MoveTree Notes.


Repadmin.exe: Replication Diagnostics Tool
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool assists administrators in diagnosing replication problems between Windows domain controllers.

Administrators can use RepAdmin to view the replication topology (sometimes referred to as RepsFrom and RepsTo) as seen from the perspective of each domain controller. In addition, RepAdmin can be used to manually create the replication topology (although in normal practice this should not be necessary), to force replication events between domain controllers, and to view both the replication metadata and up-to-datedness vectors.

Normally, the Knowledge Consistency Checker (KCC) manages the replication topology for each naming context held on domain controllers.

Important

  • During the normal course of operations, there is no need to manually create the replication topology. Incorrect use of this tool may adversely impact the replication topology. The primary use of this tool is to monitor replication so that problems such as offline servers or unavailable LAN/WAN connections can be identified.

Corresponding UI

RepAdmin is used to troubleshoot replication issues in Active Directory. Many of the actions performed at the command line with RepAdmin can be accomplished with ReplMon.

Concepts

For more information on replication, see Introduction to Performance in the Help and Support Center.

System Requirements

The following are the system requirements for RepAdmin:

  • Windows XP Professional
  • Administrator rights on the domain controller

File Required

  • Repadmin.exe


RepAdmin Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

RepAdmin Terminology

The following terminology is used in discussing RepAdmin syntax:

  • NamingContext refers to the directory partitions that are part of Active Directory. This includes the three read/write naming contexts — domain, schema and configuration — and the optional read-only naming context, the Global Catalog. A naming context is specified by the distinguished name of its root (for example, DC=MyDomain,DC=Microsoft,DC=Com).
  • GUID (Globally Unique Identifier) refers to the 128-bit number used to uniquely identify objects stored in the directory (for example, fa1a9e6e-2e14-11d2-aa9b-bbfc0a30094c). The GUID is sometimes referred to in the syntax line as a Universally Unique Identifier (UUID). For the purposes of RepAdmin these two terms are synonymous.
    • DN is an X.500 distinguished name (for example, CN=Server1,CN=First Site,CN=Configuration,DC=Microsoft,DC=Com).

Difference Between the objectGUID and the InvocationID

In the RepAdmin Examples the objectGUID and the InvocationID returned by the showreps and other operations are identical hexadecimal numbers. However, they are not the same thing. An objectGUID is a unique identifier for an object that will never change. Initially the two are the same, however when Active Directory is backed up the Invocation ID will change.


RepAdmin Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

RepAdmin uses the following general syntax:

One Step repadmin Operation Parameters [/u:{domain\\user}] [/pw:{password|*}]

/u
Specifies the username that has permissions to perform operations in Active Directory.
/pw
Specifies the password for the username entered with the u parameter.

Operations

Repadmin bind

Connects to and displays the replication features for a directory partition on a domain controller.

One Step repadmin /bind [DSA]

Parameters

DSA
Specifies the host name of the domain controller (Directory Server Agent).

Repadmin failcache

Dispays a list of failed replication events detected by the Knowledge Consistency Checker.

One Step repadmin /failcache [DSA]

Parameters

DSA
Specifies the host name of the domain controller (Directory Server Agent).

Repadmin getchanges

Displays changes from a specified directory partition or changes to a specified object. Syntax 1 saves changes to a directory partition. If this information is saved to a file the getchanges operation can be run again for comparison. Syntax 2 shows changes to a specified object.

Syntax 1

One Step repadmin /getchanges NamingContext [SourceDSA] [/cookie: File]

Syntax 2

One Step repadmin /getchanges NamingContext [DestDSA] SourceDSAobjectGUID [/verbose] [/statistics]

Parameters

NamingContext
Specifies the distinguished name of the directory partition.
SourceDSA
Specifies the host name of the domain controller that hosts the directory partition (Directory Server Agent) whose changes you want to view.
/cookie: File
Specifies a name for the file to which list changes are saved.
DestDSA
Specifies the host name of the domain controller that hosts the object (Directory Server Agent) whose changes you want to view.
SourceDSAobjectGUID
Specifies the unique hexadecimal number that identifies the object whose changes will be listed. The objectGUID can be retrieved by using the /showreps operation.
/verbose
Lists detailed information.
/statistics
Displays a summary of information about changes instead of a list of individual changes.

Remarks

  • The information from Syntax 1 can be saved to a file for later comparison.

Examples

See Example 6: Create a File to Determine What Changes Have Occurred Over a Period of Time.

Repadmin kcc

Forces the Knowledge Consistency Checker to recalculate replication topology for a specified domain controller. By default this recalculation occurs every 15 minutes.

One Step repadmin /kcc [DSA] [/async]

Parameters

DSA
Specifies the host name of the domain controller (Directory Server Agent).
/async
Specifies that replication will be asynchronous. This means that RepAdmin will start the replication event, but it does not expect an immediate response from the destination domain controller. Use this parameter when there are slow links between domain controllers.

Repadmin propcheck

Compares properties of specified domain controllers to determine if they are up to date with each other. The source domain controller contains the original information that needs to be checked. The destination domain controller data will be compared to the source domain controller data.

One Step repadmin /propcheck NamingContext OriginatingDSAInvocationID OriginatingUSN [DestDSA]

Parameters

NamingContext
Specifies the distinguished name of the directory partition on the source domain controller.
OriginatingDSAInvocationID
Specifies the unique hexadecimal number that identifies an object on a source domain controller. InvocationID can be retrieved by using the /showreps operation.
OriginatingUSN
Specifies the USN for the object on the source domain controller. The USN is for the object whose InvocationID is already listed.
DestDSA
Specifies the host name of the destination domain controller (Directory Server Agent) from which to enumerate the host DSAs.

Repadmin queue

Displays tasks waiting in the replication queue.

One Step repadmin /queue [DSA]

Parameters

DSA
Specifies the host name of the domain controller (Directory Server Agent).

Repadmin showcert

Displays the server certificates loaded on a specified domain controller

One Step repadmin /showcert [DSA]

Parameters

DSA
Specifies the host name of the domain controller (Directory Server Agent).

Repadmin showconn

Displays the connection objects for a specified domain controller. Default is local site.

One Step repadmin /showconn [DSA] [{ContainerDN|DSAGUID}]

Parameters

DSA
Specifies the host name of the domain controller (Directory Server Agent).
ContainerDN
Specifies the distinguished name of the container.
DSAGUID
Specifies the unique hexadecimal number that identifies the domain controller. The DSA GUID can be retrieved using the /showreps operation.

Examples

See Example 7: Display the Connection Objects for a Server.

Repadmin showctx

Displays a list of computers that have opened sessions with a specified domain controller.

One Step repadmin /showctx [DSA] [/nocache]

Parameters

DSA
Specifies the host name of the domain controller (Directory Server Agent).
/nocache
Specifies that GUIDs are left in hexadecimal form. By default GUIDs are translated into strings.

Examples

See Example 9: Display the Context Handles for the Replication Process.

Repadmin showism

Displays intersite messaging routes calculated by the Knowledge Consistency Checker (KCC). This operation cannot be executed remotely.

One Step repadmin /showism [TransportDN] [/verbose]

Parameters

TransportDN
Specifies whether the mail server is using SMTP or RPCs to send messages.
/verbose
Lists detailed information.

Repadmin showmeta

Displays the replication metadata for a specified object stored in Active Directory such as attribute ID, version number, originating and local Update Sequence Number (USN), and originating server's GUID and date/time stamp. By comparing the replication metadata for the same object on different domain controllers, an administrator can determine whether replication has taken place.

One Step repadmin /showmeta ObjectDN [DSA] [/nocache]

Parameters

ObjectDN
Specifies the distinguished name of the object.
DSA
Specifies the host name of the domain controller that hosts the object (Directory Server Agent).
/nocache
Specifies that GUIDs are left in hexadecimal form. By default GUIDs are translated into strings.

Repadmin showmsg

Displays the error message for a given error number.

One Step repadmin /showmsg Win32Error

Parameters

Win32Error
Specifies the number of the Win32 error.

Repadmin showreps

Displays the replication partners for each directory partition on the specified domain controller. Helps the administrator build a visual representation of the replication topology and see the role of each domain controller in the replication process.

One Step repadmin /showreps [NamingContext] [DSA] [SourceDSAobjectGUID] [/verbose] [/unreplicated] [/nocache]

Parameters

NamingContext
Specifies the distinguished name of the directory partition.
DSA
Specifies the host name of the domain controller (Directory Server Agent).
SourceDSAobjectGUID
Specifies the unique hexadecimal number that identifies the object whose replication events will be listed.
/verbose
Lists detailed information.
/unreplicated
Shows pending changes.
/nocache
Specifies that GUIDs are left in hexadecimal form. By default GUIDs are translated into strings.

Examples

See Example 1: Display the Replication Partners of a Server.

Repadmin showsig

Displays the replication signature for a specified domain controller.

One Step repadmin /showsig [DSA]

Parameters

DSA
Specifies the host name of the domain controller (Directory Server Agent).

Examples

See Example 8: Display the Replication Signature for a Server.

Repadmin showtime

Converts a directory service time value to string format for both the local and the UTC time zones.

One Step repadmin /showtime [DSTimeValue]

Parameters

DSTimeValue
Specifies the time value that needs to be converted.

Remarks

  • With parameters omitted, repadmin /showtime displays the current system time in both the directory service format and string format.
  • The string format displays both the local and UTC time zones.

Repadmin showvector

Displays the highest Update Sequence Number (USN) for the specified domain controller. This information shows how up to date a replica is with its replication partners.

One Step repadmin /showvector NamingContext [DSA] [/nocache]

Parameters

NamingContext
Specifies the distinguished name of the directory partition.
DSA
Specifies the host name of the domain controller (Directory Server Agent).
/nocache
Specifies that GUIDs are left in hexadecimal form. By default GUIDs are translated into strings.

Examples

See Example 4: Display the Highest Update Sequence Number on a Server.

Repadmin sync

Starts a replication event for the specified directory partition between the source and destination domain controllers. The source DSA UUID can be determined when viewing the replication partners with the repadmin /showreps command.

One Step repadmin /sync NamingContext DestDSA SourceDSAUUID [/force] [/async] [/full] [/addref] [/allsources]

Parameters

NamingContext
Specifies the distinguished name of the directory partition.
destDSA
Specifies the host name of the domain controller (Directory Server Agent) with which you want to replicate.
SourceDSAUUID
Specifies the unique hexadecimal number that identifies the object whose changes will be listed. The objectGUID can be retrieved using the /showreps operation.
/force
Overrides the normal replication schedule.
/async
Specifies that the replication will be asynchronous. This means that RepAdmin will start the replication event, but it does not expect an immediate response from the destination domain controller. Use this parameter when there are slow links between domain controllers.
/full
Forces a full replication of all objects from the destination domain controller.
/addref
Directs the source to check for a notification entry on the source. If the source does not have a notification entry for this destination, one is added.
/allsources
A given destination may have multiple sources for the same naming context. Directs the destination to sync with all sources instead of just one.

Examples

See Example 2: Force a Replication Event Between Two Replication Partners.

Repadmin syncall

Synchronizes a specified domain controller with all replication partners.

One Step repadmin /syncall DestDSA [NamingContext] [Flags]

Parameters

DestDSA
Specifies the host name of the domain controller (Directory Server Agent) to synchronize with all replication partners.
NamingContext
Specifies the distinguished name of the directory partition.
Flags
Performs specific actions during the replication.
/a | Abort if any server is unavailable
/d | ID servers by DN in messages
/e | Enterprise, cross sites
/h | Print this help screen
/i | Iterate indefinitely
/I | Perform showreps on each server pair in path instead of syncing
/j | Sync adjacent servers only
/p | Pause for possible user abort after every message
/P | Push changes outward from home server
/q | Quiet mode, suppress callback messages
/Q | Very quiet, report fatal errors only
/s | Do not sync
/S | Skip initial server-response check

Examples

See Example 3: Force a Replication Event for a Specified Directory Partition with All of its Replication Partners.


RepAdmin Examples
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Display the Replication Partners of a Server

The following example uses the showreps operation of RepAdmin to display the replication partners of Server1. This command is also used to find the objectGUID and InvocationID for a server for use with other operations.

No parameters are required for the showreps operation. A remote connection is assumed so the server name (DSA in the syntax) is included. Type the following at the command line:

repadmin /showreps server1.microsoft.com

Press enter and the following output is displayed:

Building7a\server1
DSA Options : IS_GC
objectGUID : 415db077-le28-4855-b225-c5bb9af6f50b
InvocationID: 415db077-le28-4855-b225-c5bb9af6f50b

==== INBOUND NEIGHBORS ======================================

CN=Schema,CN=Configuration,DC=microsoft,Dc=com
    Building7b\server2 via RPC
         objectGuid: e55c6c85-85bb-495a-a0d3-020a44c3afe7
         last attempt @ 2001-08-26 11:47.15 was successful.

CN=Configuration,DC=microsoft,Dc=com
    Building7b\server2 via RPC
          objectGuid: e55c6c85-85bb-495a-a0d3-020a44c3afe7
        @nbsp last attempt @ 2001-08-26 12:02.30 was successful.

DC=microsoft,Dc=com
     Building7b\server2 via RPC
          objectGuid: e55c6c85-85bb-495a-a0d3-020a44c3afe7
          last attempt @ 2001-08-26 11:48.16 was successful.

==== OUTBOUND NEIGHBORS FOR CHANGE NOTIFICATIONS ============

CN=Schema,CN=Configuration,DC=microsoft,Dc=com
     Building7b\server2 via RPC
          objectGuid: e55c6c85-85bb-495a-a0d3-020a44c3afe7

CN=Configuration,DC=microsoft,Dc=com
     Building7b\server2 via RPC
          objectGuid: e55c6c85-85bb-495a-a0d3-020a44c3afe7

DC=microsoft,Dc=com
     Building7b\server2 via RPC
          objectGuid: e55c6c85-85bb-495a-a0d3-020a44c3afe7

Example 2: Force a Replication Event Between Two Replication Partners

The following example uses the sync operation of RepAdmin to force the domain directory partition for Microsoft.com on Server1 to replicate with the domain directory partition on Server2. This makes Server2, the source, and Server1, the destination server.

The required parameters for the sync operation are the name of the directory partition (NamingContext in the syntax), the name of the server that will receive changes (Destination_DSA in the syntax), and the objectGUID of the directory partition that will send the changes (Source_DSAUUID in the syntax). Type the following at the command prompt:

repadmin /sync dc=microsoft,dc=com server1.microsoft.com e55c6c85-85bb-495a-a0d3-020a44c3afe7

Press enter and the following output is displayed:

Sync from e55c6c85-85bb-495a-a0d3-020a44c3afe7 to server1.microsoft.com completed successfully.

Example 3: Force a Replication Event for a Specified Directory Partition with All of Its Replication Partners

The following example uses the syncall operation of RepAdmin to force the domain directory partition for Microsoft.com on Server1 to replicate with all of its replication partners.

The required parameters for the syncall operation are the server name (DestDSA in the syntax). The name of the directory partition (NamingContext in the syntax) that will be synchronized is included also. If this name is not included, then all directory partitions are synchronized. Type the following at the command line:

repadmin /syncall server1.microsoft.com dc=microsoft,dc=com

Press enter and the following output is displayed:

CALLBACK MESSAGE: SyncAll Finished.

Example 4: Display the Highest Update Sequence Number on a Server

The following example uses the showvector operation of RepAdmin to show the highest USNs for a specified directory partition on each replication partner. In this example, there are only two replication partners and the directory partition is the domain directory partition for the Microsoft.com domain.

The only required parameter for the showvector operation is the name of the directory partition (NamingContext in the syntax). A remote connection is assumed so a server name (DSA in the syntax) is also included. Type the following at the command prompt:

repadmin /showvector dc=microsoft,dc=com server2.microsoft.com

Press enter and the following output is displayed:

Building7a\server1                    @ USN 173259
Building7b\server2                    @ USN 51830

Example 5: View Unreplicated Changes Between Two Servers

The following example uses the getchanges operation of RepAdmin to show changes that have not yet replicated between Server1 and Server2. In this example Server1 is the source server and is sending the changes while Server2 is the destination server and is receiving the changes.

This is one implementation of the getchanges operation. For another implementation of this operation see Example 6: Create a File to Determine What Changes Have Occurred Over a Period of Time.

The required parameters for this version of the getchanges operation are the name of the directory partition (referred to in the syntax line as naming context) and the objectGuid of the directory partition on the source server (referred to as Source_DSA_UUID in the syntax line). A remote connection is assumed so the destination server name (referred to in the syntax line as Dest DSA) is also included. Type the following at the command prompt:

repadmin /getchanges dc=microsoft,dc=com server2.microsoft.com 415db077-1e28-4588-b225-c5bb9af6f50b

Press enter and the following output is displayed:

Building starting position from destination server server2.microsoft.com

Source Neighbor:
dc=microsoft, dc=com
    Building7a\server1 via RPC
        objectGuid: 415db077-1e28-4588-b225-c5bb9af6f50b
        Address: 415db077-1e28-4588-b225-c5bb9af6f50b._msdcs.microsoft.com
        ntdsDsa invocationID: 415db077-1e28-4588-b225-c5bb9af6f50b
        WRITEABLE DO SCHEDULE SYNCS COMPRESS_CHANGES NO_CHANGE_NOTIFICATIONS
        USNs: 173257/OU, 173257/PU
        Last attempt @ 2001-08-26 12:44.11 was successful.

Destination's Up To Dateness Vector:
4                    @ USN 173277
b                    @ USN 51810

==== Source DSA: 415db077-1e28-4588-b225-c5bb9af6f50b._msdcs.microsoft.com ====

No changes.

Example 6: Create a File to Determine What Changes Have Occurred Over a Period of Time

The following example uses the getchanges operation of RepAdmin to create a file that records replication changes. By running the getchanges operation later you can compare the file created earlier to the current replication state.

This is one implementation of the getchanges operation. For another implementation of this operation see Example 5: View Unreplicated Changes Between Two Servers.

The only required parameter for this version of the getchanges operation is the name of the directory partition (NamingContext in the syntax) on which the check should be performed. In this example, the check is performed remotely so the server name (SourceDSA in the syntax) is included as well as the /cookie parameter, along with the name of the file to be created. Type the following at the command prompt:

repadmin /getchanges dc=microsoft,dc=com server2.microsoft.com /cookie:microsoft.txt

Press enter and the following output is displayed:

Using cookie from file microsoft.txt (132 bytes)

==== Source DSA: server2.microsoft.com ====

No changes.

Using cookie from file microsoft.txt (132 bytes)

Example 7: Display the Connection Objects for a Server

The following example uses the showconn operation of RepAdmin to show connection objects for a server.

No parameters are required for showconn operation. In this example, a remote connection is assumed so the server name (DSA in the syntax) is specified. All connection objects for Server2 are shown. Type the following at the command prompt:

repadmin /showconn server2.microsoft.com

Press enter and the following output is displayed:

Show Connection Objects
CN=Building7b,CN=Sites,CN=Configuration,DC=microsoftDc=com:
    server2\febe8edf-85b6-4744-902a-1754c1401ac2
         enabledConnection: TRUE
         fromServer: Building7a\server1
         TransportType: IP
         options: isGenerated overrideNotifyDefault
          ReplicatesNC: CN=Configuration,DC=microsoft,DC=com
          ReplicatesNC: DC=microsoft,DC=com
         whenChanged: 20000526193849.0Z
         whenCreated: 20000526193849.0Z

Example 8: Display the Replication Signature for a Server

The following example uses the showsig operation of RepAdmin to show the replication signature for a server.

No parameters are required for the showsig operation. In this example, a remote connection is assumed so the server name (DSA in the syntax) is specified. Type the following at the command prompt:

repadmin /showsig server1.microsoft.com

Press Enter and the following output is displayed:

Building7a\server1

415db077-1e28-4588-b255-c5bb9af6f50b (current)

No retired signatures.

Example 9: Display the Context Handles for the Replication Process

The following example uses the showctx operation of RepAdmin to show the open connections to the server that are established by remote servers.

No parameters are required for the showctx operation. This example specifies the directory partition (NamingContext in the syntax) and the server name (DSA in the syntax) on which the check should be performed. Type the following at the command prompt:

repadmin /showctx server2.microsoft.com

Press enter and the output similar to the following is displayed:

6 open handles.

NTDSAPI client @ 157.59.128.201 (PID 948) (Handle 0x5c925c8)
    bound, refs=1, lasted used 2000-05-26 10:23.9

Building7a\server1 @ 157.59.128.242 (PID 256) (Handle 0x914e100)
    bound, refs=1, lasted used 2000-05-26 13:30.26

NTDSAPI client @ 127.0.0.1 (PID 1368) (Handle 0x5c92330)
    NOT bound, refs=0, lasted used 2000-05-26 13:41.52

NTDSAPI client @ 157.59.128.201 (PID 244) (Handle 0x5c5bd08)
    NOT bound, refs=0, lasted used 2000-05-26 13:43.27

NTDSAPI client @ 127.0.0.1 (PID 1420) (Handle 0x91b88e8)
    NOT bound, refs=0, lasted used 2000-05-26 13:44.40

NTDSAPI client @ 127.0.0.1 (PID 1356) (Handle 0x5c8e290)
    bound, refs=1, lasted used 2000-05-26 13:44.52


Replmon.exe: Active Directory Replication Monitor
Overview | Notes | UI | Examples | Related Tools Run Tool

This GUI tool enables administrators to view the low-level status of Active Directory replication, force synchronization between domain controllers, view the topology in a graphical format, and monitor the status and performance of domain controller replication.

You can use ReplMon to do the following:

  • See when a replication partner fails.
  • View the history of successful and failed replication changes for troubleshooting purposes.
  • View the properties of directory replication partners.
  • Create your own applications or scripts written in Visual Basic Scripting Edition (VBScripts) to extract specific data out of Active Directory and act on it.
  • View a snapshot of the performance counters on the computer, and the registry configuration of the server.
  • Generate status reports that include direct and transitive replication partners and detail a record of changes.
  • Find all direct and transitive replication partners on the network.
  • Display replication topology.
  • Poll replication partners and generate individual histories of successful and failed replication events.
  • Force replication.
  • Trigger the Knowledge Consistency Checker to recalculate the replication topology.
  • Display changes that have not yet replicated from a given replication partner.
  • Display a list of the trust relationships maintained by the domain controller being monitored.
  • Display the metadata of an Active Directory objects' attributes.
  • Monitor replication status of domain controllers from multiple forests.

Note

  • Installing ReplMon in a directory other than the default might result in errors. For more information, see Installing ReplMon.

Corresponding UI

ReplMon provides its own user interface. See ReplMon UI for more information.

Concepts

For more information about deploying and using Active Directory, see the Active Directory Overview (http://go.microsoft.com/fwlink/?LinkId=1646) Web site.

System Requirements

The following are the system requirements for ReplMon:

  • ReplMon must be installed on a computer running Windows XP Professionalr. The computer can be a domain controller, member server, member workstation, or standalone computer.

Files Required

  • Comctl32.ocx
  • Comdlg32.ocx
  • Ctl3d32.dll
  • Iadstools.dll – component DLL that hosts the functions used by ReplMon
  • Iadstools.doc - documentation for IADsTools
  • Replmon.exe
  • Tabctl32.ocx


ReplMon Notes
Overview | Notes | UI | Examples | Related Tools Run Tool

Installing ReplMon

If you choose to install Support Tools into a directory other than the default of Program Files\Support Tools, the required Visual Basic controls might fail to register. This happens only if the Support Tools are installed into a directory that contains extended characters. If this occurs, the workaround is to uninstall the Support Tools and then to install them into the Progam Files\Support Tools folder.

Context-Sensitive Menus

ReplMon is designed for use with context-sensitive menus. ReplMon UI and ReplMon Examples specify the menu options as the method for accessing commands. For a shortcut, right-click objects in the ReplMon window and then a context sensitive menu appears.

Creating a List of Monitored Servers

The list of monitored servers in ReplMon can be created by adding each server individually. If a number of servers must be monitored on a regular basis, however, the task of building the list can be automated by creating a file that lists the servers to be monitored. The file is created either by using a text editor or in ReplMon by saving a list of servers already being monitored. The file is then opened in ReplMon.

To create a list of monitored servers and save it as a text file

  1. Open a text editor.
  2. Type a list of host names for the servers. Each server must be on its own line.
  3. If alternative credentials are needed, add a comma after ServerName, followed by Domain\User. If the ServerName is Server1, Domain is Microsoft.com, and the User is Admin, the command looks like the following:

    4. server1\microsoft.com\admin

    The password is not included for security reasons. When the text file is read by ReplMon, a dialog box prompts the user for the password.

  4. Save the file with a .ini extension in the Program Files\Active Directory Replication Monitor folder.

Another way to create a text file of servers is by using ReplMon. If ReplMon is open and monitoring servers, the current list of monitored servers can be saved for future use.

To create a list of monitored servers from ReplMon

  1. While monitoring a list of servers in ReplMon, click the File menu and then select Save Monitored List As.
  2. Save the file with a .ini extension in the Program Files\Active Directory Replication Monitor folder.

Populating the Monitored Servers List in ReplMon

To load an .ini file to create a list of monitored servers for ReplMon

  1. With ReplMon open, click the File menu and then select Open Script. A list of .ini files from the Program Files\Active Directory Replication Monitor displays.
  2. Select the .ini file that contains the list of servers to be monitored.

ReplMon and RepAdmin Similarities

Many of the tasks that can be performed with ReplMon can be performed from the command line by using RepAdmin.


Replmon UI
Overview | Notes | UI | Examples | Related Tools Run Tool

ReplMon has the following menus:

File Menu Options

File menu options:

Option | Description
Open Script | Opens a dialog box that automatically populates the Active Directory Replication Monitor with monitored servers. These files have a .ini extension and can be created by using a text editor or by using the Save Monitored List As command in the File menu.
Save Monitored List As | Opens a dialog box that saves a list of monitored servers in a .ini file. This list can be opened later by using the Open Script command on the File menu. If the currently logged-on user does not have permissions to monitor a server listed, then a user name must be supplied after ServerName using the Domain\User format. Do not supply the password in the .ini file. The password is requested as each server is added to the monitored list when the .ini file is read.
Open Log | Opens a previously created .log file. Log files are created by default for every monitored server and statistics are tracked on a per-replication partner and a per-directory partition basis.
Exit | Closes ReplMon and discontinues monitoring servers.

Edit Menu Options

Edit menu options:

Option | Description
Add Monitored Server | Opens a dialog box that adds a single server to the list of servers monitored by ReplMon. By default, ReplMon does not monitor any servers. If you know the name of the server, click Add the server explicitly by name, and then type the name of the server. If you need to browse for the server, click Search the directory for the server to add, and then click Next. The entire forest can be searched if necessary. Enter a user name and password by selecting the Use Alternate Credentials checkbox.

Action Menu Options

Action menu options:

Domain submenu options:

Option | Description
Domain | Opens the Search Domain Controllers for Replication Errors submenu option.

Server submenu options:

Option | Description
Update Status (only for this server) | Triggers an immediate status check for the selected server. The time of the updated status is logged and displayed.
Check Replication Topology | Triggers the Knowledge Consistency Checker (KCC) to recalculate the replication topology for the selected server.
Synchronize Each Directory Partition with All Servers | Triggers replication for the selected server's directory partitions with each partitions replication partners.
Generate Status Report | Creates and saves a status report for the selected server. You can use the Save As dialog box to name the status report. To select the information that should be on the status report, select Report Options.
Show Domain Controllers in Domain | Opens a dialog box that lists all of the domain controllers that belong to the selected server's domain. Click OK to close this dialog box.
Show Replication Topologies | Creates a graphical view of all replication partners for all directory partitions.
Show Group Policy Object Status | Lists Group Policy objects for a specified domain controller and the object's current version number. Also lists version numbers of the Group Policy object in SysVol.
Show Current Performance Data | Displays real-time performance monitor counters that are specific to Active Directory replication.
Show Global Catalog Servers in Enterprise | Opens a dialog box that lists a list of Global Catalog servers in the selected server's forest. Click OK to close this dialog box.
Show Bridgehead Servers | Displays a list of Bridgehead servers for the selected server's site or enterprise. Click OK to close this dialog box.
Show Trust Relationships | Displays a list of trust relationships for the selected server's enterprise. Click OK to close this dialog box.
Show Attribute Meta-Data for Active Directory Object | Displays the attribute metadata for a specified object. Enter the distinguished name of the object in the Object dialog box and then click OK.
Clear Log | Clears the contents of the log file generated by ReplMon.
Delete | Removes the selected server from the list of monitored servers in ReplMon.
Properties | Displays properties of the selected server.

Site submenu options:

Option | Description
Site | Starts the Add Monitored Server wizard.

Naming Context submenu options:

Option | Description
Synchronize This Directory Partition with All Servers | Synchronizes a selected directory partition with all domain controllers on the site.
Show Change Notifications To Replication Partners | Lists the replication messages sent to direct replication partners.

Replication Partner submenu options:

Option | Description
Check Current USN and Unreplicated objects | Displays information on a selected server's replication partner. Displays unreplicated changes on selected replication partners.
Synchronize Each Directory Partition with All Servers | Manually synchronizes all of the directory partitions on a server with its replication partners. To synchronize an individual replication partner, right-click that replication partner and select Synchronize with this Replication Partner.

View Menu Options

View menu options:

Option | Description
Details View | Opens a window that shows a log of server status updates.
Refresh | Updates all listed servers. Refreshes automatically every 5 minutes. To change the refresh interval, click the Update Automatically button and enter a value from 1 to 60.

Options dialog box General tab:

Option | Description
Show Retured Replication Partners | Shows servers that are no longer replication partners in the graphical replication topology display.
Show Transitive Replication and Extended Data | By default, only replication events from direct replication partners are entered in the log. To log replication events from transitive partners also, select this checkbox.
Notify when replication fails after this number of attempts: | Enter a number of attempts after which ReplMon notes that replication is failing. Specify whether to enter this event in the Application log or send an e-mail message.
Auto Generate File Names for Log Files | By default, ReplMon automatically creates a name for log files.
Default Path For Replication Status Logs | Specify a path to which ReplMon automatically saves log files.
Enable Debug Logging | Creates a separate log that can be used to troubleshoot errors in ReplMon.

Options menu Status Logging tab:

Option | Description
Group Policy Objects | Enables Group Policy object logging.
Performance Statistics | Enables the addition of performance objects and counters to ReplMon's log.
Display Changed Attributes When Replication Occurs | Records each attribute changed, and the Update Sequence Number associated with the change, in ReplMon's log.

The Cache tab:

Option | Description
Reset Button | Flushes ReplMon's cache.


ReplMon Examples
Overview | Notes | UI | Examples | Related Tools Run Tool

Example 1: Generate a Status Report for a Server

The following procedure creates a log file that records replication events for an individual server. This data is used to troubleshoot possible replication errors in the forest or domain.

To create the log file

  1. In ReplMon, select the server in the Monitored Servers section of the window.
  2. On the Action menu, select Server, and then click Generate Status Report. The Save As dialog box appears.
  3. In the Save As dialog box, type a name for the log file that will be generated, and then select a new path for the file, if desired.
  4. Click Save.
  5. In the Report Options dialog box, select the type of information to be logged.
  6. To save the log file and return to ReplMon, click OK.

Notes

  • If a log file is given the same name as an existing log file, ReplMon replaces the existing log file without a warning. To avoid this, use a naming scheme that includes the current date.
  • To set the default path, on the View menu, select Options, and then use the General tab of the Options dialog box.

Example 2: Display the Replication Topology for a Server

The following procedure displays replication partners of a server, which graphically represents the replication topology.

To display replication partners

  1. In the Monitored Servers section of the dialog box, select the server.
  2. On the Action menu, select Server and then click Show Replication Topologies.
  3. In the View Replication Topology window, select the View menu and then click Replication Topologies.
  4. In ReplMon on the Options menu, select Report.

Example 3: Display Pending Replication Changes

Each domain controller keeps a record of the last changes received from other domain controllers by using the update sequence number (USN) of the replication partner. If changes have occurred on the replication partner and the Active Directory replication process has not propagated those changes to the monitored server, you can use this procedure to show what objects have changed and need to be replicated to the monitored server. This is done on a per-directory partition level.

To show what objects have changed

  1. In ReplMon, expand the monitored server to display the list of directory partitions.
  2. Expand and select the replication partner within the directory partition for which you want to view unreplicated changes. Only objects that have changed within the directory partition are displayed.
  3. On the Action menu, click Replication Partner and then select Check Current USN and Unreplicated Objects. A separate window opens.

Detected changes are displayed and can be saved to a text file. If no changes are detected, a message box is displayed that informs you of the current USN on the replication partner and that all changes have replicated to the monitored server.

Example 4: Synchronizing Directory Partitions

The following procedure forces a replication event between two directory partitions. By default, directory partitions on servers periodically synchronize with each other. Manual synchronization is only necessary if the network or a server is down for an extended period of time.

To manually synchronize two directory partitions

  1. In the Monitored Servers pane of ReplMon, expand the server that needs to be brought up to date.
  2. Expand a directory partition. A list of replication partners for that directory partition appears.
  3. Select the directory partition that needs to be synchronized.
  4. On the Action menu, select Synchronize with this Replication Partner.
  5. In the ? dialog box, select any additional parameters for synchronization, then click OK to continue with the synchronization.

Notes

  • This method works only with direct replication partners.
  • This method synchronizes only one directory partition at a time. To synchronize all directory partitions at once, on the Action menu, select Server and then click Synchronize Each Directory Partition with All Servers.


Sdcheck.exe: Security Descriptor Check Utility
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool displays the security descriptor for any object stored in Active Directory. The security descriptor contains the access control lists (ACLs) defining the permissions that users have on objects stored in Active Directory.

Notes

  • You must run SDCheck from the command window.
  • To enable administrators to determine the effective access controls on an object, SDCheck also displays the object hierarchy and any ACLs that are inherited by the object from its parent.
  • As changes are made to the ACLs of an object or its parent, these changes are propagated automatically by Active Directory. SDCheck displays the security descriptor propagation metadata, so that administrators can monitor these changes with respect to propagation of inherited ACLs, as well as replication of ACLs from other domain controllers.
  • As a complement to the replication monitoring tools (Repadmin.exe and Replmon.exe), SDCheck can be used to ensure that domain controllers are up-to-date with one another.

Corresponding UI

There is no corresponding user interface for SDCheck.

Concepts

A security descriptor contains the security information associated with a securable object. Every container and object on the network or in Active Directory has a set of access control information attached to it, known as a security descriptor. Windows XP Professional automatically creates the security descriptor when an object is created.

System Requirements

The following are the system requirements for SDCheck:

  • Windows XP Professional

File Required

  • Sdcheck.exe


SDCheck Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Security Descriptors Explored

The security descriptor is the structure of the list of permissions for an object.

The descriptor contains a header that includes a revision number and control flags. It also contains the Owner's SID (Security Identifier), and the SID of the object's primary group. A security descriptor can also contain two other lists: A Discretionary Access Control List (DACL) and a System Access Control List (SACL).

The DACL is used to determine what access can be allowed to an object. It contains access control entries (ACE) that define which SIDs have what priveledges. An ACE has three parts: Header, SID, and Mask. The Header describes whether it allows or denies access. The SID is the Security Identifier of the group or user that the ACE pertains to. The Mask tells what access type the ACE is referring to.

When an access request is recieved, the system scans the DACL to see if any of the SIDs match any of the SIDs of the requester. If no matches are found or a Deny is found, then access is denied. All the SIDs are scanned, because a Deny Access always has a higher priority than any Allow. The only exception to this rule is that the owner of an object ALWAYS has full control of the object.

A SACL is is similar to a DACL, except that it is used for auditing purposes. If the user's SID is listed in the SACL's ACE, then audit event will be recorded in the event log.


SDCheck Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

SDCheck uses the following syntax:

One Step sdcheck Server Object [/dumpsd] [/dumpall] [/debug] [[/domain: DomainName] /user: UserName /password: Password] [/?]

Parameters

Server
Specifies the name of the domain controller on which to perform the query. The name may be either the DNS name or the NetBIOS name of the domain controller.
Object
Specifies the name of the object on which you want to determine the access control list (ACL) entries. The name can be either the logon name (for example, MICROSOFT\someone), the fully distinguished name (for example, cn=Someone, ou=Sales,dc=microsoft,dc=com), or the user principal name (for example, someone@microsoft.com).
/dumpsd
Displays only the security descriptor for the selected object.
/dumpall
Displays the security descriptor for the selected object along with all security descriptors inherited from parent containers. This allows administrators to determine the inheritance of security descriptors from parent objects through the object hierarchy.
/debug
Displays internal debugging information for the Security Descriptor Check Utility.
/domain: DomainName
Specifies the domain name of UserName in either DNS or NetBIOS format. Used to specify credentials other other than the current user's.
/user: UserName
Specifies the name of a user other than the current one, in the form of either the logon name or user principal name. If a user principal name is specified, then a domain name is not required.
/password: Password
Specifies the name of UserName. Used to specify credentials other other than the current user's.
/?
Displays Security Descriptor Check Utility syntax at the command line.


SDCheck Examples
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Display the Summary Security Information for an Object

In this example, no changes have been applied to the user object (Someone), or the parent organization unit (Sales), since their initial creation. Note the metadata version number.

c:\sdcheck sprocket someone@microsoft.com

Microsoft(R) Windows (R) 2000 Operating System
Security Descriptor Check Utility - build(2015)

Input:  someone@microsoft.com
Object: CN=Someone,OU=Sales,DC=microsoft,DC=com
Domain: microsoft.com
Domain: DC=microsoft,DC=com
Server: sprocket

*** Warning: No values returned for dSCorePropagationData on CN=Someone,OU=Sales,DC=microsoft,DC=com
*** Warning: No values returned for dSCorePropagationData on OU=Sales,DC=microsoft,DC=com
*** Warning: No values returned for dSCorePropagationData on DC=microsoft,DC=com

Object:   CN=Someone,OU=Sales,DC=microsoft,DC=com
Classes:  top person organizationalPerson user
SD:       1012 bytes
Metadata: 04/15/1999 14:53:04 @ SPROCKET.microsoft.com ver: 1

  Object:   OU=Sales,DC=microsoft,DC=com
  Classes:  top organizationalUnit
  SD:       424 bytes
  Metadata: 04/15/1999 14:54:13 @ SPROCKET.microsoft.com ver: 1

    Object:   DC=microsoft,DC=com
    Classes:  top domain domainDNS
    SD:       496 bytes
    Metadata: 04/15/1999 14:51:32 @ SPROCKET.microsoft.com ver: 4

Checking ACL inheritance ...
    Parent: 2 - DC=microsoft,DC=com
    Child:  1 - OU=Sales,DC=microsoft,DC=com

Checking ACL inheritance ...
    Parent: 1 - OU=Sales,DC=microsoft,DC=com
    Child:  0 - CN=Someone,OU=Sales,DC=microsoft,DC=com

Example 2: Display the Security Descriptor for an Object

Note that in this example, two additional access control lists (ACLs) have been added. This can be identified by the version number increase for the security metadata. One ACL denies read/write access to members of the Accounts Payable group, and the other ACL audits read/write attempts by the Administrator.

c:\sdcheck sprocket someone@microsoft.com -dumpSD

Microsoft(R) Windows (R) 2000 Operating System
Security Descriptor Check Utility - build(2015)

Input:  someone@microsoft.com
Object: CN=Someone,OU=Sales,DC=microsoft,DC=com
Domain: microsoft.com
Domain: DC=microsoft,DC=com
Server: sprocket

*** Warning: No values returned for dSCorePropagationData on OU=Sales,DC=microsoft,DC=com
*** Warning: No values returned for dSCorePropagationData on DC=microsoft,DC=com

Object:   CN=Someone,OU=Sales,DC=microsoft,DC=com
Classes:  top person organizationalPerson user
SD:       1072 bytes
Metadata: 04/15/1999 14:59:08 @ SPROCKET.microsoft.com ver: 3
History:  04/15/1999 14:59:00 flags(0x1) SD propagation
          04/15/1999 14:59:08 flags(0x1) SD propagation

  Object:   OU=Sales,DC=microsoft,DC=com
  Classes:  top organizationalUnit
  SD:       424 bytes
  Metadata: 04/15/1999 14:54:13 @ SPROCKET.microsoft.com ver: 1

    Object:   DC=microsoft,DC=com
    Classes:  top domain domainDNS
    SD:       496 bytes
    Metadata: 04/15/1999 14:51:32 @ SPROCKET.microsoft.com ver: 4

Checking ACL inheritance ...
    Parent: 2 - DC=microsoft,DC=com
    Child:  1 - OU=Sales,DC=microsoft,DC=com

Checking ACL inheritance ...
    Parent: 1 - OU=Sales,DC=microsoft,DC=com
    Child:  0 - CN=Someone,OU=Sales,DC=microsoft,DC=com

SD for CN=Someone,OU=Sales,DC=microsoft,DC=com
SD Revision: 1
SD Control:  0x8c14
        SE_DACL_PRESENT
        SE_SACL_PRESENT
        SE_DACL_AUTO_INHERITED
        SE_SACL_AUTO_INHERITED
        SE_SELF_RELATIVE
Owner: microsoft\Domain Admins S-1-5-21-640924683-4221571012-3872390550-512
Group: microsoft\Domain Users S-1-5-21-640924683-4221571012-3872390550-513
DACL:
    Revision      4
    Size:         944 bytes
    # Aces:       24
    Ace[0]
        Ace Type:  0x1 - ACCESS_DENIED_ACE_TYPE
        Ace Size:  36 bytes
        Ace Flags: 0x0
        Ace Mask:  0x000200bc
            READ_CONTROL
            ACTRL_DS_LIST
            ACTRL_DS_SELF
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
            ACTRL_DS_LIST_OBJECT
        Ace Sid:   microsoft\Accounts Payable S-1-5-21-640924683-4221571012-3872390550-1130
    Ace[1]
        Ace Type:  0x0 - ACCESS_ALLOWED_ACE_TYPE
        Ace Size:  24 bytes
        Ace Flags: 0x0
        Ace Mask:  0x000f01ff
            DELETE
            READ_CONTROL
            WRITE_DAC
            WRITE_OWNER
            ACTRL_DS_CREATE_CHILD
            ACTRL_DS_DELETE_CHILD
            ACTRL_DS_LIST
            ACTRL_DS_SELF
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
            ACTRL_DS_DELETE_TREE
            ACTRL_DS_LIST_OBJECT
            ACTRL_DS_CONTROL_ACCESS
        Ace Sid:   BUILTIN\Account Operators S-1-5-32-548
    Ace[2]
        Ace Type:  0x0 - ACCESS_ALLOWED_ACE_TYPE
        Ace Size:  20 bytes
        Ace Flags: 0x0
        Ace Mask:  0x00020000
            READ_CONTROL
        Ace Sid:   NT AUTHORITY\Authenticated Users S-1-5-11
    Ace[3]
        Ace Type:  0x0 - ACCESS_ALLOWED_ACE_TYPE
        Ace Size:  36 bytes
        Ace Flags: 0x0
        Ace Mask:  0x000f01ff
            DELETE
            READ_CONTROL
            WRITE_DAC
            WRITE_OWNER
            ACTRL_DS_CREATE_CHILD
            ACTRL_DS_DELETE_CHILD
            ACTRL_DS_LIST
            ACTRL_DS_SELF
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
            ACTRL_DS_DELETE_TREE
            ACTRL_DS_LIST_OBJECT
            ACTRL_DS_CONTROL_ACCESS
        Ace Sid:   microsoft\Domain Admins S-1-5-21-640924683-4221571012-3872390550-512
    Ace[4]
        Ace Type:  0x0 - ACCESS_ALLOWED_ACE_TYPE
        Ace Size:  20 bytes
        Ace Flags: 0x0
        Ace Mask:  0x00020094
            READ_CONTROL
            ACTRL_DS_LIST
            ACTRL_DS_READ_PROP
            ACTRL_DS_LIST_OBJECT
        Ace Sid:   NT AUTHORITY\SELF S-1-5-10
    Ace[5]
        Ace Type:  0x0 - ACCESS_ALLOWED_ACE_TYPE
        Ace Size:  20 bytes
        Ace Flags: 0x0
        Ace Mask:  0x000f01ff
            DELETE
            READ_CONTROL
            WRITE_DAC
            WRITE_OWNER
            ACTRL_DS_CREATE_CHILD
            ACTRL_DS_DELETE_CHILD
            ACTRL_DS_LIST
            ACTRL_DS_SELF
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
            ACTRL_DS_DELETE_TREE
            ACTRL_DS_LIST_OBJECT
            ACTRL_DS_CONTROL_ACCESS
        Ace Sid:   NT AUTHORITY\SYSTEM S-1-5-18
    Ace[6]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Public Information
        Object Ace Sid:   NT AUTHORITY\Authenticated Users S-1-5-11
    Ace[7]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Web Information
        Object Ace Sid:   NT AUTHORITY\Authenticated Users S-1-5-11
    Ace[8]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Personal Information
        Object Ace Sid:   NT AUTHORITY\Authenticated Users S-1-5-11
    Ace[9]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - General Information
        Object Ace Sid:   NT AUTHORITY\Authenticated Users S-1-5-11
    Ace[10]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  56 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000030
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr - userCertificate
        Object Ace Sid:   microsoft\Cert Publishers S-1-5-21-640924683-4221571012-3872390550-517
    Ace[11]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000100
            ACTRL_DS_CONTROL_ACCESS
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Control right - Change Password
        Object Ace Sid:   Everyone S-1-1-0
    Ace[12]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  56 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Logon Information
        Object Ace Sid:   microsoft\RAS and IAS Servers S-1-5-21-640924683-4221571012-3872390550-553
    Ace[13]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  56 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Control right - Modify Group Membership
        Object Ace Sid:   microsoft\RAS and IAS Servers S-1-5-21-640924683-4221571012-3872390550-553
    Ace[14]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  56 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Account Restrictions
        Object Ace Sid:   microsoft\RAS and IAS Servers S-1-5-21-640924683-4221571012-3872390550-553
    Ace[15]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  56 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Modify Remote Access Information
        Object Ace Sid:   microsoft\RAS and IAS Servers S-1-5-21-640924683-4221571012-3872390550-553
    Ace[16]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000030
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Web Information
        Object Ace Sid:   NT AUTHORITY\SELF S-1-5-10
    Ace[17]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000030
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Control right - Phone and Mail Options
        Object Ace Sid:   NT AUTHORITY\SELF S-1-5-10
    Ace[18]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000030
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Personal Information
        Object Ace Sid:   NT AUTHORITY\SELF S-1-5-10
    Ace[19]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000100
            ACTRL_DS_CONTROL_ACCESS
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Control right - Receive As
        Object Ace Sid:   NT AUTHORITY\SELF S-1-5-10
    Ace[20]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000100
            ACTRL_DS_CONTROL_ACCESS
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Control right - Send As
        Object Ace Sid:   NT AUTHORITY\SELF S-1-5-10
    Ace[21]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000100
            ACTRL_DS_CONTROL_ACCESS
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Control right - Change Password
        Object Ace Sid:   NT AUTHORITY\SELF S-1-5-10
    Ace[22]
        Ace Type:  0x0 - ACCESS_ALLOWED_ACE_TYPE
        Ace Size:  24 bytes
        Ace Flags: 0x12
            CONTAINER_INHERIT_ACE
            INHERITED_ACE
        Ace Mask:  0x000f01bd
            DELETE
            READ_CONTROL
            WRITE_DAC
            WRITE_OWNER
            ACTRL_DS_CREATE_CHILD
            ACTRL_DS_LIST
            ACTRL_DS_SELF
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
            ACTRL_DS_LIST_OBJECT
            ACTRL_DS_CONTROL_ACCESS
        Ace Sid:   BUILTIN\Administrators S-1-5-32-544
    Ace[23]
        Ace Type:  0x0 - ACCESS_ALLOWED_ACE_TYPE
        Ace Size:  36 bytes
        Ace Flags: 0x12
            CONTAINER_INHERIT_ACE
            INHERITED_ACE
        Ace Mask:  0x000f01ff
            DELETE
            READ_CONTROL
            WRITE_DAC
            WRITE_OWNER
            ACTRL_DS_CREATE_CHILD
            ACTRL_DS_DELETE_CHILD
            ACTRL_DS_LIST
            ACTRL_DS_SELF
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
            ACTRL_DS_DELETE_TREE
            ACTRL_DS_LIST_OBJECT
            ACTRL_DS_CONTROL_ACCESS
        Ace Sid:   microsoft\Enterprise Admins S-1-5-21-640924683-4221571012-3872390550-519
SACL:
    Revision      2
    Size:         52 bytes
    # Aces:       2
    Ace[0]
        Ace Type:  0x2 - SYSTEM_AUDIT_ACE_TYPE
        Ace Size:  24 bytes
        Ace Flags: 0x82
            CONTAINER_INHERIT_ACE
        Ace Mask:  0x00000030
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
        Ace Sid:   BUILTIN\Administrators S-1-5-32-544
    Ace[1]
        Ace Type:  0x2 - SYSTEM_AUDIT_ACE_TYPE
        Ace Size:  20 bytes
        Ace Flags: 0xd2
            CONTAINER_INHERIT_ACE
            INHERITED_ACE
        Ace Mask:  0x000d016b
            DELETE
            WRITE_DAC
            WRITE_OWNER
            ACTRL_DS_CREATE_CHILD
            ACTRL_DS_DELETE_CHILD
            ACTRL_DS_SELF
            ACTRL_DS_WRITE_PROP
            ACTRL_DS_DELETE_TREE
            ACTRL_DS_CONTROL_ACCESS
        Ace Sid:   Everyone S-1-1-0

Example 3: Determine If the Security Descriptor is Being Inherited Correctly

In this example, an inheritable ACL was added to the domain object dc=microsoft,dc=com, denying read and write access to the members of the Finance group. Note that the metadata version number for the domain object dc=microsoft,dc=com has been incremented, however the ACL has yet to propagate to the Sales object.

c:\sdcheck sprocket someone@microsoft.com

Microsoft(R) Windows (R) 2000 Operating System
Security Descriptor Check Utility - build(2015)

Input:  someone@microsoft.com
Object: CN=Someone,OU=Sales,DC=microsoft,DC=com
Domain: microsoft.com
Domain: DC=microsoft,DC=com
Server: sprocket

*** Warning: No values returned for dSCorePropagationData on DC=microsoft,DC=com

Object:   CN=Someone,OU=Sales,DC=microsoft,DC=com
Classes:  top person organizationalPerson user
SD:       1108 bytes
Metadata: 04/15/1999 14:59:08 @ SPROCKET.microsoft.com ver: 3
History:  04/15/1999 14:59:00 flags(0x1) SD propagation
          04/15/1999 14:59:08 flags(0x1) SD propagation
          04/15/1999 15:13:22 flags(0x1) SD propagation

  Object:   OU=Sales,DC=microsoft,DC=com
  Classes:  top organizationalUnit
  SD:       460 bytes
  Metadata: 04/15/1999 14:54:13 @ SPROCKET.microsoft.com ver: 1
  History:  04/15/1999 15:13:21 flags(0x1) SD propagation

    Object:   DC=microsoft,DC=com
    Classes:  top domain domainDNS
    SD:       532 bytes
    Metadata: 04/15/1999 15:13:21 @ SPROCKET.microsoft.com ver: 5

Checking ACL inheritance ...
    Parent: 2 - DC=microsoft,DC=com
    Child:  1 - OU=Sales,DC=microsoft,DC=com
*** Error: Parent ACE [0] specific Mask [0x4] not found1 in child
*** Error: Parent ACE [0] specific Mask [0x8] not found1 in child
*** Error: Parent ACE [0] specific Mask [0x10] not found1 in child
*** Error: Parent ACE [0] specific Mask [0x20] not found1 in child
*** Error: Parent ACE [0] specific Mask [0x80] not found1 in child
*** Error: Parent ACE [0] specific Mask [0x20000] not found1 in child

Checking ACL inheritance ...
    Parent: 1 - OU=Sales,DC=microsoft,DC=com
    Child:  0 - CN=Someone,OU=Sales,DC=microsoft,DC=com

Example 4: Determine If Changes to the Security Descriptor Are Being Replicated From One Domain Controller to Another

In this example, changes to the security descriptor were performed against the same object on a different domain controller. Note in the security metadata that the version number has been incremented and that the name of the domain controller which originated the updated security descriptor is different (in this example: wombat.microsoft.com).

c:\sdcheck sprocket someone@microsoft.com

Microsoft(R) Windows (R) 2000 Operating System
Security Descriptor Check Utility - build(2015)

Input:  someone@microsoft.com
Object: CN=Someone,OU=Sales,DC=microsoft,DC=com
Domain: microsoft.com
Domain: DC=microsoft,DC=com
Server: sprocket

*** Warning: No values returned for dSCorePropagationData on DC=microsoft,DC=com

Object:   CN=Someone,OU=Sales,DC=microsoft,DC=com
Classes:  top person organizationalPerson user
SD:       1144 bytes
Metadata: 04/15/1999 17:26:52 @ WOMBAT.microsoft.com ver: 4
History:  04/15/1999 14:59:00 flags(0x1) SD propagation
          04/15/1999 14:59:08 flags(0x1) SD propagation
          04/15/1999 15:13:22 flags(0x1) SD propagation

  Object:   OU=Sales,DC=microsoft,DC=com
  Classes:  top organizationalUnit
  SD:       460 bytes
  Metadata: 04/15/1999 14:54:13 @ SPROCKET.microsoft.com ver: 1
  History:  04/15/1999 15:13:21 flags(0x1) SD propagation

    Object:   DC=microsoft,DC=com
    Classes:  top domain domainDNS
    SD:       532 bytes
    Metadata: 04/15/1999 15:13:21 @ SPROCKET.microsoft.com ver: 5

Checking ACL inheritance ...
    Parent: 2 - DC=microsoft,DC=com
    Child:  1 - OU=Sales,DC=microsoft,DC=com

Checking ACL inheritance ...
    Parent: 1 - OU=Sales,DC=microsoft,DC=com
    Child:  0 - CN=Someone,OU=Sales,DC=microsoft,DC=com


Depends.exe: Dependency Walker
Overview | Notes | Related Tools Run Depends Run Depends Help

This tool scans any 32-bit or 64-bit Windows module (including .exe, .dll, .ocx, and .sys, among others) and builds a hierarchical tree diagram of all dependent modules. For each module found, it lists all the functions that are exported by that module, and identifies which of those functions are actually being called by other modules. Another view displays the minimum set of required files, along with detailed information about each file including a full path to the file, base address, version numbers, computer type, debug information, and more.

Depends is very useful for troubleshooting system errors related to module load problems. During the module scan, this tool detects dozens of common application problems such as missing modules, invalid modules, import/export mismatches, circular dependency errors, and mismatched computer types of modules.

Depends is useful for developers, testers, system administrators, creators of setup scripts, and anyone else who needs to examine what dependencies are required to make a specific module load successfully.

Depends runs on Windows 95, Windows 98, Windows NT 3.51, Windows NT 4.0, Windows 2000, and Windows XP. It can process any 32-bit or 64-bit Windows modules, including ones designed for Windows CE. It can run as a graphical application or as a console application. New features in version 2.0 include C++ function name undecoration, detection of delay-load and dynamic dependencies, application profiling, user-definable search paths, and the ability to save results to several file formats.

Details on running Depends can be found in Dependency Walker 2.0 Help (Depends.hlp), a separate documentation file.

System Requirements

The following are the system requirements for Depends:

  • Windows 95, Windows 98, Windows NT 3.51, Windows NT 4.0, Windows 2000, or Windows XP Professional

Files Required

  • Depends.cnt
  • Depends.exe
  • Depends.hlp
  • Dwinject.dll


Depends Notes
Overview | Notes | Related Tools Run Depends Run Depends Help

Configuring Depends

When you first run Depends, it registers itself with your system as a handler for all Win32 binaries. This causes a View Dependencies item to be added to the system's context menu. You must configure which file extensions Depends should handle by opening the Options menu and adding file extensions in the Handled File Extensions Dialog box. Then, when you right-click a Win32 module file in Windows Explorer, View Dependencies is displayed as one of the options.

Opening a File in Depends

To open a file in Depends, use one of four methods:

  • Right-click a module file in Windows Explorer and choose View Dependencies from the context menu. This requires that you configure Depends to handle certain file extensions. This can be done by choosing Handled File Extensions from Dependency Walker's View menu.
  • On the main menu in Depends, click File, and then click Open.
  • Drag and drop a file on top of the Dependency Walker's main window.
  • Run depends at the command prompt with the name of the file to be viewed as part of the command line.

Getting Help on Depends

To get help on Depends while running the tool, open the table of contents using one of two methods:

  • On the main menu in Depends, click Help, and then click Help Topics.
  • To get help on the view that currently has focus, press F1.


Gflags.exe: Global Flags Editor
Overview | Notes | Syntax | UI | Examples | Flags | Related Tools Run Tool Open Command Prompt

Gflags.exe enables and disables advanced internal system diagnostics and troubleshooting features on computers running Windows 2000 and Windows XP Professional. GFlags is designed as a debugging tool for application developers. It is most often used to turn on indicators that other tools track, count, and log.

You can run Gflags from the command line or use its graphical user interface dialog box.

You can use GFlags to activate the following debugging features:

  • Registry. Set systemwide debugging features for all Windows processes. These settings are stored in the registry. They take effect when you restart the system and remain effective until you change them.
  • Kernel mode settings. Set debugging features for this session. These settings are effective immediately, but are lost when the system stops. The settings affect processes started after this command completes.
  • Image file settings. Set debugging features for a particular program. These settings are stored in the registry. They take effect when you restart the program and remain effective until you change them.
  • Debugger. Specify that a particular program always runs in a debugger. This setting is stored in the registry. It is effective immediately and remains effective until you change it. (This feature is available only from the Gflags dialog box.)
  • Launch. Run a program with the specified debugging settings. The debugging settings are effective until the program stops. (This feature is available only from the Gflags dialog box.)

Caution

  • Use GFlags only in consultation with Microsoft Product Support Services. It is an optional component provided solely for troubleshooting purposes. Incorrect use of this tool can degrade system performance or prevent the system from starting, requiring you to reinstall the operating system.

File Required

  • Gflags.exe


Gflags Notes
Overview | Notes | Syntax | UI | Examples | Flags | Related Tools Run Tool Open Command Prompt

General Information

  • To display the Gflags dialog box, at the command line, type Gflags (with no parameters).
  • To set flags in the registry or in kernel mode, you must be a member of the Administrators group on the computer. However, users with at least Guest account access can launch a program from the Gflags dialog box.
  • Gflags system-level registry settings appear in the registry immediately, but do not take effect until you restart the system.
  • Gflags image file registry settings appear in the registry immediately, but do not take effect until you restart the process.
  • The debugger and launch features in the Gflags dialog box are program specific. You can only set them on one image file at a time.
  • For information about kernel special pool, see the Windows Driver Development Kit (DDKs).
  • For information about debuggers and to obtain debuggers and documentation, see the Microsoft Windows 2000 Debugging Tools Kit, which is available from the Microsoft Windows Driver Development Kits (DDK) (http://go.microsoft.com/fwlink/?LinkId=1651) Web site.

Flag Details

  • To clear all flags, set the flag to -FFFFFFFF. Setting the flag to 0 adds 0 to the current flag value.
  • When you set the flags for an image file to 0xFFFFFFFF, Windows clears all flags and deletes the GlobalFlag entry in the image file subkey. The subkey is retained.

Dialog Box and Command Line

You can run Gflags by using its handy dialog box or from the command line. Most features are available in both forms, but the following features are only available from the dialog box:

  • Launch. Start a program using the specified flags.
  • Run the program in a debugger.
  • Kernel Special Pool Tag.

Registry Information

Debugging settings saved between sessions are stored in the registry. You can use the registry APIs, Regedit.exe, or Reg to query or change these values. The following table lists the types of settings and where they are stored in the registry.

Systemwide debugging values. ("Registry") | HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\GlobalFlag
Program-specific debugging values. ("Image file") | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ImageFileName\GlobalFlag
Maximum stack trace capture size (maxdepth) | HKLM\System\CurrentControlSet\Control\Session Manager\MaxStackTraceDepth
Create user mode stack trace database (ust, 0x1000) for an image file | Windows adds the image file name to the value of the USTEnabled registry entry (HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USTEnabled).
Kernel Special Pool Tags | HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management\PoolTag
Verify Start / Verify End | HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management\PoolTagOverruns. The Verify Start option sets the value to 0. The Verify End option sets the value to 1.
Debugger for an image file | HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ImageFileName\Debugger


Gflags Syntax
Overview | Notes | Syntax | UI | Examples | Flags | Related Tools Run Tool Open Command Prompt

One Step gflags [/r [flag [flag...]] [maxdepth StackSize]] | [/k [flag [flag...]] | [/i ImageFile [flag][flag...]]

Parameters

  • Typing gflags without parameters opens the Gflags dialog box.
flag
A three-letter abbreviation (flag-abbr) or hexadecimal value (flag-hex) that represents a debugging feature. The abbreviations and hexadecimal values are listed in the Global Flags Table.

Use one of the following flag formats:

Format | Description
{+ | -}flag-abbr | Sets (+) or clears (-) the flag represented by the flag abbreviation. Without a plus (+) or minus (-) symbol, the command has no effect.
[+ | -]flag-hex | Adds (+) or subtracts (-) the hexadecimal value of a flag. A flag is set when its value is included in the sum. Add (+) is the default. Enter a hexadecimal value (without 0x) that represents a single flag or enter the sum of hexadecimal values for multiple flags.
/r [flag [flag...]] [maxdepth StackSize]]
Registry. View and change systemwide debugging settings stored in the registry. These settings take effect when you restart the system and remain effective until you change them.
Parameter | Description
None | Displays the systemwide flags set in the registry.
flag | Sets or clears systemwide flags stored in the registry.
maxdepth StackSize | Specifies the maximum size of the stack trace in decimal units. The default is 16.
/k [flag [flag...]
Kernel mode settings. View and change debugging settings for this session. These settings are effective immediately, but are lost when the system stops. The settings affect processes started after this command completes.
Parameter | Description
None | Displays flags set for the current session.
flag | Sets or clears flags for the current session.
/i ImageFile [flag [flag...]
Image file settings. View and change debugging settings for a particular process. These settings are stored in the registry. These settings are effective for all new instances of this process. They remain effective until you change them.
Parameter | Description
None | Displays the flags for the specified image file.
flag | Sets or clears flags for the specified image file.

Global Flags Table

The following table lists the flags that Gflags changes, the hexadecimal value and abbreviation for each flag, and the destination (R for registry, K for kernel, I for image file) in which the flag is valid.

For a detailed description of each flag, see the Gflags Flag Reference.

Caution

  • The symbolic name of each flag is provided for reference only. Because symbolic names change, they are not a reliable identifier of a global flag.
Description | Symbolic name | Hexadecimal Value | Abbreviation | Destination
Buffer DbgPrint output | FLG_DISABLE_DBGPRINT | 0x08000000 | ddp | R,K
Create kernel mode stack trace database | FLG_KERNEL_STACK_TRACE_DB | 0x2000 | kst | R, K
Create user mode stack trace database | FLG_USER_STACK_TRACE_DB | 0x1000 | ust | R,K,I
Debug initial command | FLG_DEBUG_INITIAL_COMMAND | 0x4 | dic | R,K
Debug WINLOGON | FLG_DEBUG_INITIAL_COMMAND_EX | 0x04000000 | dwl | R, K
Disable heap coalesce on free | FLG_HEAP_DISABLE_COALESCING | 0x00200000 | dhc | R,K,I
Disable paging of kernel stacks | FLG_DISABLE_PAGE_KERNEL_STACKS | 0x80000 | dps | R,K
Disable protected DLL verification | FLG_DISABLE_PROTDLLS | 0x80000000 | dpd | R,K,I
Disable stack extension | FLG_DISABLE_STACK_EXTENSION | 0x10000 | dse | I
Early critical section event creation | FLG_CRITSEC_EVENT_CREATION | 0x10000000 | cse | R,K,I
Enable application verifier | FLG_APPLICATION_VERIFIER | 0x100 | vrf | R,K,I
Enable bad handles detection | FLG_ENABLE_HANDLE_EXCEPTIONS | 0x40000000 | bhd | R,K
Enable close exception | FLG_ENABLE_CLOSE_EXCEPTIONS | 0x00400000 | ece | R,K
Enable debugging of Win32 subsystem | FLG_ENABLE_CSRDEBUG | 0x20000 | d32 | R,K
Enable exception logging | FLG_ENABLE_EXCEPTION_LOGGING | 0x00800000 | eel | R,K
Enable heap free checking | FLG_HEAP_ENABLE_FREE_CHECK | 0x20 | hfc | R,K,I
Enable heap parameter checking | FLG_HEAP_VALIDATE_PARAMETERS | 0x40 | hpc | R,K,I
Enable heap tagging | FLG_HEAP_ENABLE_TAGGING | 0x800 | htg | R,K,I
Enable heap tagging by DLL | FLG_HEAP_ENABLE_TAG_BY_DLL | 0x8000 | htd | R,K,I
Enable heap tail checking | FLG_HEAP_ENABLE_TAIL_CHECK | 0x10 | htc | R,K,I
Enable heap validation on call | FLG_HEAP_VALIDATE_ALL | 0x80 | hvc | R,K,I
Enable loading of kernel debugger symbols | FLG_ENABLE_KDEBUG_SYMBOL_LOAD | 0x40000 | ksl | R,K
Enable object handle type tagging | FLG_ENABLE_HANDLE_TYPE_TAGGING | 0x01000000 | eot | R,K
Enable page heap | FLG_HEAP_PAGE_ALLOCS | 0x02000000 | hpa | R,K,I
Enable pool tagging | FLG_POOL_ENABLE_TAGGING | 0x400 | ptg | R,K
Enable system critical breaks | FLG_ENABLE_SYSTEM_CRIT_BREAKS | 0x100000 | scb | R, K, I
Load DLLs top-down (Win64 only) | FLG_LDR_TOP_DOWN | 0x20000000 | ltd | R, K, I
Maintain a list of objects for each type | FLG_MAINTAIN_OBJECT_TYPELIST | 0x4000 | otl | R,K
Show loader snaps | FLG_SHOW_LDR_SNAPS | 0x2 | sls | R,K,I
Stop on exception | FLG_STOP_ON_EXCEPTION | 0x1 | soe | R,K,I
Stop on hung GUI | FLG_STOP_ON_HUNG_GUI | 0x8 | shg | K


Gflags.exe: Dialog Box Operation
Overview | Notes | Syntax | UI | Examples | Flags | Related Tools Run Tool Open Command Prompt

By using the Gflags dialog box, you can perform all Gflags functions from a user interface that lists all flags by name. There is no need to look up flag abbreviations or hexadecimal values. Instead, you can set and clear flags by selecting and clearing the named flag check boxes.

Also, the dialog box provides access to the following features that are not available from the command line:

  • Debugger. Specify that a particular program always runs in a debugger.
  • Launch. Run a program with the specified debugging settings.
  • Kernel Special Pool Tag. Detects kernel pool errors.

This section includes the following topics.

Gflags Dialog Box

The Gflags dialog box in System Registry mode.

Gflags Dialog Box

To open the dialog box

Use one of the following methods:

  • At the command line, type gflags (without parameters).
  • In the Run dialog box, type gflags (without parameters).

To set and clear systemwide registry flags

Systemwide registry settings affect the entire system. They are saved in the registry and remain effective until you change them.

  1. In the Destination area, click System Registry.
  2. Set or clear a flag by selecting or clearing the check box associated with the flag.
  3. When you have selected or cleared all the flags you want, click Apply.
  4. Restart the system to make the changes effective.

To set and clear kernel mode flags

Kernel mode settings affect the entire system, but are effective only for the current session.

  1. In the Destination area, click Kernel Mode.
  2. Set or clear a flag by selecting or clearing the check box associated with the flag.
  3. When you have selected or cleared all the flags you want, click Apply.

To set and clear image file registry flags

Image file settings affect instances of the specified program that start after the command completes. They are saved in the registry and remain effective until you change them.

  1. In the Destination area, in the Image File Name box, type the name of the executable file or DLL, including the file name extension.
  2. Click Image File Options.
  3. Set or clear a flag by selecting or clearing the check box associated with the flag.
  4. When you have selected or cleared all the flags you want, click Apply.

To launch a program with flags

This feature runs a program once with the specified flags. These settings affect only the instance of the program launched by the instruction in the Command Line box. They are not saved in the registry.

  1. In the Destination area, in the Command Line box, type a command to start a program, including program parameters.
  2. Set or clear a flag by selecting or clearing the check box associated with the flag.
  3. When you have selected or cleared all the flags you want, click the Launch button.

Notes

  • Flags set in the registry do not affect the instance of the program that is launched.
  • Flags set in the dialog box are used for the launched instance even when they are not image file flags.

To run a program in a debugger

This feature configures the program so that it always runs in a debugger with the specified options. This setting is saved in the registry. It affects all new instances of the program and remains effective until you change it.

The flags settings in the dialog box do not affect the debugger run.

  1. In the Destination area, in the Image File Name box, type the name of the executable file, including the file name extension.
  2. Click Image File Options.
  3. In the Image Debugger Options area, click the Debugger check box.
  4. In the Debugger box, type the command to run the debugger, including the program name and parameters. For example, ntsd -d.
  5. Click Apply.

To configure kernel special pool

The kernel special pool feature uses the special pool for all allocations that have a specified tag or are within a specified size range. This feature helps you to detect and identify the source of errors in kernel pool use, such as writing beyond the allocated memory space, or referring to memory that has already been freed.

For information on using the special pool, see the Windows Driver Development Kit.

Kernel special pool settings are saved in the registry. They become effective when you restart the system and remain effective until you change them.

  1. In the Destination area, click System Registry.
  2. Choose one of the following methods:
    • To specify a pool tag in text format, click Text.

      • Type a four-character pattern for the tag. The tag can include the ? (any single character) and * (multiple characters) wildcard characters. For example, Fat* or Av?4.

      Gflags converts the ASCII characters to their hexadecimal format, placing the leftmost character in the lowest order position. For example, if you type Tag1, Gflags sets the tag to 0x31676154.

    • To specify a pool tag in hexadecimal format, click Hex.

      • Type a hexadecimal value for the tag.

      Gflags sets the tag to the same numeric value. For example, if you type 12345678, Gflags stores pool tag 0x12345678.

      Note

      • Enter a hexadecimal value that is greater than the page size of the system. Otherwise, the value is interpreted as indicating a size range.
    • To track kernel pool allocations of a specified size, click Hex.

      • Allocations are organized into a range of pool block sizes. In 32-bit systems, pool blocks are divided into 8-byte ranges. In 64-bit systems, the range is 16 bytes.

      To indicate a range, type a hexadecimal number equal to the upper limit of the range + 8 bytes for the pool header. For example, on a 32-bit system, to specify a pool block of between 9 and 16 bytes, type 18 to indicate 0x18.

      The following table shows the pattern of pool block ranges and the value you type to select that range for 32-bit systems.

      Size range (in bytes) | Value
0 - 8 | 0x10 (16)
9 - 16 | 0x18 (24)
17 - 24 | 0x20 (32)
25 - 32 | 0x28 (40)
... |

      The following table shows the pattern of pool block ranges and the value you type to select that range for 64-bit systems.

      Size range (in bytes) | Value
0 - 16 | 0x18 (24)
17 - 32 | 0x28 (40)
33 - 48 | 0x38 (56)
49 - 64 | 0x46 (70)
... |

      Note

      • The value for a size range must be equal to a multiple of 8 plus 8 (8x + 8) on 32-bit systems or a multiple of 16 + 8 (16x + 8) on 64-bit systems. Also, the value must be smaller than the page size for the system. Otherwise, the value is interpreted as a hexadecimal tag.
  3. Click Verify Start or Verify End:
    • Verify End causes a system stop when a program tries to access tagged memory beyond its memory allocation.
    • Verify Start causes a system stop when a program tries to access tagged memory preceding its memory allocation.
  4. Click Apply.
  5. To disable kernel special pool, delete the text or hexadecimal value from the Kernel Special Pool Tag box, and then click Apply.

Note

  • The special pool can also be used for the memory pool allocations requested by a specific driver. This feature is activated by Driver Verifier (Verifier.exe), a tool included in the Windows\System32 directory in Windows 2000 and Windows XP . For details, see the Driver Verifier documentation in the Windows Driver Development Kit (DDK).


Gflags Flag Reference
Overview | Notes | Syntax | UI | Examples | Flags | Related Tools Run Tool Open Command Prompt

Caution

  • The symbolic name of each flag is provided for reference only. Because symbolic names change, they are not a reliable identifier of a global flag.

Buffer DbgPrint output

Abbreviation | ddp
Hexadecimal value | 0x08000000
Symbolic Name | FLG_DISABLE_DBGPRINT
Destination | Systemwide registry entry, kernel mode

Suppresses debugger output from DbgPrint(), DbgPrintEx(), KdPrint(), and KdPrintEx() calls. When this output is suppressed, it does not automatically appear in the kernel debugger. However, it can still be accessed by using the !dbgprint debugger extension.

Create kernel mode stack trace database

Abbreviation | kst
Hexadecimal value | 0x2000
Symbolic Name | FLG_KERNEL_STACK_TRACE_DB
Destination | Systemwide registry entry, kernel mode

Creates a run-time stack trace database of kernel operations, such as resource objects and object management operations. This feature works only when using a "checked build," that is, an internal debugging build of the operating system.

Note

  • This flag is available as a kernel mode setting, but it is not effective in kernel mode because the kernel is already started.

Create user mode stack trace database

Abbreviation | ust
Hexadecimal value | 0x1000
Symbolic Name | FLG_USER_STACK_TRACE_DB
Destination | Systemwide registry entry, kernel mode, image file registry entry

Creates a run-time stack trace database in the address space of a particular process (image file mode) or all processes (systemwide).

Debug initial command

Abbreviation | dic
Hexadecimal value | 0x4
Symbolic Name | FLG_DEBUG_INITIAL_COMMAND
Destination | Systemwide registry entry, kernel mode

Runs Winlogon in the Windows Symbolic Debugger (Ntsd.exe) with the -d option, which directs its output to the kernel debugger console.

This flag is used for debugging the Client Server Run-time Subsystem (CSRSS), Winlogon.exe, and the Winlogon child processes.

See also: Debug Winlogon, Enable debugging of Win32 subsystem.

Debug Winlogon

Abbreviation | dwl
Hexadecimal value | 0x04000000
Symbolic Name | FLG_DEBUG_INITIAL_COMMAND_EX
Destination | Systemwide registry entry, kernel mode

Runs Winlogon in the Windows Symbolic Debugger (Ntsd.exe) with the following options:

  • -d Send output to kernel debugger console.
  • -g Ignore first breakpoint.
  • -x Ignore first chance access violations.

See also: Debug Initial Command, Enable debugging of Win32 subsystem.

Disable heap coalesce on free

Abbreviation | dhc
Hexadecimal value | 0x00200000
Symbolic Name | FLG_HEAP_DISABLE_COALESCING
Destination | Systemwide registry entry, kernel mode, image file registry entry

Leaves adjacent blocks of heap memory separate when they are freed. By default, the system combines ("coalesces") newly freed adjacent blocks into a single block. Combining the blocks takes time, but reduces fragmentation that might force the heap to allocate additional memory when it can't find contiguous memory.

This flag is used to test optimizing strategies. It is not used for debugging.

Disable paging of kernel stacks

Abbreviation | dps
Hexadecimal value | 0x80000
Symbolic Name | FLG_DISABLE_PAGE_KERNEL_STACKS
Destination | Systemwide registry entry, kernel mode

Prevents paging of the kernel mode stacks of inactive threads. Generally, the kernel mode stack cannot be paged; it is guaranteed to be resident in memory. However, the system occasionally pages the kernel stacks of inactive threads. This flag prevents these occurrences.

The kernel debugger can provide information about a thread only when its stack is in physical memory. This flag is particularly important when debugging deadlocks and in other cases when every thread must be tracked.

Disable protected DLL verification

Abbreviation | dpd
Hexadecimal value | 0x80000000
Symbolic Name | FLG_DISABLE_PROTDLLS
Destination | Systemwide registry entry, kernel mode, image file registry entry

This flag appears in Gflags, but it has no effect on the operating system.

Disable stack extension

Abbreviation | dse
Hexadecimal value | 0x10000
Symbolic Name | FLG_DISABLE_STACK_EXTENSION
Destination | Image file registry entry

Prevents the kernel from extending the stacks of the threads in the process beyond the initial memory committed. This is used to simulate low memory conditions (where stack extensions start to fail) and to test the strategic system processes that are expected to run well even with low memory.

Early critical section event creation

Abbreviation | cse
Hexadecimal value | 0x10000000
Symbolic Name | FLG_CRITSEC_EVENT_CREATION
Destination | Systemwide registry entry, kernel mode, image file registry entry

Creates event handles when a critical section is initialized, rather than waiting until the event is needed. When the system cannot create an event, it generates the exception during initialization and the calls to enter and leave the critical section do not fail.

Because this flag uses a significant amount of nonpaged pool memory, use it only on very reliable systems that have sufficient memory.

Enable application verifier

Abbreviation | vrf
Hexadecimal value | 0x100
Symbolic Name | FLG_APPLICATION_VERIFIER
Destination | Systemwide registry entry, kernel mode, image file registry entry

Enable bad handles detection

Abbreviation | bhd
Hexadecimal value | 0x40000000
Symbolic Name | FLG_ENABLE_HANDLE_EXCEPTIONS
Destination | Systemwide registry entry, kernel mode

Raises a user mode exception (STATUS_INVALID_HANDLE) whenever a user mode process passes an invalid handle to the Object Manager.

Enable close exception

Abbreviation | ece
Hexadecimal value | 0x00400000
Symbolic Name | FLG_ENABLE_CLOSE_EXCEPTIONS
Destination | Systemwide registry entry, kernel mode

Raises a user mode exception whenever an invalid handle is passed to the CloseHandle() interface or related interfaces, such as SetEvent(), that take handles as arguments.

Notes

  • This flag is still supported, but it has been replaced by Enable bad handles detection, which performs a more comprehensive check of handle use.

Enable debugging of Win32 subsystem

Abbreviation | d32
Hexadecimal value | 0x20000
Symbolic Name | FLG_ENABLE_CSRDEBUG
Destination | Systemwide registry entry, kernel mode

Runs the Client Server Run-time Subsystem, Csrss.exe, in the Windows Symbolic Debugger (Ntsd.exe) with the following options:

  • -d Send output to kernel debugger console.
  • -p 1 Attach the debugger to already running Csrss process, as identified by its process ID, 1.

This flag is effective only when the Debug Initial Command (dic) or Debug Winlogon (dwl) flag is also set.

Enable exception logging

Abbreviation | eel
Hexadecimal value | 0x00800000
Symbolic Name | FLG_ENABLE_EXCEPTION_LOGGING
Destination | Systemwide registry entry, kernel mode

Creates a log of exception records in the kernel run-time library. You can access the log from the kernel debugger.

Enable heap free checking

Abbreviation | hfc
Hexadecimal value | 0x20
Symbolic Name | FLG_HEAP_ENABLE_FREE_CHECK
Destination | Systemwide registry entry, kernel mode, image file registry entry

Validates the heap when it is freed.

See also: Enable heap tail checking, Enable heap parameter checking

Enable heap parameter checking

Abbreviation | hpc
Hexadecimal value | 0x40
Symbolic Name | FLG_HEAP_VALIDATE_PARAMETERS
Destination | Systemwide registry entry, kernel mode, image file registry entry

Verifies some aspects of the heap whenever a heap API is called.

See also: Enable heap validation on call

Enable heap tagging

Abbreviation | htg
Hexadecimal value | 0x800
Symbolic Name | FLG_HEAP_ENABLE_TAGGING
Destination | Systemwide registry entry, kernel mode, image file registry entry

Assigns unique tags to heap allocations. You can display the tag by using the !heap debugger extension with the -t parameter.

For information abou the !heap extension, see the Microsoft Windows 2000 Debugging Tools Kit, which is available from the Microsoft Windows Driver Development Kits (DDK) (http://go.microsoft.com/fwlink/?LinkId=1651) Web site.

See also: Enable heap tagging by DLL

Enable heap tagging by DLL

Abbreviation | htd
Hexadecimal value | 0x8000
Symbolic Name | FLG_HEAP_ENABLE_TAG_BY_DLL
Destination | Systemwide registry entry, kernel mode, image file registry entry

Assigns a unique tag to heap allocations created by the same DLL. You can display the tag by using the !heap debugger extension with the -t parameter.

For information abou the !heap extension, see the Microsoft Windows 2000 Debugging Tools Kit, which is available from the Microsoft Windows Driver Development Kits (DDK) (http://go.microsoft.com/fwlink/?LinkId=1651) Web site.

See also: Enable heap tagging

Enable heap tail checking

Abbreviation | htc
Hexadecimal value | 0x10
Symbolic Name | FLG_HEAP_ENABLE_TAIL_CHECK
Destination | Systemwide registry entry, kernel mode, image file registry entry

Checks for buffer overruns when the heap is freed. This flag adds a short pattern to the end of each allocation. The Windows heap manager detects the pattern when the block is freed and, if the block was modified, the heap manager breaks into the debugger.

See also: Enable heap free checking, Enable heap parameter checking

Enable heap validation on call

Abbreviation | hvc
Hexadecimal value | 0x80
Symbolic Name | FLG_HEAP_VALIDATE_ALL
Destination | Systemwide registry entry, kernel mode, image file registry entry

Validates the entire heap each time a heap API is called.

To avoid the high overhead resulting from this flag, use the HeapValidate() API at critical junctures, such as when the heap is destroyed. However, this flag is useful for detecting random corruption in a pool.

See also: Enable heap parameter checking

Enable loading of kernel debugger symbols

Abbreviation | ksl
Hexadecimal value | 0x40000
Symbolic Name | FLG_ENABLE_KDEBUG_SYMBOL_LOAD
Destination | Systemwide registry entry, kernel mode

Loads kernel symbols into the kernel memory space the next time the system starts. The kernel symbols are used in kernel profiling and by advanced kernel debugging tools.

Enable object handle type tagging

Abbreviation | eot
Hexadecimal value | 0x01000000
Symbolic Name | FLG_ENABLE_HANDLE_TYPE_TAGGING
Destination | Systemwide registry entry, kernel mode

This flag appears in Gflags, but it has no effect on the operating system.

Enable page heap

Abbreviation | hpa
Hexadecimal value | 0x02000000
Symbolic Name | FLG_HEAP_PAGE_ALLOCS
Destination | Systemwide registry entry, kernel mode, image file registry entry

Adds a guard page and other tracking features to each heap allocation. Available systemwide (registry or kernel mode) or per-program (image file).

Gflags for Windows XP implements full page heap tracking for image files and standard page heap tracking for system allocations. Full page heap tracking places inaccessible pages at the end of an allocation. Standard page heap tracking examines allocations as they are freed. This optimization reduces the huge overhead that would otherwise result from systemwide page heap tracking.

Enable pool tagging

Abbreviation | ptg
Hexadecimal value | 0x400
Symbolic Name | FLG_POOL_ENABLE_TAGGING
Destination | Systemwide registry entry, kernel mode

Attaches a four-character tag to every kernel pool allocation. Several tools that diagnose memory leaks and other kernel pool errors require this tag.

Enable system critical breaks

Abbreviation | scb
Hexadecimal value | 0x100000
Symbolic Name | FLG_ENABLE_SYSTEM_CRIT_BREAKS
Destination | Systemwide registry entry, kernel mode, image file registry entry

  • For per-process (image file) only: Forces a system breakpoint into the debugger whenever the specified process stops abnormally. This flag is effective only when the process calls the RtlSetProcessBreakOnExit() and RtlSetThreadBreakOnExit() interfaces.
  • For systemwide (registry or kernel mode): Forces a system breakpoint to the debugger whenever processes that have called the RtlSetProcessBreakOnExit() and RtlSetThreadBreakOnExit() interfaces stop abnormally.

Load DLLs top-down (Win64 only)

Abbreviation | ltd
Hexadecimal value | 0x20000000
Symbolic Name | FLG_LDR_TOP_DOWN
Destination | Systemwide registry entry, kernel mode, image file registry entry

Loads DLLs at the highest possible address. This flag is used to test 64-bit code for pointer truncation errors, because the most significant 32 bits of the pointers are not zeroes.

Maintain a list of objects for each type

Abbreviation | otl
Hexadecimal value | 0x4000
Symbolic Name | FLG_MAINTAIN_OBJECT_TYPELIST
Destination | Systemwide registry entry, kernel mode

Collects and maintains a list of the active objects by object type (for example, event, mutex, and semaphore). You can use Open Handles (Oh.exe), a Windows Support Tool, to dump the object lists.

Note

  • This flag is available as a kernel mode setting, but it is not effective in kernel mode because the kernel is already started.

Show loader snaps

Abbreviation | sls
Hexadecimal value | 0x2
Symbolic Name | FLG_SHOW_LDR_SNAPS
Destination | Systemwide registry entry, kernel mode, image file registry entry

Captures detailed information about the loading and unloading of executable images and their supporting library modules.

  • For systemwide (registry or kernel mode): Whenever a driver is loaded, this flag writes the kernel contents to the kernel debugger console. This feature works only when using a "checked build," that is, an internal debugging build of the operating system.
  • For per-process (image file): Whenever a DLL is loaded, this flag writes the loader contents (and data related to DLL loading) to the program debugger console.

Stop on exception

Abbreviation | soe
Hexadecimal value | 0x1
Symbolic Name | FLG_STOP_ON_EXCEPTION
Destination | Systemwide registry entry, kernel mode, image file registry entry

The kernel breaks into the kernel debugger whenever a kernel mode exception occurs. The system passes all first chance exceptions (except for STATUS_PORT_DISCONNECT) with a severity of Warning or Error to the debugger before passing them to a local exception handler.

Stop on hung GUI

Abbreviation | shg
Hexadecimal value | 0x8
Symbolic Name | FLG_STOP_ON_HUNG_GUI
Destination | Kernel mode

This flag appears in Gflags, but it has no effect on the operating system.

Gflags Topics

  • GFlags Notes
  • GFlags Command-Line Syntax
  • GFlags Dialog Box Operation
  • Global Flags Reference
  • GFlags Examples


Gflags Examples
Overview | Notes | Syntax | UI | Examples | Flags | Related Tools Run Tool Open Command Prompt
Basic | Example 1: Display debugging settings. Example 2: Set a flag by using a flag abbreviation. Example 3: Set a flag by using its hexadecimal value. Example 4: Set multiple flags. Example 5: Clear a flag. Example 6: Clear all flags. Example 7: Clear all flags for an image file.
Advanced | Example 8: Change the maximum trace stack size. Example 9: Detect a memory pool leak. Example 10: Detect a heap memory leak in a process.

Example 1: Display debugging settings

The following command displays the current value of the system-level GlobalFlag registry entry (HKLM\System\CurrentControlSet\Control\Session Manager\GlobalFlag). It uses the /r parameter to specify the system-level registry entry.

gflags /r

In response, Gflags displays a single hexadecimal value representing the sum of all flags set and a list of the flags set.

Current Boot Registry Settings are: 40001400
    ptg - Enable pool tagging
    ust - Create user mode stack trace database
    bhd - Enable bad handles detection

In this example, the results show that there are three tags set, with a combined value of 0x40001400.

  • Enable pool tagging (ptg) = 0x400
  • Create user mode stack trace database (ust) = 0x1000
  • Enable bad handles detection (bhd) = 0x40000000

Remember that the value in the registry might not be the current value. Changes to the registry are not effective until the system is restarted.

You can use similar commands to display the debugging values for the current session, known as kernel mode, and debugging values for a particular image file.

The following command displays the debugging values for the current session. It uses the /k parameter to indicate kernel mode.

gflags /k

The following command displays the debugging values set in the registry for Notepad.exe. This value is stored in a GlobalFlag registry entry located in the program-specific subkey, HKLM\System\CurrentControlSet\Control\Session Manager\Image File Execution Options\Notepad.exe. It uses the /i parameter to indicate image file mode and specifies the image file.

gflags /i notepad.exe

Remember that the value in the registry might not be the current value. Changes to the registry are not effective until the system is restarted.

Example 2: Set a flag by using a flag abbreviation

The following command sets the Show loader snaps flag in the GlobalFlag registry entry for the Notepad.exe image file. Show loader snaps takes snapshots of the load process, capturing in detail the loading and unloading of executable images and their supporting library modules.

The command uses the /i parameter to indicate image file mode and specifies the name of the image file, Notepad.exe. To identify the flag, the command uses sls, the abbrevation for Show loader snaps and it precedes the abbreviation with a plus sign (+) to indicate that the flag is set. Without the plus sign, the command has no effect.

gflags /i notepad.exe +sls

In response, Gflags displays the current flags for Notepad.exe. The display indicates that the command is successful. The Show loader snaps flag is enabled for all new instances of the Notepad.exe process.

Current Registry Settings for notepad.exe executable are: 00000002
    sls - Show Loader Snaps

Example 3: Set a flag by using its hexadecimal value

The following command sets the Enable page heap flag in the systemwide GlobalFlag registry entry. Enable page heap adds a guard page and other tracking features to each heap allocation.

The command uses the /r parameter to indicate system registry mode. To identify the flag, the command uses 2000000, which represents 0x2000000, the hexadecimal value for Enable page heap.

Although the command sets a flag, it omits the plus sign. When using hexadecimal values, the sign is optional and add (+) is the default.

gflags /r 2000000

In response, Gflags displays the current value of GlobalFlag. The display indicates that the command is successful. The Enable page heap flag is set when you restart the system.

Current Boot Registry Settings are: 02000000
    hpa - Enable page heap

Example 4: Set multiple flags

The following command sets the following three debugging flags for the current session.

  • Enable heap free checking (hfc, 0x20)
  • Enable heap parameter checking (hpc, 0x40)
  • Enable heap validation on call (hvc, 0x80)

This command uses the /k parameter to specify kernel mode (session only). It sets the value for kernel mode to E0 (0xE0), the sum of the hexadecimal values of the flags.

gflags /k e0

In response, Gflags displays the current value of GlobalFlag. The display indicates that the command is successful and that the correct three flags are, indeed, set.

Current Running Kernel Settings are: 000000e0
    hfc - Enable heap free checking
    hpc - Enable heap parameter checking
    hvc - Enable heap validation on call

Please note that each of the following commands have the same effect as the command used in this example and can be used interchangeably.

gflags /k +20 +40 +80

gflags /k +E0

gflags /k +hfc +hpc +hvc

Flags set in kernel mode are effective immediately and remain effective until the system stops.

Example 5: Clear a flag

The following command clears the Enable page heap flag from the systemwide GlobalFlag registry entry. The command uses the /r parameter to indicate the systemwide registry and hpa, the abbreviation for the Enable page heap flag. The minus sign (-) specifies that the flag is to be cleared.

gflags /r -hpa

In response, Gflags displays the current value of GlobalFlag. The display indicates that the command is successful and that there are no longer any flags set in the registry value.

Current Boot Registry Settings are: 00000000

Please note that the following command, which uses the hexadecimal value of the Enable page heap flag, has the same effect as the command used in this example and can be used interchangeably:

gflags /r -02000000

Example 6: Clear all flags

There are two different ways to clear all flags set for a particular debugging mode:

  • Clear the current flags.
  • Clear all flags.

Notes

  • The methods demonstrated by this example clear flags only. They do not reset the maximum stack trace size or kernel special pool tag to the default values.

Clear the current flags

The following command uses the first method for clearing flags. It clears the current value of GlobalFlag by clearing the flags set. In this example, the current value is 0xE0.

gflags /r -E0

In response, Gflags displays the current value of GlobalFlag. The display indicates that the command is successful and that there are no longer any flags set in the registry value.

Current Boot Registry Settings are: 00000000

Please note that the following commands have the same effect as the command used in this example and can be used interchangeably:

gflags /r -20 -40 -80

gflags /r -hfc -hpc -hvc

Clear all flags

The following command uses the second method for clearing flags. It clears all possible values set for GlobalFlag.

gflags /r -ffffffff

In response, Gflags displays the current value of GlobalFlag. The display indicates that the command is successful and that there are no longer any flags set in the registry value.

Current Boot Registry Settings are: 00000000

Note

  • Type this command into Notepad, then save the file as ClearFlag.bat. Thereafter, to clear all flags, just type ClearFlag .

Finally, the following example demonstrates that the intuitive method of clearing all flags does not work.

The following command sets the value of the systemwide GlobalFlag registry entry to 0. In this example, the current value of GlobalFlag is 0xE0.

gflags /r 0

In response, Gflags displays the value of GlobalFlag after the command completes:

Current Boot Registry Settings are: 000000e0
    hfc - Enable heap free checking
    hpc - Enable heap parameter checking
    hvc - Enable heap validation on call

The command has no effect because it adds the value 0 to the current value of GlobalFlag.

Example 7: Clear all flags for an image file

The following command clears all flags and image debugger options for an image file. The command adds high-values (0xFFFFFFFF) to the current flag value. Gflags responds by deleting the GlobalFlag entry for the image file, thereby deleting all of the values it stores.

This method does not clear flags set in the systemwide registry entry or in kernel mode.

gflags /i notepad.exe ffffffff

In response, Gflags displays a message indicating that there are no flags set for the image file:

No Registry Settings for notepad.exe executable

To determine which image files have flags set, use Regfind, a tool included in the Windows 2000 Server Resource Kit, to search the registry subkeys in the Image file Execution Options subkey.

The following command searches for GlobalFlag in the path specified by the -p parameter. The -n parameter directs Regfind to search for the names of subkeys and entries, instead of the data stored in the entry.

regfind GlobalFlag -n -p "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

In response, Regfind displays all image file subkeys with GlobalFlag registry entries. It also displays the value of the entry. Because the gflags command deleted the entry for Notepad.exe, it does not appear in the Regfind list.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execu
tion Options
    f32main.exe
        GlobalFlag = 0x000000c0
    dgsetup.exe
        GlobalFlag = 0x00000080

Note

  • Type the regfind command into Notepad, then save the file as Images.bat. Thereafter, to find image files for which flags have been set, just type Images .

Example 8: Change the maximum trace stack size

The following command increases the maximum size of the stack trace to 24 items. This value is set in the systemwide GlobalFlag registry entry. The default value is 16 (0x10).

The command uses the /r parameter to indicate the systemwide GlobalFlag registry entry. It uses the maxdepth parameter to change the maximum stack trace size and the value 24 to indicate the desired size in decimal units. (Hexadecimal units are not valid.)

gflags /r maxdepth 24

In response, Gflags displays the current value of the systemwide GlobalFlag registry entry. Gflags does not report the success of the command or display the current stack trace size.

Current Boot Registry Settings are: 02000000
    hpa - Enable page heap

To display the stack trace size, use registry APIs, Regedit.exe, or Reg, to check the value of the MaxStackTraceDepth registry entry (HKLM\System\CurrentControlSet\Control\Session Manager\MaxStackTraceDepth).

The following command uses Reg.exe to query the value of MaxStackTraceDepth:

reg query "hklm\system\currentcontrolset\control\session manager" /v maxstacktracedepth

In response, Reg.exe returns the value of MaxStackTraceDepth, which confirms that the new value, 24 (0x18), was set. This value becomes effective when you restart the system.

! REG.EXE VERSION 2.0

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager
    maxstacktracedepth  REG_DWORD       0x18

Notes

  • Type the reg query command into Notepad, then save the file as MaxDepth.bat. Thereafter, to display the value of MaxStackTraceDepth, just type MaxDepth .
  • To see the registry locations of values set by Gflags, see Gflags Notes.

Example 9: Detect a memory leak

The following example uses Gflags to set the Enable pool tagging flag in the registry entry for the system. Then, it uses Poolmon, a Windows Support Tool, to display the size of the memory pools. Poolmon uses pool tags to monitor the bytes in the paged and nonpaged memory pools. By running Poolmon periodically, you can identify pools that expand continuously over time. This pattern often indicates a memory leak.

Note

  • If the Enable pool tagging flag is not set, Poolmon fails and diplays the following message: "Query pooltags Failed c0000002."
  1. Set the Enable pool tagging flag in the systemwide registry entry.

    2. Use one of the following methods. These methods have the same effect and can be used interchangeably.

    • In the Gflags dialog box, click the Registry button, click the Enable pool tagging check box, and then click Apply.
    • At the command line, use the /r parameter to specify the systemwide registry entry, and the ptg abbreviation to specify the flag.

      gflags /r +ptg

    • At the command line, use the /r parameter to specify the systemwide registry entry, and the 0x400 hexadecimal value to specify the flag. The plus sign (+) is optional in this format.

      gflags /r +400

  2. Restart the computer to make the registry change effective.

  3. Run Poolmon periodically by using the following command. In this command, the /b parameter sorts the pools in descending size order.

    4. poolmon /b

    In response, Poolmon displays a table of memory pool size, including the number of allocs and frees, and the amount of memory remaining in the pool (in the Bytes column).

    Memory: 16224K Avail: 4564K PageFlts: 31 InRam Krnl: 684K P: 680K
 Commit: 24140K Limit: 24952K Peak: 24932K  Pool N: 744K P: 2180K

 Tag  Type    Allocs          Frees         Diff   Bytes      Per Alloc
-----------------------------------------------------------------------

 CM   Paged    1283 (   0)    1002 (   0)    281 1377312 (     0) 4901
Strg  Paged   10385 (  10)    6658 (   4)   3727  317952 (   512)   85
 Fat  Paged    6662 (   8)    4971 (   6)   1691  174560 (   128)  103
MmSt  Paged     614 (   0)     441 (   0)    173   83456 (     0)  482

    If the value of Bytes in a pool expands continuously for no obvious reason, there might be a memory leak in that pool.

  4. Turn off Enable pool tagging.

    5. The following command line uses the flag abbreviation method, but you can identify the flag by its hexadecimal value or use the Global Flags dialog box:

    gflags /r -ptg

  5. Restart the system to make the registry change effective.

Note

  • Use the append symbol (>>) to redirect the Poolmon output to a log file. Later, you can examine the log file for pool size trends. For example:

    poolmon.exe /b >> poolmon.log

Example 10: Detect a heap memory leak in a process

This example uses Gflags and Umdh.exe (User Mode Dump Heap), a tool available from Microsoft Product Support Services (http://go.microsoft.com/fwlink/?LinkId=1679).

To detect a leak in heap memory in Notepad.exe:

  1. Set the Create user mode stack trace database flag for the Notepad.exe image file.

    2. The following command uses Gflags to set the Create user mode stack trace database flag. It uses the /i parameter to identify the image file and the ust abbreviation for the flag.

    gflags /i Notepad.exe +ust

    As a result of this command, a user mode stack trace is created for all new instances of the Notepad process.

  2. Set the symbol file path.

    3. The following command creates an environment variable that stores the path to the directory of symbol files:

    set _NT_SYMBOL_PATH=C:\Windows\symbols

  3. Start Notepad.
  4. Find the process identifier (PID) of the Notepad process.

    5. You can find the PID of any running process from Task Manager or Tasklist.exe, a tool included in Windows XP Professional. In this example, the Notepad PID is 1228.

  5. Run Umdh.exe

    6. The following command runs Umdh.exe. It uses the -p: parameter to specify the PID which, in this example, is 1228. It uses the /f: parameter to specify the name and location of the output file for the heap dump, Notepad.dmp.

    umdh -p:1228 -f:notepad.dmp

    In response, Umdh writes a complete dump of all active heaps to the notepad.dmp file.


Memsnap.exe: Memory Profiling Tool
Overview | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool takes a snapshot of the memory resources being consumed by all running processes and writes this information to a log file.

MemSnap logs system memory usage to a log file with the default name of Memsnap.log; however, any file name can be chosen by specifying it at the command line when starting the tool.

Corresponding UI

There is no corresponding user interface for MemSnap.

Concepts

Memory leaks occur when programs allocate memory but neglect to free it when the memory is no longer being used. For more information about memory management and memory leaks, search the Microsoft Developers' Network (http://www.microsoft.com/).

System Requirements

The following are the system requirements for MemSnap:

  • Windows XP Professional

File required

  • Memsnap.exe


MemSnap Syntax
Overview | Syntax | Examples | Related Tools Open Command Prompt

One Step memsnap [/t] [/g] [/?] [LogFile]

Parameters

/t
Adds tagging information (time (Greenwich mean time (GMT)), date, computer name).
/g
Adds GDI and USER resource counts.
LogFile
Specifies the name of the file where MemSnap writes its information (the default is Memsnap.log).


MemSnap Examples
Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Generate Snapshot of Memory Resources

To generate a snapshot of memory resources being consumed, type the following at the command line:

memsnap c:\data\memsnap.txt

This command sends the memory data to the Memsnap.txt file in the c:\data directory. Your output will look similar to the following:

Process ID         Proc.Name Wrkng.Set PagedPool  NonPgdPl  Pagefile    Commit   Handles   Threads
00000000              (null)     16384         0         0         0         0         0         1
00000008              System    217088         0         0     24576     24576       231        35
00000094            SMSS.EXE    356352      5944      1252   1122304   1122304        33         6
000000AC           csrss.exe   2297856     38676      5520   1363968   1363968       326        10
000000A8        WINLOGON.EXE   3530752     38376     62220   5906432   5906432       359        16
000000DC        services.exe   3375104     29640    216364   2564096   2564096       491        30
000000E8           LSASS.EXE   1232896     28100     37176   1961984   1961984       301        13
0000018C         svchost.exe   3284992     27592     16896   1318912   1318912       273         8
000001A8         SPOOLSV.EXE   3018752     20436     12904   2199552   2199552       104        10
000001C4        Avsynmgr.exe   2412544     19976      3428   1265664   1265664        98         4
000001D4         svchost.exe   2916352     39148     62548   3952640   3952640       398        26
000001F8          regsvc.exe    774144      8056      9548    241664    241664        30         2
00000208          mstask.exe   2912256     25596     15212   1032192   1032192       138         6
00000250         WinMgmt.exe    151552     15752      3208    651264    651264        90         3
0000028C          VSStat.exe   1294336     20264      3324   1228800   1228800        67         2
00000158        vshwin32.exe   1253376     22192      5136   2736128   2736128       107         7
000002C0        MCSHIELD.EXE   3710976     13060     20872   2306048   2306048       113        16
00000318        Avconsol.exe   2777088     20944      3948   1413120   1413120        67         2
0000035C        explorer.exe   2588672     50452     18996   4829184   4829184       334        14
000003E0       SETI@home.exe  16777216     26072      5724  16412672  16412672       126         3
00000388         winmine.exe   1069056     17080      2032    294912    294912        23         1
000003AC         cmmon32.exe    720896     15904      2580    352256    352256        52         3
00000404             MDM.EXE   2183168     18908      3676    692224    692224        81         4
00000380           SSEXP.EXE   3584000     25104      3064   1298432   1298432        60         4
000004A0         OUTLOOK.EXE  11087872     76724     20362   4177920   4177920       305        11
00000358        MAPISP32.EXE   4001792     30036      9032   1421312   1421312       172         7
00000438      homesite45.exe  23937024     50808     10984  22159360  22159360       203         7
00000370             CMD.EXE    856064     13628      1616    253952    253952        23         1
000002A8         notepad.exe   2146304     19864      2552    720896    720896        42         2
0000030C         memsnap.exe    737280     12556      1704    307200    307200        18         1

Example 2: Generate Snapshot of Memory, GDI, and User Resources

To generate a snapshot of memory, GDI, and user resources being consumed, type the following at the command line:

memsnap /g

This command sends the memory data to the Memsnap.log file in the c:\ directory. Your output will look similar to the following:

Process ID         Proc.Name Wrkng.Set PagedPool  NonPgdPl  Pagefile    Commit   Handles   Threads
00000000              (null)     16384         0         0         0         0         0         1
00000008              System    217088         0         0     24576     24576       231        35
00000094            SMSS.EXE    356352      5944      1252   1122304   1122304        33         6
000000AC           csrss.exe   2072576     37332      5312   1359872   1359872       327        10
000000A8        WINLOGON.EXE   3530752     38376     62220   5906432   5906432       359        16
000000DC        services.exe   3375104     29640    216364   2564096   2564096       491        30
000000E8           LSASS.EXE   1232896     28100     37176   1961984   1961984       301        13
0000018C         svchost.exe   3284992     27592     16896   1318912   1318912       273         8
000001A8         SPOOLSV.EXE   3026944     20436     12904   2199552   2199552       105        10
000001C4        Avsynmgr.exe   2412544     19976      3428   1265664   1265664        98         4
000001D4         svchost.exe   2916352     39148     62548   3952640   3952640       398        26
000001F8          regsvc.exe    774144      8056      9548    241664    241664        30         2
00000208          mstask.exe   2912256     25596     15212   1032192   1032192       138         6
00000250         WinMgmt.exe    151552     15752      3208    651264    651264        90         3
0000028C          VSStat.exe   1294336     20264      3324   1228800   1228800        67         2
00000158        vshwin32.exe   1249280     22192      5136   2736128   2736128       107         7
000002C0        MCSHIELD.EXE   3694592     13060     20872   2301952   2301952       113        16
00000318        Avconsol.exe   2777088     20944      3948   1413120   1413120        67         2
0000035C        explorer.exe   2416640     49456     18424   4546560   4546560       308        17
000003E0       SETI@home.exe  16773120     26072      5724  16412672  16412672       126         3
00000388         winmine.exe   1069056     17080      2032    294912    294912        23         1
000003AC         cmmon32.exe    720896     15904      2580    352256    352256        52         3
00000404             MDM.EXE   2191360     18940      3780    704512    704512        91         5
00000380           SSEXP.EXE   3584000     25104      3064   1298432   1298432        60         4
000004A0         OUTLOOK.EXE  11083776     76404     20466   4190208   4190208       314        12
00000358        MAPISP32.EXE   4001792     30036      9032   1421312   1421312       172         7
00000438      homesite45.exe  23564288     50808     10932  21811200  21811200       204         7
00000370             CMD.EXE    856064     13628      1616    253952    253952        23         1
000004A4         memsnap.exe    737280     12556      1704    307200    307200        18         1

00000000              (null)     16384         0         0         0         0         0         1         0         0
00000008              System    217088         0         0     24576     24576       231        35         0         0
00000094            SMSS.EXE    356352      5944      1252   1122304   1122304        33         6         0         0
000000AC           csrss.exe   2306048     38604      5520   1372160   1372160       325        10         0         0
000000A8        WINLOGON.EXE   3530752     38376     62220   5906432   5906432       359        16         8        20
000000DC        services.exe   3375104     29640    216364   2564096   2564096       491        30         1         6
000000E8           LSASS.EXE   1232896     28100     37176   1961984   1961984       301        13         0         4
0000018C         svchost.exe   3284992     27592     16896   1318912   1318912       273         8         0         4
000001A8         SPOOLSV.EXE   3018752     20436     12904   2199552   2199552       104        10         0         4
000001C4        Avsynmgr.exe   2412544     19976      3428   1265664   1265664        98         4         0         4
000001D4         svchost.exe   2916352     39148     62548   3952640   3952640       398        26         6         8
000001F8          regsvc.exe    774144      8056      9548    241664    241664        30         2         0         0
00000208          mstask.exe   2912256     25596     15212   1032192   1032192       138         6         1         4
00000250         WinMgmt.exe    151552     15752      3208    651264    651264        90         3         0         4
0000028C          VSStat.exe   1294336     20264      3324   1228800   1228800        67         2        29        20
00000158        vshwin32.exe   1253376     22192      5136   2736128   2736128       107         7         2         6
000002C0        MCSHIELD.EXE   3710976     13060     20872   2306048   2306048       113        16         1         4
00000318        Avconsol.exe   2777088     20944      3948   1413120   1413120        67         2        18        63
0000035C        explorer.exe   3923968     51568     19152   4935680   4935680       345        14       215       216
000003E0       SETI@home.exe  17829888     26072      5776  17465344  17465344       126         3         9        24
00000388         winmine.exe   1069056     17080      2032    294912    294912        23         1         7        41
000003AC         cmmon32.exe    720896     15904      2580    352256    352256        52         3        14        12
00000404             MDM.EXE   2174976     18524      3572    675840    675840        78         3         1         4
00000380           SSEXP.EXE   3584000     25104      3064   1294336   1294336        60         4        68        68
000004A0         OUTLOOK.EXE  11128832     76372     20362   4202496   4202496       304        11       140       215
00000358        MAPISP32.EXE   4014080     30036      9032   1421312   1421312       172         7         6        29
00000438      homesite45.exe  24576000     50872     11080  22794240  22794240       203         7       294       543
00000370             CMD.EXE    860160     13628      1616    258048    258048        23         1         0         4
000002A8         notepad.exe   2146304     19864      2552    720896    720896        42         2        10        25
0000030C         memsnap.exe    737280     12556      1704    307200    307200        18         1         0         4

00000000              (null)     16384         0         0         0         0         0         1         0         0
00000008              System    217088         0         0     24576     24576       231        35         0         0
00000094            SMSS.EXE    356352      5944      1252   1122304   1122304        33         6         0         0
000000AC           csrss.exe   2269184     38048      5468   1372160   1372160       323        10         0         0
000000A8        WINLOGON.EXE   3530752     38376     62220   5906432   5906432       359        16         8        20
000000DC        services.exe   3375104     29640    216364   2564096   2564096       491        30         1         6
000000E8           LSASS.EXE   1257472     28132     37280   1994752   1994752       301        14         0         4
0000018C         svchost.exe   3284992     27592     16896   1318912   1318912       273         8         0         4
000001A8         SPOOLSV.EXE   3018752     20436     12904   2199552   2199552       104        10         0         4
000001C4        Avsynmgr.exe   2412544     19976      3428   1265664   1265664        98         4         0         4
000001D4         svchost.exe   2916352     39148     62548   3952640   3952640       398        26         6         8
000001F8          regsvc.exe    774144      8056      9548    241664    241664        30         2         0         0
00000208          mstask.exe   2912256     25596     15212   1032192   1032192       138         6         1         4
00000250         WinMgmt.exe    151552     15752      3208    651264    651264        90         3         0         4
0000028C          VSStat.exe   1294336     20264      3324   1228800   1228800        67         2        29        20
00000158        vshwin32.exe   1253376     22192      5136   2736128   2736128       107         7         2         6
000002C0        MCSHIELD.EXE   3710976     13060     20872   2306048   2306048       113        16         1         4
00000318        Avconsol.exe   2777088     20944      3948   1413120   1413120        67         2        18        63
0000035C        explorer.exe   4997120     51216     19256   4960256   4960256       349        15       215       217
000003E0       SETI@home.exe  17829888     26072      5776  17465344  17465344       126         3         9        24
00000388         winmine.exe   1069056     17080      2032    294912    294912        23         1         7        41
000003AC         cmmon32.exe    720896     15904      2580    352256    352256        52         3        14        12
00000404             MDM.EXE   2174976     18524      3572    675840    675840        78         3         1         4
00000380           SSEXP.EXE   3584000     25104      3064   1294336   1294336        60         4        68        68
000004A0         OUTLOOK.EXE  11485184     76596     20886   4202496   4202496       311        11       140       215
00000358        MAPISP32.EXE   4026368     30036      9032   1421312   1421312       172         7         6        29
00000438      homesite45.exe  24723456     50808     10984  22941696  22941696       203         7       294       543
00000370             CMD.EXE    860160     13628      1616    258048    258048        23         1         0         4
000004BC         memsnap.exe    733184     12556      1704    307200    307200        18         1         0         4

Example 3: Generate Snapshot of Memory Resources and Tagging Information

To generate a snapshot of memory resources being consumed with tagging information, type the following at the command line:

memsnap /t c:\data\memsnap.txt

This command sends the memory data to the Memsnap.txt file in the c:\data directory. Your output will look similar to the following:

Process ID         Proc.Name Wrkng.Set PagedPool  NonPgdPl  Pagefile    Commit   Handles   Threads
00000000              (null)     16384         0         0         0         0         0         1
00000008              System    217088         0         0     24576     24576       231        35
00000094            SMSS.EXE    356352      5944      1252   1122304   1122304        33         6
000000AC           csrss.exe   2297856     38676      5520   1363968   1363968       326        10
000000A8        WINLOGON.EXE   3530752     38376     62220   5906432   5906432       359        16
000000DC        services.exe   3375104     29640    216364   2564096   2564096       491        30
000000E8           LSASS.EXE   1232896     28100     37176   1961984   1961984       301        13
0000018C         svchost.exe   3284992     27592     16896   1318912   1318912       273         8
000001A8         SPOOLSV.EXE   3018752     20436     12904   2199552   2199552       104        10
000001C4        Avsynmgr.exe   2412544     19976      3428   1265664   1265664        98         4
000001D4         svchost.exe   2916352     39148     62548   3952640   3952640       398        26
000001F8          regsvc.exe    774144      8056      9548    241664    241664        30         2
00000208          mstask.exe   2912256     25596     15212   1032192   1032192       138         6
00000250         WinMgmt.exe    151552     15752      3208    651264    651264        90         3
0000028C          VSStat.exe   1294336     20264      3324   1228800   1228800        67         2
00000158        vshwin32.exe   1253376     22192      5136   2736128   2736128       107         7
000002C0        MCSHIELD.EXE   3710976     13060     20872   2306048   2306048       113        16
00000318        Avconsol.exe   2777088     20944      3948   1413120   1413120        67         2
0000035C        explorer.exe   2588672     50452     18996   4829184   4829184       334        14
000003E0       SETI@home.exe  16777216     26072      5724  16412672  16412672       126         3
00000388         winmine.exe   1069056     17080      2032    294912    294912        23         1
000003AC         cmmon32.exe    720896     15904      2580    352256    352256        52         3
00000404             MDM.EXE   2183168     18908      3676    692224    692224        81         4
00000380           SSEXP.EXE   3584000     25104      3064   1298432   1298432        60         4
000004A0         OUTLOOK.EXE  11087872     76724     20362   4177920   4177920       305        11
00000358        MAPISP32.EXE   4001792     30036      9032   1421312   1421312       172         7
00000438      homesite45.exe  23937024     50808     10984  22159360  22159360       203         7
00000370             CMD.EXE    856064     13628      1616    253952    253952        23         1
000002A8         notepad.exe   2146304     19864      2552    720896    720896        42         2
0000030C         memsnap.exe    737280     12556      1704    307200    307200        18         1

!LogType=memsnap
!ComputerName=TRINA
!buildnumber=2195
!buildtype=retail
!CSDVersion=Service Pack 1
!SystemTime=06\01\2001 20:36:13.0947 (GMT)
!TickCount=72164637
00000000              (null)     16384         0         0         0         0         0         1
00000008              System    217088         0         0     24576     24576       231        35
00000094            SMSS.EXE    356352      5944      1252   1122304   1122304        33         6
000000AC           csrss.exe   2400256     38288      5572   1417216   1417216       331        10
000000A8        WINLOGON.EXE   3600384     38376     62220   5890048   5890048       359        16
000000DC        services.exe   3375104     29640    216364   2564096   2564096       491        30
000000E8           LSASS.EXE    942080     28100     37176   1961984   1961984       301        13
0000018C         svchost.exe   3284992     27592     16896   1318912   1318912       273         8
000001A8         SPOOLSV.EXE   3018752     20436     12904   2199552   2199552       104        10
000001C4        Avsynmgr.exe   2412544     19976      3428   1265664   1265664        98         4
000001D4         svchost.exe   2916352     39148     62548   3952640   3952640       398        26
000001F8          regsvc.exe    774144      8056      9548    241664    241664        30         2
00000208          mstask.exe   2912256     25596     15212   1032192   1032192       138         6
00000250         WinMgmt.exe    151552     15752      3208    651264    651264        90         3
0000028C          VSStat.exe   1294336     20264      3324   1228800   1228800        67         2
00000158        vshwin32.exe   1253376     22192      5136   2736128   2736128       107         7
000002C0        MCSHIELD.EXE   3710976     13060     20872   2306048   2306048       113        16
00000318        Avconsol.exe   2777088     20944      3948   1413120   1413120        67         2
0000035C        explorer.exe   2166784     52368     19568   5013504   5013504       352        18
000003E0       SETI@home.exe  16777216     26072      5724  16412672  16412672       126         3
00000388         winmine.exe   1069056     17080      2032    294912    294912        23         1
000003AC         cmmon32.exe    720896     15904      2580    352256    352256        52         3
00000404             MDM.EXE   2203648     19324      3884    716800    716800        96         6
00000380           SSEXP.EXE   3584000     25104      3064   1294336   1294336        60         4
000004A0         OUTLOOK.EXE  11649024     77564     21250   4390912   4390912       331        14
00000358        MAPISP32.EXE   4026368     30036      9032   1421312   1421312       172         7
00000438      homesite45.exe  25358336     50860     11088  23629824  23629824       221         7
000004BC             CMD.EXE    856064     13628      1616    253952    253952        23         1
000003C4         memsnap.exe    749568     12556      1704    307200    307200        18         1


Msicuu.exe: Windows Installer Cleanup Utility
Overview | Notes | UI | Related Tools Run Tool

The Windows Installer Cleanup Utility, Msicuu, deletes the configuration data that Windows Installer maintains for a product that it installed, including directories, files, registry subkeys, and registry entries. You can use Msicuu to remove the remnants of a corrupted Windows Installer installation that prevents you from installing a product correctly.

Msicuu provides a dialog box from which you select a Windows Installer installation and execute the command. This method is safer than using Windows Installer Zapper (Msizap.exe), a command-line Windows Installer tool that offers potentially damaging configuation options.

Msicuu is designed to be used only when conventional methods of repairing or removing an installation have failed. Before using Msicuu, use Add or Remove Programs to remove or repair the installation.

Caution

  • Msicuu can delete installation data that is required by the system. Products installed by Windows Installer might not operate properly after using this tool.

You can use Msicuu to correct the following installation failures.

  • A Windows Installer installation, uninstallation, or rollback is interrupted or fails unpredictably. Because the installation did not complete successfully, Windows Installer will not uninstall or reinstall the program, or install any another programs.
  • Registry entries for a product have been deleted or changed, damaging the operation of the products and preventing you from uninstalling or reinstalling the product.
  • Multiple instances of a setup program are running simultaneously, or an instance of a setup program cannot run.

Concepts

Windows Installer manages the installation and removal of applications on Windows 2000 and Windows XP Professional. Typically, these installations conclude successfully, or are successfully reversed ("rolled back") or repaired. However, in rare situations, an installation, a rollback, or an uninstallation fails, leaving installation files and registry entries that would otherwise be removed. As long as these objects remain on the system, Windows Installer considers the installation to be active and incomplete.

Because Windows Installer conducts only one installation at a time, it will not start an installation until all indicators of the active installation are removed. You can use Msicuu to delete the configuration data remaining from a failed installation, thus allowing you to reinstall the product.

System Requirements

  • Msicuu runs on Windows 2000 and Windows XP Professional.
  • The user must be a member of the Adminstrators group on the computer.
  • Msicuu affects only the local computer. You cannot use it to manage a remote computer.

Files Required

  • Msicuu.exe
  • Msizap.exe


Msicuu Notes
Overview | Notes | UI | Related Tools Run Tool

Msicuu Log File

Msicuu records the installations that a user deletes in a log file, Msicu.log. It creates a log for each user who runs Msicuu and stores the log in the user profile. The log is cumulative, and is updated each time Msicuu runs.

The Msicuu log file, Msicu.log, is located in the SystemDrive\Documents and Settings\user\Local Settings\Temp directory. Because the Local Settings directory is hidden by default, to view the file, you must set your Windows Explorer folder options to show hidden files and folders.

The Msicuu log is not updated when you run Msizap.

Msicuu and Msizap

Msicuu uses the same programmatic functions as Msizap, and it runs Msizap (with the T parameter) to delete installation data. (You can see the Msizap command window briefly when you click Remove.)

Unlike Msizap, Msicuu does not remove rollback data or the InProgress registry subkey, and it does not change permissions to Windows Installer objects. Also, Msicuu removes user-specific installation data only from the profile of the current user. Installation data stored in other user profiles remains in the system.

Msicuu Products List

Msicuu displays a list of products that Windows Installer installed on the system. It compiles this list by calling Windows Installer functions that search the registry. Products that do not appear in this list cannot be removed by Msicuu or Msizap.

Products that are installed on the system, but that do not appear in the list, might have been installed by other technologies, such as those used before the advent of Windows Installer. You must use other methods to remove these installations.


Msicuu UI
Overview | Notes | UI | Related Tools Run Tool

To use Msicuu

  • To run Msicuu, in the Run dialog box or at the command prompt, type msicuu.
  • To quit Msicuu, click Exit.
  • To delete installation data, select one or more product names from the Installed Products box, and then click Remove.
  • To select all products, click Select All, or click Clear All to unselect all products.
  • Msicuu prompts you for confirmation. Its actions are not reversible.


Msizap.exe: Windows Installer Zapper
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool deletes configuration data that Windows Installer maintains for products that it installs, including the directories, files, registry subkeys, and registry entries in which Windows Installer stores configuration data. You can use Msizap to remove remnants of corrupted Windows Installer installations that prevent you from installing a product correctly.

You can also use Msizap to give Adminstrators Full Control permissions to Windows Installer folders, files, and registry subkeys.

Msizap is designed as a last resort tool to be used only when conventional methods of repairing or removing an installation have failed. Before using Msizap, use Add or Remove Programs to remove or repair the installation. If that fails, use the Windows Installer Cleanup Utility (Msicuu.exe), which runs Msizap, but prevents you from causing unnecesary harm to the system.

Caution

  • Msizap can delete installation data that is required by the system. Products installed by Windows Installer might not operate properly after using this tool.

You can use Msizap to correct the following installation failures.

  • A Windows Installer installation, uninstallation, or rollback is interrupted or fails unpredictably. Because the installation did not complete successfully, Windows Installer will not uninstall or reinstall the program, or install any another programs.
  • Registry entries for a product have been deleted or changed, damaging the operation of the products and preventing you from uninstalling or reinstalling the product.
  • Multiple instances of a setup program are running simultaneously, or an instance of a setup program cannot run.

Concepts

Windows Installer manages the installation and removal of applications on Windows XP Professional. Typically, these installations conclude successfully, or are successfully reversed ("rolled back") or repaired. However, in rare situations, an installation, a rollback, or an uninstallation fails, leaving installation files and registry entries that would otherwise be removed. As long as these objects remain on the system, Windows Installer considers the installation to be active and incomplete.

Because Windows Installer conducts only one installation at a time, it will not start another installation until all indicators of the active installation are removed.

You can use Msizap to remove particular installation remnants, such as the InProgress registry subkey and the rollback registry data. You can also delete all configuration data for a specified installation, or all Windows Installer installations on the system.

System Requirements

  • This version of Msizap runs on Windows XP Professional. (Windows 2000 includes a version of Msizap for that operating system.)
  • The user must be a member of the Adminstrators group on the computer.
  • Msizap affects only the local computer. You cannot use it to manage a remote computer.

File Required

  • Msizap.exe


Msizap Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

General Information

  • Typing msizap without any parameters, or with an incorrect parameter combination, displays help.
  • When you run Msizap, it displays a complete transaction log, including a list of the folders, files, and registry subkeys that it deleted or changed.
  • Msizap only affects products installed by Windows Installer. It does not affect products that were installed by other technologies, including older Windows applications that were installed before the advent of Windows Installer.
  • Msizap does not uninstall programs or delete objects that programs install during their setup procedures. It only deletes configuration data that Windows Installer stores for its own use.
  • Programs removed by using Msizap might no longer appear in Add or Remove Programs in Control Panel.

Troubleshooting Windows Installer

Msizap is designed to be used as a last resort to remove the remnants of a corrupted installation. It is a blunt instrument that can delete installation data that is required by the system.

Before using Msizap, try the following less-risky methods for repairing an failed installation.

  • Use Add or Remove Programs in Control Panel to remove or repair the installation.
  • Use Msiexe.exe, the command line version of Windows Installer, with parameters to repair the installation and recache the local package. For example, use the following syntax to repair the MyPackage installation.

    msiexec /fvomus package.msi

  • Use the Windows Installer Cleanup Utility, Msicuu.exe, a Windows XP Professional Support Tool. The Windows Installer Cleanup Utility runs Msizap with the T parameter for any specified installation. It is safer to use than Msizap because it lists the installations in a dialog box and acts on only one installation at a time.

Troubleshooting Msizap

When Msizap completes successfully, it displays a log of the objects that it searched, deleted, and changed. To determine whether Msizap ran to completion, look for one of the following statements at the end of the log.

Final log statement | Description
Searching for files and folders in the %WINDIR%\Installer folder | Msizap successfully completed a command using the T or A parameters. If the Installer folder is empty, then Msizap records a final action, in which it deletes the Installer folder.
No product data was found. | Msizap searched successfully, but did not find any of the specified objects on the system. Typically, this happens when a Msizap command is repeated.
FAILED to clear all data. | Msizap could not delete all of the data requested by the command. Output that ends with this statement also includes a failure statement and an error code at the point in the log at which the failure occurred. Failures are typically caused by problems with permissions, or with folders that do not reside on the local computer.

Active (Incomplete) Installations

When an installation does not complete or roll back successfully, some remnants of the installation might remain in the system. Windows Installer considers the incomplete installation to be active and will not install new products or reinstall existing products until the installation is resolved.

Because Windows Installer runs only one installation at a time, only one installation is active at any given time, and there will be only one instance of the indicator objects on any system.

The following objects indicate an active, incomplete installation on the system. When an installation completes successfully, Windows Installer automatically deletes these objects from the system.

  • The InProgress registry subkey (HKLM\Software \Microsoft \Windows \CurrentVersion \Installer \InProgress).
  • Rollback data, which includes rollback scripts, registry entries for the DisableRollback Group Policy setting, and the Rollback registry subkey (HKLM\Software \Microsoft \Windows \CurrentVersion \Installer \Rollback).
  • Temporary backup copies and cached data.

To search for the InProgress subkey on a system, use Regedit.exe or Reg.exe, tools included in Windows XP Professional. Enter the following Reg command:

reg /query [\\ComputerName] HKLM \SOFTWARE \Microsoft \Windows \CurrentVersion \Installer \InProgress

To search for the Rollback subkey on a system, use Regedit or Reg, tools included in Windows XP Professional. Enter the following Reg command:

reg /query [\\ComputerName] HKLM \SOFTWARE \Microsoft \Windows \CurrentVersion \Installer\Rollback

Msizap and User Profiles

The W parameter, which is new to this version of Msizap, extends the Msizap command to all user profiles in the system. By default, Msizap only deletes the user-specific data stored in or associated with the profile of the current user.

The W parameter acts on all user profiles that appear in HKEY_USERS when the command runs. Profiles of users who have interactive logon rights, but are not logged on to the computer when the command runs, are not affected.

The W parameter is effective when the program is installed in per-machine format (that is, in the All Users profile), or when it has been installed by more than one user of the computer. You can also use W to repair a system for a user other than the current user, such as when an Administrator repairs the configuration of a non-Administrator user.

For information on user-specific and computer-specific installations, see the topics Per-Machine Installations (http://www.microsoft.com/) and Per-User Installations (http://www.microsoft.com/) in the Platform SDK.

Stopping the Windows Installer Service

The * ALLPRODUCTS and T parameters stop the Windows Installer service so that Msizap can obtain exclusive access to the files, folders, and registry subkeys that it needs to change or delete. Because the Windows Installer service starts automatically when needed and stops automatically when idle, you do not need to stop or restart this service manually.

Identifying Package Files

All Windows Installer Package files end with the file name extension .msi. However, the file names are sometimes obscure and are often numeric, making it hard to determine which program the package file installs. Fortunately, this data is included in the summary information associated with each package file.

To display the summary information for a package file, use one of the following methods.

  • In Windows Explorer, place the mouse pointer over the name of an .msi file. (However, don't click.)
  • In Windows Explorer, right click the name of an .msi file, click Properties, and then click the Summary tab.

Folders Deleted by Msizap

Msizap attempts to delete the following directories when it is run with the * or T parameters. The list of objects actually deleted appears in the command window when you run Msizap.

  • SystemDrive \Documents and Settings \UserName \Application Data \Microsoft \Installer \ProductCode
  • Systemroot \MSI
  • Systemroot \Installer \ProductCode (a hidden system folder)
  • Drive:\config.msi (for each local drive)

Registry Subkeys Deleted by Msizap

Msizap attempts to delete the following registry subkeys when it is run with the * or T parameters. The list of objects actually deleted appears in the command window when you run Msizap.

  • HKCU\Software\Classes \Installer \Features \ProductCode
  • HKCU\Software\Classes \Installer \Products \ProductCode
  • HKCU\Software\Microsoft \Installer \Features \ProductCode
  • HKCU\Software\Microsoft \Installer \Products \ProductCode
  • HKCU\Software\Microsoft \Installer \UpgradeCodes \ProductCode
  • HKCU\Software\Microsoft \Windows \CurrentVersion \Installer \UpgradeCodes \ProductCode
  • HKLM\Software\Classes \Installer \Features \ProductCode
  • HKLM\Software\Classes \Installer \Products \ProductCode
  • HKLM\Software\Microsoft \Windows \CurrentVersion \Installer \Features \ProductCode
  • HKLM\Software\Microsoft \Windows \CurrentVersion \Installer \Managed \SID \Installer \Products \ProductCode
  • HKLM\Software\Microsoft \Windows \CurrentVersion \Installer \Managed \SID \Installer \Features \ProductCode
  • HKLM\Software\Microsoft \Windows \CurrentVersion \Installer \Products \ProductCode
  • HKLM\Software\Microsoft \Windows \CurrentVersion \Installer \UpgradeCodes \ProductCode
  • HKLM\Software\Microsoft \Windows \CurrentVersion \Installer \UserData \SID \Components
  • HKLM\Software\Microsoft \Windows \CurrentVersion \Installer \UserData \SID \Products
  • HKLM\Software\Microsoft \Windows \CurrentVersion \Uninstall \ProductCode - if there are no longer any installations with the specified product code.
  • HKLM\Software\Microsoft \Windows \CurrentVersion \Installer \UserData \{user sid} \Components
  • HKLM\Software\Microsoft \Windows \CurrentVersion \Installer \UserData \{usersid} \Products


Msizap Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Msizap uses the following syntax combinations:

To remove remnants of an active (incomplete) installation.

One Step msizap [P][S]

To remove data for a specified installation.

One Step msizap [T][P][S][W] PackageName | { ProductCode }

To remove all installation data.

One Step msizap *[W][!] ALLPRODUCTS

To give Administrators Full Control permission to installation data.

One Step msizap A[*][T][W][P][S] [PackageName | { ProductCode } | ALLPRODUCTS]

To display help.

One Step msizap /?

Note

  • When deleting objects that are unique in the system (such as the InProgress registry subkey or rollback data), or to change permissions, you do not need to specify an installation package.
  • The package name, product code, or ALLPRODUCTS, if included, must be the last parameter in the command. Other parameters may be listed in any order.

Parameters

PackageName | { ProductCode }
Specifies an installation as the target of the Msizap command. Type the product code or the path and file name of the MSI package file, such as c:\ptree.msi. If you do not specify an installation, then Msizap commands apply to all Windows Installer installations on the computer.
ALLPRODUCTS
Indicates all Windows Installer installations on the computer. ALLPRODUCTS is required when using *.
*
Deletes all Windows Installer configuration data on the computer. ALLPRODUCTS is required when using *.

This parameter deletes the folders, files, registry subkeys and registry entries in which Windows Installer stores configuration data, including rollback data and the InProgress registry subkeys for each installation. It also stops the Windows Installer service, deletes published icons (icons that offer to install a program), and adjusts shared DLL counts.

T
Deletes Windows Installer configuration data for a specified installation.

This parameter deletes the folders, files, registry subkeys and registry entries in which Windows Installer stores configuration data for the installation (except for rollback data and the InProgress registry subkey, which are specified separately). It also stops the Windows Installer service, deletes published icons (icons that offer to install a program), and adjusts shared DLL counts.

P
Deletes the InProgress registry subkey.

This parameter deletes the subkey that indicates to Windows Installer that an installation is in progress (HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress). While this subkey remains in the registry, Windows Installer will not install another program. Because Windows Installer deletes the InProgress subkey when an installation completes, this subkey is present only for an active installation.

S
Deletes rollback data.

This parameter deletes the Rollback registry subkey (HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback), rollback scripts, and backup copies that enable Windows Installer to restore the computer to its original state when an installation stops before it is complete. Because Windows Installer automatically deletes rollback data when an installation completes, rollback data is present only for an active installation.

W
Extends the command to all user profiles. By default, Msizap deletes and changes user-specific data only for the current user.
A
Gives Adminstrators Full Control permission to the folders, files, and registry subkeys specified by other parameters in the command. When combined with A, other parameters specify which object DACLs are changed; they do not direct Msizap to delete installation configuration data.

When using T, you must specify an installation by package name or product code. When using *, you must specify ALLPRODUCTS.

!
Suppresses all confirmation messages.
?
Displays help.

Sample Usage

msizap *! ALLPRODUCTS
msizap PS
msizap AT ptree.msi
msizap WTP MyPackage.msi
msizap TW {00000001-0001-0000-0000-624474736554}


Msizap Examples
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Delete Remnants of an Active Installation

The following command deletes the InProgress subkey and the indicators of an active (incomplete) installation on the computer. Because the command does not specify an installation, Msizap searches all installations until it finds these objects.

In this command, the P parameter deletes the InProgress registry subkey and the S parameter deletes rollback data.

msizap PS

In response, Msizap lists the actions it took to comply with the command.

MsiZapInfo: Performing operations for user S-1-5-21-2127521184-1604012920-1887927527-00000

Searching for the Windows Installer InProgress key. . .
   Removed  \Software\Microsoft\Windows\CurrentVersion\Installer\InProgress
Searching for Installer files and folders associated with the product {ALL PRODUCTS}. . .
  Searching for rollback folders. . .
Searching for the Windows Installer Rollback key. . .
   Removed  \Software\Microsoft\Windows\CurrentVersion\Installer\Rollback

The list begins by identifying the user profile from which user-specific data is deleted. Unless the W parameter is used, only the SID of the current user appears.

The remaining elements in the list report objects deleted or changed by the command. Note that Msizap searches for all products because the command did not specify a product by name or product code.

Example 2: Remove Installation Data for a Program

The following command deletes all Windows Installer configuration data for MyApp.exe, a fictitious program installed by the MyApp.msi package file.

The command identifies the program by using the fully qualified path to the MSI package file for the program. It uses the T parameter to delete the folders, files, and registry subkeys that Windows Installer created for the package, and the P and S parameters to remove rollback data and the InProgress subkey, in case they remain in the system.

Finally, the command redirects the output to a text file (Msizap.log), so that the detailed output is recorded in file.

msizap TPS "C:\Program Files\My Apps\MyApp.msi" > msizap.log

The resulting Msizap.log file begins by displaying the SID of the user profile from which Msizap deleted user-specific objects (in this case, the current user profile), followed by a complete log of the objects that it seached for, deleted, and changed.

As expected for a command using the T parameter, the log ends with a search of the %WINDIR%\Installer folder. If this folder no longer contains any directories, then Msizap deletes the folder. In this case, the folder still contains data for other programs, so Msizap does not delete it.

See sample output

C:\myapp>msizap tps myapp.msi
MsiZapInfo: Performing operations for user S-1-5-21-2000000004-1000000000-1000000000-00000

Searching for the Windows Installer InProgress key. . .
Searching for Installer files and folders associated with the product {00000001-0001-0000-
0000-624474736554}. . .
  Searching for rollback folders. . .
Searching for the Windows Installer Rollback key. . .
Searching for the product {00000001-0001-0000-0000-624474736554} cached package. . .
   Removed file: C:\WINDOWS\Installer\56cb1ce.msi
Searching for install property data for product {00000001-0001-0000-0000-624474736554}. ..
   Removed  \10000000100000000000264447375645\InstallProperties
Searching for product {00000001-0001-0000-0000-624474736554} data in the HKLM\Software\Mic
rosoft\Windows\CurrentVersion\Uninstall key. . .
   Removed  \{00000001-0001-0000-0000-624474736554}
Searching user's global config location for product {00000001-0001-0000-0000-624474736554}
 data. . .
  Searching for product 10000000100000000000264447375645 upgrade codes in Software\Microso
ft\Windows\CurrentVersion\Installer\UpgradeCodes...
   Removed upgrade code '10000000100000000000264447375645' at HKLM\Software\Microsoft\Wind
ows\CurrentVersion\Installer\UpgradeCodes
  Searching for patches for product 10000000100000000000264447375645 in Software\Microsoft
\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2000000004-1000000000-1000000000-00000
\Products\10000000100000000000264447375645\Patches
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2000000004-1000000000-1000000000-00000\Products\10000000100000000000264447375645 for product
data. . .
   Removed  \Features
   Removed  \Usage
   Removed  \Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2000000004-1000000000-1000000000-00000\Products\10000000100000000000264447375645
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2000000004-1000000000-1000000000-00000\Features\10000000100000000000264447375645 for product
feature data. . .
Searching per-machine global config location for product {00000001-0001-0000-0000-62447473
6554} data. . .
  Searching for product 10000000100000000000264447375645 upgrade codes in Software\Microso
ft\Windows\CurrentVersion\Installer\UpgradeCodes...
  Searching for patches for product 10000000100000000000264447375645 in Software\Microsoft
\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\10000000100000000000264447375
645\Patches
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Pro
ducts\10000000100000000000264447375645 for product data. . .
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Fea
tures\10000000100000000000264447375645 for product feature data. . .
Searching old global config location for product {00000001-0001-0000-0000-624474736554} da
ta. . .
  Searching for product 10000000100000000000264447375645 upgrade codes in Software\Microso
ft\Windows\CurrentVersion\Installer\UpgradeCodes...
  Searching for patches for product 10000000100000000000264447375645 in Software\Microsoft
\Windows\CurrentVersion\Installer\Products\10000000100000000000264447375645\Patches
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Products\100000001000
00000000264447375645 for product data. . .
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Features\100000001000
00000000264447375645 for product feature data. . .
Searching per-machine location for product {00000001-0001-0000-0000-624474736554} data. ..
  Searching for product 10000000100000000000264447375645 upgrade codes in Software\Classes
\Installer\UpgradeCodes...
  Searching for patches for product 10000000100000000000264447375645 in Software\Classes\I
nstaller\Products\10000000100000000000264447375645\Patches
  Searching Software\Classes\Installer\Components for published component data for the pro
duct {00000001-0001-0000-0000-624474736554}. . .
  Searching HKLM\Software\Classes\Installer\Products\10000000100000000000264447375645 for
product data. . .
  Searching HKLM\Software\Classes\Installer\Features\10000000100000000000264447375645 for
product feature data. . .
Searching old per-user location for product {00000001-0001-0000-0000-624474736554} data. ..
  Searching for product 10000000100000000000264447375645 upgrade codes in Software\Classes
\Installer\UpgradeCodes...
  Searching for patches for product 10000000100000000000264447375645 in Software\Classes\I
nstaller\Products\10000000100000000000264447375645\Patches
  Searching Software\Classes\Installer\Components for published component data for the product {00000001-0001-0000-0000-624474736554}. . .
  Searching HKCU\Software\Classes\Installer\Products\10000000100000000000264447375645 for
product data. . .
  Searching HKCU\Software\Classes\Installer\Features\10000000100000000000264447375645 for
product feature data. . .
Searching per-user location for product {00000001-0001-0000-0000-624474736554} data. . .
  Searching for product 10000000100000000000264447375645 upgrade codes in Software\Microso
ft\Installer\UpgradeCodes...
   Removed upgrade code '10000000100000000000264447375645' at HKCU\Software\Microsoft\Inst
aller\UpgradeCodes
  Searching for patches for product 10000000100000000000264447375645 in Software\Microsoft
\Installer\Products\10000000100000000000264447375645\Patches
  Searching Software\Microsoft\Installer\Components for published component data for the p
roduct {00000001-0001-0000-0000-624474736554}. . .
   Removed product's published component qualifier value Convertor for published component
 10000000400000000000264447375645
   Removed published component qualifier value Convertor
   Removed HKCU\Software\Microsoft\Installer\Components\10000000400000000000264447375645
  Searching HKCU\Software\Microsoft\Installer\Products\10000000100000000000264447375645 fo
r product data. . .
   Removed  \Media
   Removed  \Net
   Removed  \SourceList
   Removed  \Software\Microsoft\Installer\Products\10000000100000000000264447375645
  Searching HKCU\Software\Microsoft\Installer\Features\10000000100000000000264447375645 fo
r product feature data. . .
   Removed  \Software\Microsoft\Installer\Features\10000000100000000000264447375645
Searching for product {00000001-0001-0000-0000-624474736554} in per-user managed location.
  Searching for product 10000000100000000000264447375645 upgrade codes in Software\Microso
ft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-2000000004-1000000000-1000000000-00000\Installer\UpgradeCodes...
  Searching for patches for product 10000000100000000000264447375645 in Software\Microsoft
\Windows\CurrentVersion\Installer\Managed\S-1-5-21-2000000004-1000000000-1000000000-00000\
Installer\Products\10000000100000000000264447375645\Patches
  Searching Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-2000000004-1000000000-1000000000-00000\Installer\Components for published component data for the product {00000001-0001-0000-0000-624474736554}. . .
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-2000000004-1000000000-1000000000-00000\Installer\Products\10000000100000000000264447375645 for
 product data. . .
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-2000000004-1000000000-1000000000-00000\Installer\Features\10000000100000000000264447375645 for
 product feature data. . .
Searching for shared DLL counts for components tied to the product 10000000100000000000264
447375645. . .
Searching for shared DLL counts for components tied to the product 10000000100000000000264
447375645. . .
   Reduced shared DLL count to 1 for: C:\Test\myapp.EXE
  Searching for product 10000000100000000000264447375645 client info data. . .
   Removed client of component 30000000300000000000264447375645
   Removed client of component 40000000300000000000264447375645
   Removed client of component 50000000300000000000264447375645
   Removed client of component 51000000300000000000264447375645
   Removed client of component 71000000300000000000264447375645
   Removed client of component A0000000300000000000264447375645
  Searching for product 10000000100000000000264447375645 client info data. . .
Searching for Installer files and folders associated with the product {00000001-0001-0000-
0000-624474736554}. . .
  Searching for files and folders in the user's profile. . .
   Removed file: C:\Documents and Settings\user38.RESKIT\Application Data\Microsoft\Instal
ler\{00000001-0001-0000-0000-624474736554}\advt.ico
   Removed file: C:\Documents and Settings\user38.RESKIT\Application Data\Microsoft\Instal
ler\{00000001-0001-0000-0000-624474736554}\CD.ico
   Removed folder: C:\Documents and Settings\user38.RESKIT\Application Data\Microsoft\Inst
aller\{00000001-0001-0000-0000-624474736554}
  Searching for files and folders in the %WINDIR%\Installer folder

Example 3: Change Permissions to Installation Objects

The following command grants members of the Administrators group on the computer Full Control permission to the folders, files, and registry subkeys for the MyApp.msi installation. The command changes permissions only; it does not delete any installation data.

The command uses the A parameter to specify that it is changing permissions, and the T and W parameters to specify which permissions it is changing. The command changes permissions on objects that the T parameter would otherwise delete, that is, the permissions to all files, folders, and registry subkeys that Windows Installer maintains for the installation. The W parameter extends the permission changes to objects in all user profiles in the registry.

In this command, the MyApp.msi package is identified by its product code, enclosed in the required braces.

msizap ATW {00000001-0001-0000-0000-624474736554}

The resulting Msizap.log file is divided into sections for each user profile that Msizap changes. The log lists all of the objects for which Msizap searched, and those on which it changed permissions.

As expected for a command using the A parameter, each section of the log ends with a search of the %WINDIR%\Installer folder.

See sample output

   ***** Adjusting ACLs on data for user S-1-5-18 for product
{00000001-0001-0000-0000-624474736554} *****

MsiZapInfo: Performing operations for user S-1-5-18
Searching for the product {00000001-0001-0000-0000-624474736554} cached package. . .
Searching for install property data for product {00000001-0001-0000-0000-624474736554}. . .
Searching user's global config location for product {00000001-0001-0000-0000-624474736554} data. . .
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Prod
ucts\10000000100000000000264447375645 for product data. . .
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Feat
ures\10000000100000000000264447375645 for product feature data. . .
Searching per-machine global config location for product {00000001-0001-0000-0000-624474736554} data. . .
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Prod
ucts\10000000100000000000264447375645 for product data. . .
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Feat
ures\10000000100000000000264447375645 for product feature data. . .
Searching old global config location for product {00000001-0001-0000-0000-624474736554} data. . .
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Products\1000000010000
0000000264447375645 for product data. . .
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Features\1000000010000
0000000264447375645 for product feature data. . .
Searching per-machine location for product {00000001-0001-0000-0000-624474736554} data. . .
  Searching HKLM\Software\Classes\Installer\Products\10000000100000000000264447375645 for
product data. . .
  Searching HKLM\Software\Classes\Installer\Features\10000000100000000000264447375645 for
product feature data. . .
Searching for product {00000001-0001-0000-0000-624474736554} in per-user managed location.
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-18\Insta
ller\Products\10000000100000000000264447375645 for product data. . .
  Searching HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-18\Insta
ller\Features\10000000100000000000264447375645 for product feature data. . .
  Searching for product 10000000100000000000264447375645 client info data. . .
  Searching for product 10000000100000000000264447375645 client info data. . .
Searching for Installer files and folders associated with the product {00000001-0001-0000-0000-624474736554}. . .
  Searching for files and folders in the user's profile. . .
   Removed ACL on file: C:\Documents and Settings\user38.RESKIT\Application Data\Microsoft\Installer\{00000001-0001-0000-0000-624474736554}\advt.ico
   Removed ACL on file: C:\Documents and Settings\user38.RESKIT\Application Data\Microsoft\Installer\{00000001-0001-0000-0000-624474736554}\CD.ico
   Removed ACL on folder: C:\Documents and Settings\user38.RESKIT\Application Data\Microsoft\Installer\{00000001-0001-0000-0000-624474736554}
  Searching for files and folders in the %WINDIR%\Installer folder

***** Adjusting ACLs on data for user S-1-5-18 for product
{00000001-0001-0000-0000-624474736554} *****
... (Data truncated)

***** Adjusting ACLs on data for user S-1-5-21-2127521184-1604012920-1887927527-31305 for product {00000001-0001-0000-0000-624474736554} *****
... (Data truncated)

***** Adjusting ACLs on data for user S-1-5-21-2127521184-1604012920-1887927527-31305 for product {00000001-0001-0000-0000-624474736554} *****
... (Data truncated)
  Searching for files and folders in the %WINDIR%\Installer folder

Example 4: Delete Configuration Data for Another User

The following command deletes Windows Installer configuration data for MyApp.msi for all users of the computer. The command is intended to remove installer data from the profile of User21, a user who is not a member of the Administrators group on the computer. To assure that the user's profile is loaded in the registry, the command must run while User21 is logged on to the system. However, because Msizap runs only with Adminstrator permissions, an Administrator must run this command. In this example, the Administrator uses the Runas command extension to provide their credentials.

The command uses the T parameter to specify that all Windows Installer files, folders, and registry subkeys for MyApp.msi are deleted. It also uses the W parameter to make certain that the profile of User21 is affected, because Runas can temporarily make the Adminstrator the current user of the computer.

The command is run by the Administrator while User21 is logged on to the computer.

runas /env /user:Computer21\Administrator msizap TW MyApp.msi

In response, Runas prompts the Administrator for a password, and then Msizap responds to the command. All MyApp.exe installer configuration data for all users, including User21, is deleted.

Example 5: Delete All Configuration Data From the System

The following command deletes all Windows Installer configuration data for all programs on the system. Because this command can cause serious and irreparable harm, it is very rarely used.

The command uses the * ALLPRODUCTS parameters to extend the command to all products that Windows Installer installed on the system. It uses the W parameter to delete data from all user profiles. The only Windows Installer data that might remain in the system when the command completes is data that is stored in user profiles that are not present in the registry when the command runs.

msizap *W ALLPRODUCTS


Oh.exe: Open Handles
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool shows the handles of all open windows. The tool can also be used to show only information relating to a specific process, object type, or object name. This feature is useful for finding the process that has a file open when a sharing violation occurs.

To function properly, OH must enable a kernel option that maintains a linked list of all objects sorted by object type. If the kernel option is not turned on, OH enables the kernel option and notifies you to restart the computer so that OH functions and displays information.

Corresponding UI

There is no corresponding user interface for OH.

Concepts

A handle is a 32-bit positive integer that Windows uses to identify a window or other object, such as a font or bitmap.

In Windows, a window is any window that you see on the screen as well as many objects that you cannot see. A window can be a bounded rectangular area of the screen (such as a Microsoft Word window) or a control on a form (such as a list box or a scroll bar) although not all types of controls are windows. The desktop and the icons that appear on it are windows.

Because all of these types of objects are windows, Windows can treat them similarly. Windows gives every window a unique handle when it is created and uses that handle to control that window. When the window is destroyed, Windows frees the handle it used to control the window. A window retains the same handle during its lifetime, but each time the window is recreated, a new handle is assigned. In other words, a window probably will not have the same handle if it is destroyed and recreated.

System Requirements

The following are the system requirements for OH:

  • Windows XP Professional

File required

  • Oh.exe


OH Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Lowering Linked List Overhead

The linked list uses 8 bytes of overhead per object. You can disable this option later by using Gflags. To disable this option in Gflags, clear the Maintain a list of objects for each type check box in the Global Flags window, then restart the computer.


OH Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

OH uses the following syntax:

One Step oh [/p ClientID] [/t TypeName] [/o FileName] [/a] [Name] [/?]

Parameters

/p ClientID
Displays open handles for the process with an ID of ClientId.
/t TypeName
Displays open object names of the specified type. Examples include Key, File, Directory, Desktop, Semaphore, Mutant, Section, Event, Thread.

Note

    Use the /a parameter to display unnamed objects of the specified type.

/o FileName
Specifies the name of the file that writes output.
/a
Includes objects with no name.
Name
Displays handles that contain the specified name.
/?
Displays command-line Help.


OH Examples
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Enable the Kernel Option

To function properly, OH must enable a kernel option that maintains a linked list of all objects sorted by object type. To set the kernel option, type the following at the command line:

oh

Output similar to the following is displayed in the command window:

Enabled maintaining a list of objects for each type.
Will take effect next time you boot.
Until then, OH is unable to query useful information

Restart your computer, and you can then use OH.

Example 2: List Handles for Open Windows

To generate a list of handles for open windows and send the output to the file C:\Output\Ohall.txt, type the following at the command line:

oh /o c:\output\ohall.txt

Looking in Ohall.txt, you then see output similar to the following:

00000004 System         Key            000c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\WPA
00000004 System         Key            0010 \REGISTRY
00000004 System         Key            0014
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session
Manager\WPA\SigningHash-PRCRFTFJWDC27Q
00000004 System         Key            0018
\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter
00000004 System         Key            001c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Executive
00000004 System         Key            0020 \REGISTRY\MACHINE\SYSTEM\Setup
00000004 System         Key            0024
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ProductOptions
00000004 System         Key            0028
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Eventlog
00000004 System         Event          002c \Security\TRKWKS_EVENT
00000004 System         File           0034
\WINDOWS\system32\config\software
00000004 System         Key            0040
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\USB\ROOT_HUB\3&29761208&0\Device
Parameters
00000004 System         File           0044 \WINDOWS\system32\config\SAM.LOG
00000004 System         Key            0048
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_8086&DEV_7112&SUBSYS_00000000&REV_01\2&ebb567f&0&22\Device
Parameters
00000004 System         Key            004c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_8086&DEV_7112&SUBSYS_00000000&REV_01\2&ebb567f&0&22\Device
Parameters
00000004 System         Key            0050
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0000
00000004 System         Key            0054
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0000
00000004 System         Key            0058
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Video\{67BA24C1-E772-4266-BBE5-D44FE7A9D9A4}\0000\VolatileSettings
00000004 System         Key            005c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0000
00000004 System         Key            006c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Memory
Management\PrefetchParameters
00000004 System         File           007c
\WINDOWS\system32\config\SECURITY
00000004 System         File           0084
\WINDOWS\system32\config\default.LOG
00000004 System         File           0088 \WINDOWS\system32\config\SAM
00000004 System         Event          008c
\Device\DmControl\VxKernel2VoldEvent
00000004 System         File           0090 \WINDOWS\system32\config\default
00000004 System         Directory      0094 \Device\WinDfs
00000004 System         Directory      009c \Device\Harddisk0
00000004 System         File           00a0
\WINDOWS\system32\config\system.LOG
00000004 System         File           00b8
\WINDOWS\system32\config\software.LOG
00000004 System         Port           00d0 \SeRmCommandPort
00000004 System         Event          00d4 \LanmanServerAnnounceEvent
00000004 System         File           00d8 \pagefile.sys
00000004 System         File           00f4
\WINDOWS\system32\config\SECURITY.LOG
00000004 System         File           01a4 \Documents and
Settings\LocalService.NT AUTHORITY\NTUSER.DAT
00000004 System         File           01b0 \Documents and
Settings\NetworkService.NT AUTHORITY\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG
00000004 System         File           01b4 \Documents and
Settings\LocalService.NT AUTHORITY\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
00000004 System         File           01bc \Documents and
Settings\NetworkService.NT AUTHORITY\NTUSER.DAT
00000004 System         File           01c0 \Documents and
Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG
00000004 System         File           01c8 \Documents and
Settings\NetworkService.NT AUTHORITY\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
00000004 System         File           01cc \Documents and
Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG
00000004 System         File           01d0 \Documents and
Settings\LocalService.NT AUTHORITY\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG
00000004 System         File           0238 \WINDOWS\system32\config\system
00000004 System         File           02fc
\WINDOWS\system32\MsDtc\Trace\dtctrace.log
00000004 System         File           0390 \Documents and
Settings\NetShowServices\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
00000004 System         Directory      0394 \Device\Http
00000004 System         File           03a0 \Documents and
Settings\NetShowServices\NTUSER.DAT
00000004 System         File           03a4 \Documents and
Settings\NetShowServices\ntuser.dat.LOG
00000004 System         File           03b4 \Documents and
Settings\NetShowServices\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG
00000004 System         File           03b8 \
00000004 System         File           0498 \WINDOWS\DfsSvcLogFile
00000004 System         File           04a8 \255
00000004 System         File           0c3c \Documents and
Settings\user.XP\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
00000004 System         File           0c44 \Documents and
Settings\user.XP\ntuser.dat.LOG
00000004 System         File           0c48 \Documents and
Settings\user.XP\NTUSER.DAT
00000004 System         File           0c4c \Documents and
Settings\user.XP\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG
00000004 System         File           0dcc
\WINDOWS\system32\LogFiles\W3SVC1\ex010522.log
00000004 System         File           0ddc \Topology
00000004 System         File           0dfc \47
000000C0 smss.exe       File           0010 \WINDOWS
000000C0 smss.exe       Port           0014 \SmApiPort
000000C0 smss.exe       Directory      001c \GLOBAL??
000000C0 smss.exe       Directory      0020 \Sessions
000000C0 smss.exe       File           0024 \WINDOWS\system32
000000C0 smss.exe       Directory      0028 \KnownDlls
000000C0 smss.exe       SymbolicLink   002c \KnownDlls\KnownDllPath
000000C0 smss.exe       Key            0030
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
000000C0 smss.exe       Key            0034
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CrashControl
000000C0 smss.exe       Event          0038 \UniqueSessionIdEvent
000000D8 csrss.exe      Directory      0010 \KnownDlls
000000D8 csrss.exe      File           0014 \WINDOWS\system32
000000D8 csrss.exe      Directory      0018 \Sessions\BNOLINKS
000000D8 csrss.exe      SymbolicLink   0020 \Sessions\BNOLINKS\0
000000D8 csrss.exe      Directory      0024 \Sessions\0
000000D8 csrss.exe      Directory      0028 \Sessions\0\DosDevices
000000D8 csrss.exe      Directory      002c \Windows
000000D8 csrss.exe      Directory      003c \BaseNamedObjects
000000D8 csrss.exe      Directory      0040 \BaseNamedObjects\Restricted
000000D8 csrss.exe      Mutant         0044 \NlsCacheMutant
000000D8 csrss.exe      Mutant         004c \NlsCacheMutant
000000D8 csrss.exe      Section        0050 \NLS\NlsSectionUnicode
000000D8 csrss.exe      Section        0054 \NLS\NlsSectionLocale
000000D8 csrss.exe      Section        0058 \NLS\NlsSectionCType
000000D8 csrss.exe      Section        005c \NLS\NlsSectionSortkey
000000D8 csrss.exe      Section        0060 \NLS\NlsSectionSortTbls
000000D8 csrss.exe      Directory      0080 \BaseNamedObjects
000000D8 csrss.exe      Key            00a0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\PriorityControl
000000D8 csrss.exe      Port           00a4 \Windows\ApiPort
000000D8 csrss.exe      Port           00a8 \Windows\SbApiPort
000000D8 csrss.exe      Event          00dc
\BaseNamedObjects\WinSta0_DesktopSwitch
000000D8 csrss.exe      Desktop        00f0 \Disconnect
000000D8 csrss.exe      WindowStation  00f4 \Windows\WindowStations\WinSta0
000000D8 csrss.exe      Desktop        04e4 \Default
000000D8 csrss.exe      Key            0650 \REGISTRY\MACHINE
000000D8 csrss.exe      Key            0680
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale
000000D8 csrss.exe      Key            0684
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
000000D8 csrss.exe      Key            0688
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups
000000D8 csrss.exe      Key            0698
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Control
Panel\International
000000D8 csrss.exe      Key            069c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Control
Panel\International
000000D8 csrss.exe      File           0728 \WINDOWS\system32\ega.cpi
000000D8 csrss.exe      Desktop        0734 \Default
000000D8 csrss.exe      WindowStation  08a8 \Windows\WindowStations\WinSta0
000000E0 winlogon.exe   Directory      0010 \KnownDlls
000000E0 winlogon.exe   Directory      0018 \Windows
000000E0 winlogon.exe   Mutant         0024 \NlsCacheMutant
000000E0 winlogon.exe   Key            0030 \REGISTRY\MACHINE
000000E0 winlogon.exe   Directory      004c \BaseNamedObjects
000000E0 winlogon.exe   Event          0050 \BaseNamedObjects\userenv:  User
Profile setup event
000000E0 winlogon.exe   Mutant         0054 \BaseNamedObjects\userenv:
machine policy mutex
000000E0 winlogon.exe   Event          0058 \BaseNamedObjects\userenv:
Machine Group Policy has been applied
000000E0 winlogon.exe   Event          005c \BaseNamedObjects\userenv:
Machine Group Policy ForcedRefresh Needs Foreground Processing
000000E0 winlogon.exe   Event          0060 \BaseNamedObjects\userenv:
Machine Group Policy Processing is done
000000E0 winlogon.exe   Event          0064 \BaseNamedObjects\userenv:
Machine Policy Foreground Done Event
000000E0 winlogon.exe   Mutant         0068 \BaseNamedObjects\userenv: user
policy mutex
000000E0 winlogon.exe   Event          006c \BaseNamedObjects\userenv: User
Group Policy has been applied
000000E0 winlogon.exe   Event          0070 \BaseNamedObjects\userenv: User
Group Policy ForcedRefresh Needs Foreground Processing
000000E0 winlogon.exe   Event          0074 \BaseNamedObjects\userenv: User
Group Policy Processing is done
000000E0 winlogon.exe   Event          0078 \BaseNamedObjects\userenv: User
Policy Foreground Done Event
000000E0 winlogon.exe   Event          007c
\BaseNamedObjects\crypt32LogoffEvent
000000E0 winlogon.exe   Event          0088 \Security\NetworkProviderLoad
000000E0 winlogon.exe   Event          008c \BaseNamedObjects\TS-WPAAE
000000E0 winlogon.exe   WindowStation  0090 \Windows\WindowStations\WinSta0
000000E0 winlogon.exe   Desktop        0094 \Winlogon
000000E0 winlogon.exe   WindowStation  0098 \Windows\WindowStations\WinSta0
000000E0 winlogon.exe   Desktop        009c \Disconnect
000000E0 winlogon.exe   Desktop        00a0 \Default
000000E0 winlogon.exe   Mutant         00a4 \BaseNamedObjects\SingleSesMutex
000000E0 winlogon.exe   Event          00a8 \BaseNamedObjects\ReconEvent
000000E0 winlogon.exe   Key            00b0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
000000E0 winlogon.exe   File           00b4
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000E0 winlogon.exe   Key            00b8 \REGISTRY\USER\.DEFAULT
000000E0 winlogon.exe   Mutant         00bc \BaseNamedObjects\winlogon:
Logon UserProfileMapping Mutex
000000E0 winlogon.exe   Key            00dc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\crypt32chain
000000E0 winlogon.exe   Key            00e0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\cryptnet
000000E0 winlogon.exe   Key            00f0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\sclgntfy
000000E0 winlogon.exe   Key            00fc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa
000000E0 winlogon.exe   Section        013c \RPC Control\DSECe0
000000E0 winlogon.exe   Port           0148 \RPC Control\IUserProfile
000000E0 winlogon.exe   Port           0154 \RPC Control\sclogonrpc
000000E0 winlogon.exe   File           01a4 \InitShutdown
000000E0 winlogon.exe   File           01a8 \InitShutdown
000000E0 winlogon.exe   Section        01bc
\BaseNamedObjects\ShimSharedMemory[S-1-5-18]
000000E0 winlogon.exe   Mutant         01c4
\BaseNamedObjects\ShimCacheMutex[S-1-5-18]
000000E0 winlogon.exe   Key            01d0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
000000E0 winlogon.exe   Key            01e0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
000000E0 winlogon.exe   Desktop        01e8 \Default
000000E0 winlogon.exe   Event          01ec \BaseNamedObjects\DINPUTWINMM
000000E0 winlogon.exe   Key            020c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
000000E0 winlogon.exe   Event          0218
\BaseNamedObjects\WinSta0_DesktopSwitch
000000E0 winlogon.exe   Event          0234
\BaseNamedObjects\WFP_IDLE_TRIGGER
000000E0 winlogon.exe   File           0244 \WINDOWS\system32\dllcache
000000E0 winlogon.exe   Event          025c \BaseNamedObjects\Microsoft
Smart Card Resource Manager Started
000000E0 winlogon.exe   File           0260 \WINDOWS\AppPatch
000000E0 winlogon.exe   File           0264 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\isapi\_vti_adm
000000E0 winlogon.exe   File           0270 \svcctl
000000E0 winlogon.exe   File           0274 \ntsvcs
000000E0 winlogon.exe   File           0280 \svcctl
000000E0 winlogon.exe   File           0284 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\_vti_bin\_vti_adm
000000E0 winlogon.exe   File           0288 \WINDOWS\system32
000000E0 winlogon.exe   File           028c \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\isapi\_vti_aut
000000E0 winlogon.exe   File           0290 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\_vti_bin\_vti_aut
000000E0 winlogon.exe   File           0294 \WINDOWS\system32\inetsrv
000000E0 winlogon.exe   File           0298 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\bin
000000E0 winlogon.exe   File           029c \WINDOWS\Fonts
000000E0 winlogon.exe   File           02a0 \WINDOWS\system32\drivers
000000E0 winlogon.exe   File           02a4 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\servsupp
000000E0 winlogon.exe   File           02a8 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\bots\vinavbar
000000E0 winlogon.exe   File           02ac \Program Files\Microsoft
FrontPage\version3.0\bin
000000E0 winlogon.exe   File           02b0 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\_vti_bin
000000E0 winlogon.exe   File           02b4 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\bin\1033
000000E0 winlogon.exe   File           02b8 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\isapi
000000E0 winlogon.exe   File           02bc \WINDOWS
000000E0 winlogon.exe   File           02c0 \Program Files\Common
Files\Microsoft Shared\DAO
000000E0 winlogon.exe   File           02c4 \Program Files\Windows Media
Player
000000E0 winlogon.exe   File           02c8 \Program Files\Common
Files\System\msadc
000000E0 winlogon.exe   File           02cc \Program Files\Common
Files\System\ado
000000E0 winlogon.exe   File           02d0 \Program Files\Common
Files\System\Ole DB
000000E0 winlogon.exe   File           02d4 \WINDOWS\inf
000000E0 winlogon.exe   File           02d8 \WINDOWS\system32\Setup
000000E0 winlogon.exe   Event          02dc
\BaseNamedObjects\ThemesStartEvent
000000E0 winlogon.exe   Key            02e0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Credentials
000000E0 winlogon.exe   Event          02e4 \BaseNamedObjects\msgina:
ReturnToWelcome
000000E0 winlogon.exe   File           02f8
\WINDOWS\system32\clients\tsclient\win16
000000E0 winlogon.exe   File           02fc
\WINDOWS\Microsoft.NET\Framework\v1.0.2706
000000E0 winlogon.exe   File           0300 \WINDOWS\Application
Compatibility Scripts
000000E0 winlogon.exe   File           0304
\WINDOWS\system32\clients\tsclient\win32\acme351
000000E0 winlogon.exe   File           0308 \WINDOWS\msagent
000000E0 winlogon.exe   File           030c \WINDOWS\msagent\intl
000000E0 winlogon.exe   File           0310 \WINDOWS\system32\netmon\parsers
000000E0 winlogon.exe   File           0314 \WINDOWS\system
000000E0 winlogon.exe   File           0318 \WINDOWS\system32\netmon
000000E0 winlogon.exe   File           031c \WINDOWS\Help
000000E0 winlogon.exe   File           0320
\WINDOWS\PCHEALTH\HELPCTR\Binaries
000000E0 winlogon.exe   File           0324 \Program Files\NetMeeting
000000E0 winlogon.exe   File           0328 \WINDOWS\system32\drivers\disdn
000000E0 winlogon.exe   File           032c \WINDOWS\ime\chtime\applets
000000E0 winlogon.exe   File           0330 \WINDOWS\system32\wbem
000000E0 winlogon.exe   File           0334 \WINDOWS\Cluster
000000E0 winlogon.exe   File           0338 \WINDOWS\system32\Com
000000E0 winlogon.exe   File           033c \WINDOWS\ime\imjp8_1
000000E0 winlogon.exe   File           0340 \Program Files\Common
Files\Microsoft Shared\Triedit
000000E0 winlogon.exe   File           0344 \Program Files\Windows NT
000000E0 winlogon.exe   File           0348 \Program Files\Common
Files\System
000000E0 winlogon.exe   File           034c \WINDOWS\system32\1033
000000E0 winlogon.exe   File           0350 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\admcgi\scripts
000000E0 winlogon.exe   File           0354 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\admisapi\scripts
000000E0 winlogon.exe   File           0358 \WINDOWS\ime\imkr6_1\dicts
000000E0 winlogon.exe   File           035c \WINDOWS\system32\mui\0009
000000E0 winlogon.exe   File           0360 \Program Files\Internet Explorer
000000E0 winlogon.exe   File           0364 \WINDOWS\ime\imjp8_1\applets
000000E0 winlogon.exe   File           0368 \WINDOWS\ime\imkr6_1\applets
000000E0 winlogon.exe   File           036c \Program Files\Internet
Explorer\Connection Wizard
000000E0 winlogon.exe   File           0370 \Program Files\Common
Files\Microsoft Shared\MSInfo
000000E0 winlogon.exe   File           0374 \Program Files\Common
Files\Microsoft Shared\Smart Tag
000000E0 winlogon.exe   File           0378 \WINDOWS\ime\imkr6_1
000000E0 winlogon.exe   File           037c \WINDOWS\ime\shared
000000E0 winlogon.exe   File           0380 \WINDOWS\system32\reminst
000000E0 winlogon.exe   File           0384 \WINDOWS\system32\ime\pintlgnt
000000E0 winlogon.exe   File           0388
\WINDOWS\system32\clients\tsclient\win32
000000E0 winlogon.exe   File           038c \Program Files\Common
Files\SpeechEngines\Microsoft\Lexicon\1033
000000E0 winlogon.exe   File           0390 \WINDOWS\Resources\Themes\Luna
000000E0 winlogon.exe   File           0394 \WINDOWS\ime
000000E0 winlogon.exe   File           0398 \Program Files\Outlook Express
000000E0 winlogon.exe   File           039c \Program Files\MSN\SmartTag
000000E0 winlogon.exe   File           03a0 \WINDOWS\system32\oobe
000000E0 winlogon.exe   File           03a4 \WINDOWS\mui
000000E0 winlogon.exe   File           03a8 \WINDOWS\system32\npp
000000E0 winlogon.exe   File           03ac \WINDOWS\ime\shared\res
000000E0 winlogon.exe   File           03b0 \WINDOWS\system32\rocket
000000E0 winlogon.exe   File           03b4 \WINDOWS\ime\chsime\applets
000000E0 winlogon.exe   File           03b8 \WINDOWS\system32\rpcproxy
000000E0 winlogon.exe   File           03bc \Program Files\Common
Files\SpeechEngines\Microsoft\TTS\1033
000000E0 winlogon.exe   File           03c0 \Program Files\Common
Files\Microsoft Shared\Speech
000000E0 winlogon.exe   File           03c4
\WINDOWS\system32\certsrv\certcontrol\ia64
000000E0 winlogon.exe   File           03c8
\WINDOWS\system32\certsrv\certcontrol\w2k
000000E0 winlogon.exe   File           03cc
\WINDOWS\system32\certsrv\certcontrol\x86
000000E0 winlogon.exe   File           03d0
\WINDOWS\system32\spool\prtprocs\w32x86
000000E0 winlogon.exe   File           03d4
\WINDOWS\Resources\Themes\Luna\Shell
000000E0 winlogon.exe   File           03d8 \WINDOWS\system32\wbem\snmp
000000E0 winlogon.exe   File           03dc \Program Files\Common
Files\SpeechEngines\Microsoft
000000E0 winlogon.exe   File           03e0 \Program Files\Common
Files\Microsoft Shared\Speech\1033
000000E0 winlogon.exe   File           03e4
\WINDOWS\system32\spool\drivers\color
000000E0 winlogon.exe   File           03e8 \WINDOWS\system32\ime\tintlgnt
000000E0 winlogon.exe   File           03ec \WINDOWS\Help\Tours
000000E0 winlogon.exe   File           03f0 \WINDOWS\system32\wbem\AdStatus
000000E0 winlogon.exe   File           03f4
\WINDOWS\PCHEALTH\UploadLB\Binaries
000000E0 winlogon.exe   File           03f8 \Program Files\Common
Files\Microsoft Shared\VGX
000000E0 winlogon.exe   File           0400
\WINDOWS\Microsoft.NET\Framework\v1.0.2706\1033
000000E0 winlogon.exe   File           0404 \WINDOWS\system32\wbem\xml
000000E0 winlogon.exe   File           0410 \Program Files\Windows
NT\Accessories
000000E0 winlogon.exe   File           0428 \WINDOWS\WinSxS
000000E0 winlogon.exe   File           05d0 \SfcApi
000000E0 winlogon.exe   File           05d4 \SfcApi
000000E0 winlogon.exe   Mutant         05ec \BaseNamedObjects\mxrapi
000000E0 winlogon.exe   Key            05f0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#ISAPNP#CTL0070_DEV0000#FFFFFFFF#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#Wave\Device
Parameters\Mixer
000000E0 winlogon.exe   Event          05f4
\BaseNamedObjects\hardwaremixercallback
000000E0 winlogon.exe   Key            05f8 \REGISTRY\USER
000000E0 winlogon.exe   Section        05fc
\BaseNamedObjects\WDMAUD_Device_Interface_Path
000000E0 winlogon.exe   Mutant         0600
\BaseNamedObjects\GuardMutexmmGlobalPnpInfoGuard
000000E0 winlogon.exe   Event          0604
\BaseNamedObjects\GuardEventmmGlobalPnpInfoGuard
000000E0 winlogon.exe   Semaphore      0608
\BaseNamedObjects\GuardSemmmGlobalPnpInfoGuard
000000E0 winlogon.exe   Section        060c
\BaseNamedObjects\mmGlobalPnpInfo
000000E0 winlogon.exe   Section        0610
\BaseNamedObjects\WDMAUD_Path_Size
000000E0 winlogon.exe   Section        0618
\BaseNamedObjects\WDMAUD_Callbacks
000000E0 winlogon.exe   File           0640
\{9B365890-165F-11D0-A195-0020AFD156E4}
000000E0 winlogon.exe   Event          0648 \BaseNamedObjects\mixercallback
000000E0 winlogon.exe   Semaphore      064c
\BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
000000E0 winlogon.exe   Key            0650
\REGISTRY\MACHINE\SOFTWARE\Classes
000000E0 winlogon.exe   Mutant         0658
\BaseNamedObjects\MidiMapper_Configure
000000E0 winlogon.exe   Mutant         0660
\BaseNamedObjects\MidiMapper_modLongMessage_RefCnt
000000E0 winlogon.exe   Mutant         0668
\BaseNamedObjects\WPA_LICSTORE_MUTEX
000000E0 winlogon.exe   Mutant         066c \BaseNamedObjects\WPA_LT_MUTEX
000000E0 winlogon.exe   Mutant         0674 \BaseNamedObjects\WPA_LT_MUTEX
000000E0 winlogon.exe   Mutant         0678 \BaseNamedObjects\WPA_RT_MUTEX
000000E0 winlogon.exe   Mutant         0680 \BaseNamedObjects\WPA_LT_MUTEX
000000E0 winlogon.exe   Mutant         0684 \BaseNamedObjects\WPA_PR_MUTEX
000000E0 winlogon.exe   Mutant         0688 \BaseNamedObjects\WPA_RT_MUTEX
000000E0 winlogon.exe   Mutant         068c \BaseNamedObjects\WPA_LT_MUTEX
000000E0 winlogon.exe   File           06b4 \ProfMapApi
000000E0 winlogon.exe   File           06b8 \ProfMapApi
000000E0 winlogon.exe   Key            06c4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
000000E0 winlogon.exe   Event          06d0 \BaseNamedObjects\winlogon:
machine GPO Event 49931
000000E0 winlogon.exe   Event          06dc \BaseNamedObjects\userenv:
Machine Group Policy has been applied
000000E0 winlogon.exe   Event          06e4 \BaseNamedObjects\userenv:
machine policy refresh event
000000E0 winlogon.exe   Event          06e8 \BaseNamedObjects\userenv:
machine policy force refresh event
000000E0 winlogon.exe   Event          06ec \BaseNamedObjects\userenv:
Machine Group Policy has been applied
000000E0 winlogon.exe   Event          06f0 \BaseNamedObjects\userenv:
Machine Group Policy ForcedRefresh Needs Foreground Processing
000000E0 winlogon.exe   Event          06f4 \BaseNamedObjects\userenv:
Machine Group Policy Processing is done
000000E0 winlogon.exe   Event          0704
\BaseNamedObjects\jjCSCSharedEvent_UM_KM
000000E0 winlogon.exe   Event          070c
\BaseNamedObjects\jjCSCSharedFillEvent_UM_KM
000000E0 winlogon.exe   Event          0714
\BaseNamedObjects\WkssvcToAgentStartEvent
000000E0 winlogon.exe   Event          0718
\BaseNamedObjects\WkssvcToAgentStopEvent
000000E0 winlogon.exe   Event          071c
\BaseNamedObjects\AgentExistsEvent
000000E0 winlogon.exe   Event          0724
\BaseNamedObjects\AgentToWkssvcEvent
000000E0 winlogon.exe   Timer          072c \BaseNamedObjects\userenv:
refresh timer for 224:784
000000E0 winlogon.exe   File           0758 \winlogonrpc
000000E0 winlogon.exe   File           075c \winlogonrpc
000000E0 winlogon.exe   Event          0760 \BaseNamedObjects\SENS Started
Event
000000E0 winlogon.exe   Key            0774
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\ScCertProp
000000E0 winlogon.exe   Key            0790
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010
000000E0 winlogon.exe   File           0794
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000E0 winlogon.exe   Semaphore      0798
\BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
000000E0 winlogon.exe   Key            079c
\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache
000000E0 winlogon.exe   Key            07a0
\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam
000000E0 winlogon.exe   Event          07a4 \BaseNamedObjects\winlogon:
User GPO Event 73045
000000E0 winlogon.exe   Desktop        07a8 \Default
000000E0 winlogon.exe   Event          07b0 \BaseNamedObjects\userenv: User
Group Policy has been applied
000000E0 winlogon.exe   Event          07b8 \BaseNamedObjects\userenv: user
policy refresh event
000000E0 winlogon.exe   Event          07bc \BaseNamedObjects\userenv: user
policy force refresh event
000000E0 winlogon.exe   Event          07c0 \BaseNamedObjects\userenv: User
Group Policy has been applied
000000E0 winlogon.exe   Event          07c4 \BaseNamedObjects\userenv: User
Group Policy ForcedRefresh Needs Foreground Processing
000000E0 winlogon.exe   Event          07c8 \BaseNamedObjects\userenv: User
Group Policy Processing is done
000000E0 winlogon.exe   Mutant         07e4
\BaseNamedObjects\WPA_LICSTORE_MUTEX
000000E0 winlogon.exe   Timer          080c \BaseNamedObjects\userenv:
refresh timer for 224:1684
000000E0 winlogon.exe   File           0828 \AudioSrv
000000E0 winlogon.exe   Mutant         0834 \BaseNamedObjects\WPA_LT_MUTEX
000000E0 winlogon.exe   Key            0838
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
000000E0 winlogon.exe   Mutant         083c \BaseNamedObjects\WPA_RT_MUTEX
000000E0 winlogon.exe   Mutant         0840 \BaseNamedObjects\WPA_LT_MUTEX
000000E0 winlogon.exe   Mutant         0844 \BaseNamedObjects\WPA_PR_MUTEX
000000E0 winlogon.exe   Mutant         0848 \BaseNamedObjects\WPA_RT_MUTEX
000000E0 winlogon.exe   Mutant         084c \BaseNamedObjects\WPA_LT_MUTEX
000000E0 winlogon.exe   Section        08ec
\BaseNamedObjects\__R_000000000013_SMem__
000000E0 winlogon.exe   File           0914 \WINDOWS\system32
000000E0 winlogon.exe   Port           0920 \RPC Control\OLE10
00000110 services.exe   Directory      0010 \KnownDlls
00000110 services.exe   File           0014 \WINDOWS\system32
00000110 services.exe   Directory      0024 \Windows
00000110 services.exe   Mutant         0030 \NlsCacheMutant
00000110 services.exe   Key            0038 \REGISTRY\MACHINE
00000110 services.exe   WindowStation  0044
\Windows\WindowStations\Service-0x0-3e7$
00000110 services.exe   Desktop        0048 \Default
00000110 services.exe   WindowStation  004c
\Windows\WindowStations\Service-0x0-3e7$
00000110 services.exe   Directory      0060 \BaseNamedObjects
00000110 services.exe   Event          0064 \BaseNamedObjects\userenv:  User
Profile setup event
00000110 services.exe   Key            0068
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
00000110 services.exe   Key            006c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale
00000110 services.exe   Key            0070
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups
00000110 services.exe   Key            0074
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum
00000110 services.exe   Key            007c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services
00000110 services.exe   Key            0080
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class
00000110 services.exe   Key            0084
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\PerHwIdStorage
00000110 services.exe   Event          018c
\BaseNamedObjects\SC_AutoStartComplete
00000110 services.exe   Key            0190
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\Order
00000110 services.exe   Event          01b4
\BaseNamedObjects\SvcctrlStartEvent_A3752DX
00000110 services.exe   Key            01d4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ServiceGroupOrder
00000110 services.exe   File           0204 \ntsvcs
00000110 services.exe   Event          0218 \BaseNamedObjects\ScNetDrvMsg
00000110 services.exe   Section        0220 \RPC Control\DSEC110
00000110 services.exe   Port           0230 \RPC Control\ntsvcs
00000110 services.exe   File           0260 \ntsvcs
00000110 services.exe   File           0264 \ntsvcs
00000110 services.exe   File           02bc \scerpc
00000110 services.exe   File           02c0 \scerpc
00000110 services.exe   File           02c4 \ntsvcs
00000110 services.exe   File           02dc \lsarpc
00000110 services.exe   Event          02f0
\BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS
00000110 services.exe   File           0314 \svcctl
00000110 services.exe   Key            031c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent
00000110 services.exe   File           0320 \net\NtControlPipe1
00000110 services.exe   File           0328 \ntsvcs
00000110 services.exe   File           0330 \ntsvcs
00000110 services.exe   File           033c \net\NtControlPipe2
00000110 services.exe   Key            0348
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Eventlog
00000110 services.exe   File           0350 \ntsvcs
00000110 services.exe   File           0354 \net\NtControlPipe3
00000110 services.exe   File           0360 \net\NtControlPipe3
00000110 services.exe   Key            036c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName
00000110 services.exe   File           0388
\WINDOWS\system32\config\AppEvent.Evt
00000110 services.exe   File           0398
\WINDOWS\system32\config\SecEvent.Evt
00000110 services.exe   File           03b0
\WINDOWS\system32\config\SysEvent.Evt
00000110 services.exe   File           03c8 \net\NtControlPipe4
00000110 services.exe   Port           03cc \ErrorLogPort
00000110 services.exe   Event          03d8
\BaseNamedObjects\PnP_No_Pending_Install_Events
00000110 services.exe   File           03e0 \ntsvcs
00000110 services.exe   Mutant         0400 \BaseNamedObjects\PnP_Init_Mutex
00000110 services.exe   Key            042c \REGISTRY\USER
00000110 services.exe   Key            0430 \REGISTRY\USER\S-1-5-20
00000110 services.exe   Mutant         043c
\BaseNamedObjects\ShimCacheMutex[S-1-5-20]
00000110 services.exe   Section        0440
\BaseNamedObjects\ShimSharedMemory[S-1-5-20]
00000110 services.exe   File           0444 \net\NtControlPipe5
00000110 services.exe   File           044c \ntsvcs
00000110 services.exe   Key            0454 \REGISTRY\USER\S-1-5-19
00000110 services.exe   File           0460 \net\NtControlPipe6
00000110 services.exe   File           0468 \ntsvcs
00000110 services.exe   File           0470 \ntsvcs
00000110 services.exe   File           0490 \ntsvcs
00000110 services.exe   File           0494 \ntsvcs
00000110 services.exe   File           04a0 \net\NtControlPipe0
00000110 services.exe   File           04a4 \ntsvcs
00000110 services.exe   File           04b4 \net\NtControlPipe7
00000110 services.exe   File           04b8 \ntsvcs
00000110 services.exe   Key            04c0 \REGISTRY\USER\S-1-5-20
00000110 services.exe   File           04cc \net\NtControlPipe8
00000110 services.exe   File           04d4 \ntsvcs
00000110 services.exe   File           04e4 \ntsvcs
00000110 services.exe   File           0500 \ntsvcs
00000110 services.exe   File           0508 \net\NtControlPipe9
00000110 services.exe   File           050c \ntsvcs
00000110 services.exe   Key            051c \REGISTRY\USER\S-1-5-20
00000110 services.exe   File           0528 \net\NtControlPipe10
00000110 services.exe   Key            0544
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
00000110 services.exe   File           0550 \ntsvcs
00000110 services.exe   Key            055c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000
00000110 services.exe   File           0564 \net\NtControlPipe11
00000110 services.exe   File           0568 \ntsvcs
00000110 services.exe   Key            0570
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000
00000110 services.exe   File           0588 \net\NtControlPipe12
00000110 services.exe   File           05b8 \ntsvcs
00000110 services.exe   Key            05c4 \REGISTRY\USER\S-1-5-19
00000110 services.exe   File           05d0 \net\NtControlPipe13
00000110 services.exe   File           05d8 \ntsvcs
00000110 services.exe   File           05e0 \net\NtControlPipe14
00000110 services.exe   File           05ec \ntsvcs
00000110 services.exe   File           05f8 \ntsvcs
00000110 services.exe   File           0600 \net\NtControlPipe15
00000110 services.exe   File           060c \ntsvcs
00000110 services.exe   Key            0614
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000
00000110 services.exe   File           0620 \net\NtControlPipe16
00000110 services.exe   File           0628 \ntsvcs
00000110 services.exe   File           0630 \ntsvcs
00000110 services.exe   Key            0640
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000
00000110 services.exe   File           0648 \net\NtControlPipe18
00000110 services.exe   File           064c \net\NtControlPipe17
00000110 services.exe   File           0658 \ntsvcs
00000110 services.exe   File           0668 \ntsvcs
00000110 services.exe   File           0678 \ntsvcs
00000110 services.exe   File           0694 \ntsvcs
00000110 services.exe   File           06ac \ntsvcs
00000110 services.exe   File           06bc \ntsvcs
00000110 services.exe   File           06c0 \net\NtControlPipe21
00000110 services.exe   File           06dc \ntsvcs
00000110 services.exe   File           06e0 \net\NtControlPipe20
00000110 services.exe   File           06ec \ntsvcs
00000110 services.exe   File           06f4 \ntsvcs
00000110 services.exe   File           0708 \ntsvcs
00000110 services.exe   File           070c \ntsvcs
00000110 services.exe   File           072c \ntsvcs
00000110 services.exe   File           073c \PIPE_EVENTROOT\CIMV2SCM EVENT
PROVIDER
0000011C lsass.exe      Directory      0010 \KnownDlls
0000011C lsass.exe      File           0014 \WINDOWS\system32
0000011C lsass.exe      Directory      0024 \Windows
0000011C lsass.exe      Mutant         0030 \NlsCacheMutant
0000011C lsass.exe      Key            0038 \REGISTRY\MACHINE
0000011C lsass.exe      WindowStation  004c
\Windows\WindowStations\Service-0x0-3e7$
0000011C lsass.exe      Desktop        0050 \Default
0000011C lsass.exe      WindowStation  0054
\Windows\WindowStations\Service-0x0-3e7$
0000011C lsass.exe      Key            0060
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
0000011C lsass.exe      Directory      0074 \BaseNamedObjects
0000011C lsass.exe      File           0078 \net\NtControlPipe0
0000011C lsass.exe      Key            0084
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll
0000011C lsass.exe      Key            0088
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll
0000011C lsass.exe      Key            008c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll
0000011C lsass.exe      Key            00a8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa
0000011C lsass.exe      Port           00b8 \SeLsaCommandPort
0000011C lsass.exe      Event          00bc \SeLsaInitEvent
0000011C lsass.exe      Key            00dc \REGISTRY\MACHINE\SECURITY
0000011C lsass.exe      Key            00e0 \REGISTRY\MACHINE\SECURITY\RXACT
0000011C lsass.exe      Key            0110
\REGISTRY\MACHINE\SECURITY\Policy
0000011C lsass.exe      Section        012c
\BaseNamedObjects\Debug.Memory.11c
0000011C lsass.exe      Key            0130
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Kerberos
0000011C lsass.exe      Key            0164
\REGISTRY\MACHINE\SECURITY\Policy
0000011C lsass.exe      Key            016c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Kerberos\SidCache
0000011C lsass.exe      Key            017c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Kerberos\Domains
0000011C lsass.exe      Key            018c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
0000011C lsass.exe      Key            0194
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
0000011C lsass.exe      Key            01a4
\REGISTRY\MACHINE\SECURITY\Policy
0000011C lsass.exe      Key            01b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa
0000011C lsass.exe      Key            01b8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\MSV1_0
0000011C lsass.exe      File           01c0 \WINDOWS\Debug\PASSWD.LOG
0000011C lsass.exe      Event          01e8
\BaseNamedObjects\crypt32LogoffEvent
0000011C lsass.exe      Event          01f8 \BaseNamedObjects\userenv:  User
Profile setup event
0000011C lsass.exe      Section        01fc \RPC Control\DSEC11c
0000011C lsass.exe      Port           0260 \LsaAuthenticationPort
0000011C lsass.exe      Event          027c
\BaseNamedObjects\LSA_RPC_SERVER_ACTIVE
0000011C lsass.exe      File           0284 \lsass
0000011C lsass.exe      File           0288 \lsass
0000011C lsass.exe      Key            02a0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb
0000011C lsass.exe      Port           02b4 \RPC Control\protected_storage
0000011C lsass.exe      File           02e4 \protected_storage
0000011C lsass.exe      File           02e8 \protected_storage
0000011C lsass.exe      File           035c \lsarpc
0000011C lsass.exe      File           0370 \lsass
0000011C lsass.exe      Key            0384 \REGISTRY\MACHINE\SAM\SAM
0000011C lsass.exe      Key            0388 \REGISTRY\MACHINE\SAM\SAM\RXACT
0000011C lsass.exe      Key            038c
\REGISTRY\MACHINE\SAM\SAM\Domains\Builtin
0000011C lsass.exe      Key            0390
\REGISTRY\MACHINE\SAM\SAM\Domains\Account
0000011C lsass.exe      File           0398 \lsass
0000011C lsass.exe      File           03b0 \lsass
0000011C lsass.exe      Event          03cc \SAM_SERVICE_STARTED
0000011C lsass.exe      Key            03e4 \REGISTRY\USER\S-1-5-20
0000011C lsass.exe      File           03e8
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
0000011C lsass.exe      Key            03f0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
0000011C lsass.exe      Key            03f8 \REGISTRY\USER
0000011C lsass.exe      File           0410 \lsass
0000011C lsass.exe      File           0460 \lsass
0000011C lsass.exe      File           0478 \lsass
0000011C lsass.exe      Key            04a0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
0000011C lsass.exe      Key            04a4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
0000011C lsass.exe      Key            04a8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
0000011C lsass.exe      Key            04ac
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
0000011C lsass.exe      Event          04d0
\BaseNamedObjects\PS_SERVICE_STARTED
0000011C lsass.exe      Event          04dc
\BaseNamedObjects\IPSEC_POLICY_CHANGE_EVENT
0000011C lsass.exe      Event          04e8
\BaseNamedObjects\IPSEC_POLICY_CHANGE_NOTIFY
0000011C lsass.exe      File           04f8 \Endpoint
0000011C lsass.exe      File           0508 \svcctl
0000011C lsass.exe      File           0510 \WINDOWS\Debug\oakley.log
0000011C lsass.exe      File           0514 \lsass
0000011C lsass.exe      File           0544 \Endpoint
0000011C lsass.exe      File           0558 \Endpoint
0000011C lsass.exe      File           055c \255
0000011C lsass.exe      File           05a0 \ipsec
0000011C lsass.exe      File           05a4 \ipsec
0000011C lsass.exe      Port           05ac \RPC Control\ipsec
0000011C lsass.exe      File           05b8 \lsass
0000011C lsass.exe      File           0608 \lsass
0000011C lsass.exe      File           0618 \lsass
000001A0 svchost.exe    Directory      0010 \KnownDlls
000001A0 svchost.exe    File           0014 \WINDOWS\system32
000001A0 svchost.exe    Directory      001c \Windows
000001A0 svchost.exe    Mutant         0024 \NlsCacheMutant
000001A0 svchost.exe    Key            002c \REGISTRY\MACHINE
000001A0 svchost.exe    File           0054 \net\NtControlPipe1
000001A0 svchost.exe    Directory      0070 \BaseNamedObjects
000001A0 svchost.exe    WindowStation  0088
\Windows\WindowStations\Service-0x0-3e7$
000001A0 svchost.exe    Desktop        008c \Default
000001A0 svchost.exe    WindowStation  0090
\Windows\WindowStations\Service-0x0-3e7$
000001A0 svchost.exe    Event          00ac \BaseNamedObjects\userenv:  User
Profile setup event
000001A0 svchost.exe    Key            00b0
\REGISTRY\MACHINE\SOFTWARE\Classes
000001A0 svchost.exe    Key            00c8
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000001A0 svchost.exe    Key            00d0
\REGISTRY\MACHINE\SOFTWARE\Classes\AppID
000001A0 svchost.exe    Key            00f4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Ole
000001A0 svchost.exe    Section        00fc \RPC Control\DSEC1a0
000001A0 svchost.exe    Port           0108 \RPC Control\epmapper
000001A0 svchost.exe    Key            0120
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000001A0 svchost.exe    Key            0128
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000001A0 svchost.exe    File           0154 \Endpoint
000001A0 svchost.exe    File           015c \Endpoint
000001A0 svchost.exe    File           0168
\Winsock2\CatalogChangeListener-1a0-0
000001A0 svchost.exe    File           0170 \Endpoint
000001A0 svchost.exe    File           0184 \Endpoint
000001A0 svchost.exe    Key            0190
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
000001A0 svchost.exe    Key            01b0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
000001A0 svchost.exe    Key            01b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
000001A0 svchost.exe    Key            01b8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
000001A0 svchost.exe    Section        01d0 \BaseNamedObjects\RotHintTable
000001A0 svchost.exe    File           01d4 \Endpoint
000001A0 svchost.exe    Event          01d8
\BaseNamedObjects\ScmCreatedEvent
000001A0 svchost.exe    Key            0214
\REGISTRY\MACHINE\SOFTWARE\Classes
000001A0 svchost.exe    Key            021c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000001A0 svchost.exe    Key            0228 \REGISTRY\USER
000001A0 svchost.exe    Key            022c
\REGISTRY\MACHINE\SOFTWARE\Classes
000001A0 svchost.exe    Key            0238
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000001A0 svchost.exe    Key            0240
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000001A0 svchost.exe    Key            0248
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000001A0 svchost.exe    Key            0250
\REGISTRY\MACHINE\SOFTWARE\Classes
000001A0 svchost.exe    Key            0258
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000001A0 svchost.exe    Key            0264
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000001A0 svchost.exe    Key            026c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000001A0 svchost.exe    Key            0274
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000001A0 svchost.exe    Section        027c
\BaseNamedObjects\__R_000000000013_SMem__
000001A0 svchost.exe    File           02bc \epmapper
000001A0 svchost.exe    File           02c0 \epmapper
000001A0 svchost.exe    File           0358 \Endpoint
000001A0 svchost.exe    File           0438 \svcctl
000001A0 svchost.exe    Mutant         04c0
\BaseNamedObjects\ShimCacheMutex[S-1-5-18]
000001A0 svchost.exe    Section        04c4
\BaseNamedObjects\ShimSharedMemory[S-1-5-18]
000001BC svchost.exe    Directory      0010 \KnownDlls
000001BC svchost.exe    File           0014 \WINDOWS\system32
000001BC svchost.exe    Directory      001c \Windows
000001BC svchost.exe    Mutant         0024 \NlsCacheMutant
000001BC svchost.exe    Key            002c \REGISTRY\MACHINE
000001BC svchost.exe    WindowStation  003c
\Windows\WindowStations\Service-0x0-3e7$
000001BC svchost.exe    Desktop        0040 \Default
000001BC svchost.exe    WindowStation  0044
\Windows\WindowStations\Service-0x0-3e7$
000001BC svchost.exe    Directory      0048 \BaseNamedObjects
000001BC svchost.exe    File           008c \net\NtControlPipe2
000001BC svchost.exe    File           00a0 \svcctl
000001BC svchost.exe    Event          00bc
\BaseNamedObjects\crypt32LogoffEvent
000001BC svchost.exe    Event          00c0
\BaseNamedObjects\TermSrvReadyEvent
000001BC svchost.exe    Mutant         00cc
\BaseNamedObjects\746bbf3569adEncrypt
000001BC svchost.exe    Key            00ec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\Licensing
Core
000001BC svchost.exe    Key            0108
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters
000001BC svchost.exe    Section        011c \RPC Control\DSEC1bc
000001BC svchost.exe    Port           0124 \RPC Control\LcRpc
000001BC svchost.exe    File           0154 \TermSrv_Licensing_Core
000001BC svchost.exe    File           0158 \TermSrv_Licensing_Core
000001BC svchost.exe    Port           0170 \SmSsWinStationApiPort
000001BC svchost.exe    Key            0180
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000001BC svchost.exe    Key            0188
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000001BC svchost.exe    File           019c \lsarpc
000001BC svchost.exe    Event          01dc
\BaseNamedObjects\WinMMConsoleAudioEvent
000001BC svchost.exe    Event          01f0 \BaseNamedObjects\ReconEvent
000001BC svchost.exe    Event          01f4 \BaseNamedObjects\TermSrv:
machine GP event
000001BC svchost.exe    Port           0200 \RPC Control\IcaApi
000001BC svchost.exe    File           0230 \Ctx_WinStation_API_service
000001BC svchost.exe    File           0234 \Ctx_WinStation_API_service
000001BC svchost.exe    Event          0238 \BaseNamedObjects\userenv:  User
Profile setup event
000001BC svchost.exe    Event          0244 \BaseNamedObjects\userenv:
Machine Group Policy has been applied
000001BC svchost.exe    Key            0260
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Terminal Server
000001BC svchost.exe    Key            0274
\REGISTRY\MACHINE\SOFTWARE\Policies
000001BC svchost.exe    Event          028c
\Sessions\1\BaseNamedObjects\CsrStartEvent
000001BC svchost.exe    Event          0290
\Sessions\1\BaseNamedObjects\ReconEvent
000001BC svchost.exe    Event          02c8
\Sessions\2\BaseNamedObjects\CsrStartEvent
000001BC svchost.exe    Event          02cc
\Sessions\2\BaseNamedObjects\ReconEvent
000001BC svchost.exe    Key            02fc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\AddIns
000001BC svchost.exe    Key            0364 \REGISTRY\USER
00000200 svchost.exe    Directory      0010 \KnownDlls
00000200 svchost.exe    File           0014 \WINDOWS\system32
00000200 svchost.exe    Directory      001c \Windows
00000200 svchost.exe    Mutant         0024 \NlsCacheMutant
00000200 svchost.exe    Key            002c \REGISTRY\MACHINE
00000200 svchost.exe    WindowStation  003c
\Windows\WindowStations\Service-0x0-3e7$
00000200 svchost.exe    Desktop        0040 \Default
00000200 svchost.exe    WindowStation  0044 \Windows\WindowStations\WinSta0
00000200 svchost.exe    Directory      0048 \BaseNamedObjects
00000200 svchost.exe    File           008c \net\NtControlPipe4
00000200 svchost.exe    File           00a0 \svcctl
00000200 svchost.exe    Key            00a8 \REGISTRY\USER\.DEFAULT
00000200 svchost.exe    File           00ac
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
00000200 svchost.exe    Key            00b8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
00000200 svchost.exe    Port           00bc \ThemeApiPort
00000200 svchost.exe    Key            0108
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
00000200 svchost.exe    Key            010c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
00000200 svchost.exe    Key            0110
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
00000200 svchost.exe    Key            0114
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
00000200 svchost.exe    Key            012c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
00000200 svchost.exe    Key            0134
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
00000200 svchost.exe    Key            0140
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Dhcp\Parameters
00000200 svchost.exe    Key            0144
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
00000200 svchost.exe    Key            0148
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Dhcp\Parameters\Options
00000200 svchost.exe    Key            014c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services
00000200 svchost.exe    Event          015c
\BaseNamedObjects\DHCPNEWIPADDRESS
00000200 svchost.exe    File           0164 \DhcpClient
00000200 svchost.exe    Key            0178
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DNSRegisteredAdapters
00000200 svchost.exe    Key            0194
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{81A3AA37-6FFD-4907-99BB-47F19F605A44}
00000200 svchost.exe    Event          0198
\BaseNamedObjects\AgentToWkssvcEvent
00000200 svchost.exe    Event          01d0
\BaseNamedObjects\WkssvcToAgentStartEvent
00000200 svchost.exe    Event          01d4
\BaseNamedObjects\ShellHWDetection'sEvent
00000200 svchost.exe    Event          01d8
\BaseNamedObjects\CGenericServiceManager__Init
00000200 svchost.exe    Key            01f8
\REGISTRY\MACHINE\SOFTWARE\Classes
00000200 svchost.exe    Key            0200
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000200 svchost.exe    Key            020c \REGISTRY\USER
00000200 svchost.exe    Key            0210
\REGISTRY\MACHINE\SOFTWARE\Classes
00000200 svchost.exe    Key            021c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000200 svchost.exe    Key            0224
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000200 svchost.exe    Key            022c
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000200 svchost.exe    Key            0234
\REGISTRY\MACHINE\SOFTWARE\Classes
00000200 svchost.exe    Key            023c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000200 svchost.exe    Key            0248
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000200 svchost.exe    Key            0250
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000200 svchost.exe    Key            0258
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000200 svchost.exe    File           0260
\WINDOWS\Registration\R000000000013.clb
00000200 svchost.exe    Section        0264
\BaseNamedObjects\__R_000000000013_SMem__
00000200 svchost.exe    Key            0268
\REGISTRY\MACHINE\SOFTWARE\Classes
00000200 svchost.exe    Event          026c
\BaseNamedObjects\ShellHWDetection'sEvent
00000200 svchost.exe    Section        0270 \RPC Control\DSEC200
00000200 svchost.exe    Port           0278 \RPC Control\OLE3
00000200 svchost.exe    File           028c \svcctl
00000200 svchost.exe    Event          02b4 \BaseNamedObjects\userenv:  User
Profile setup event
00000200 svchost.exe    File           02d0 \lsarpc
00000200 svchost.exe    File           02d8 \ntsvcs
00000200 svchost.exe    File           02dc \WINDOWS\SchedLgU.Txt
00000200 svchost.exe    Event          02e0
\BaseNamedObjects\ShellHWDetectionInitCompleted
00000200 svchost.exe    Desktop        02ec \SADesktop
00000200 svchost.exe    WindowStation  0300 \Windows\WindowStations\SAWinSta
00000200 svchost.exe    File           0354 \Endpoint
00000200 svchost.exe    File           0364
\Winsock2\CatalogChangeListener-200-0
00000200 svchost.exe    File           0394 \Endpoint
00000200 svchost.exe    File           0398 \atsvc
00000200 svchost.exe    File           039c \atsvc
00000200 svchost.exe    File           03c0 \WINDOWS\Tasks
00000200 svchost.exe    Event          03e0
\BaseNamedObjects\WkssvcToAgentStopEvent
00000200 svchost.exe    File           0460 \wkssvc
00000200 svchost.exe    File           0464 \wkssvc
00000200 svchost.exe    Event          046c \BaseNamedObjects\wkssvc:  MUP
finished initializing event
00000200 svchost.exe    Key            0478
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lanmanworkstation\parameters
00000200 svchost.exe    Event          0490
\BaseNamedObjects\crypt32LogoffEvent
00000200 svchost.exe    File           04dc \AudioSrv
00000200 svchost.exe    File           04e0 \AudioSrv
00000200 svchost.exe    Event          04e4 \BaseNamedObjects\DmServerStop
00000200 svchost.exe    File           0518 \keysvc
00000200 svchost.exe    File           051c \keysvc
00000200 svchost.exe    Port           0524 \RPC Control\keysvc
00000200 svchost.exe    Event          0540 \BaseNamedObjects\ReSyncKernel
00000200 svchost.exe    Event          0548
\Device\DmControl\VxKernel2VoldEvent
00000200 svchost.exe    Mutant         054c
\BaseNamedObjects\ShimCacheMutex[S-1-5-18]
00000200 svchost.exe    Section        0550
\BaseNamedObjects\ShimSharedMemory[S-1-5-18]
00000200 svchost.exe    Mutant         0564
\BaseNamedObjects\0CADFD67AF62496dB34264F000F5624A
00000200 svchost.exe    Mutant         0568
\BaseNamedObjects\4FCC0DEFE22C4f138FB9D5AF25FD9398
00000200 svchost.exe    Key            0570
\REGISTRY\MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting
00000200 svchost.exe    File           057c \PCHHangRepExecPipe
00000200 svchost.exe    File           058c \PCHFaultRepExecPipe
00000200 svchost.exe    Port           05b8 \XactSrvLpcPort
00000200 svchost.exe    File           05e4 \srvsvc
00000200 svchost.exe    File           05e8 \srvsvc
00000200 svchost.exe    Event          05f0 \LanmanServerAnnounceEvent
00000200 svchost.exe    File           05f4 \AudioSrv
00000200 svchost.exe    Semaphore      0614
\BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
00000200 svchost.exe    Key            0630
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\parameters
00000200 svchost.exe    File           0674 \SECLOGON
00000200 svchost.exe    File           0678 \SECLOGON
00000200 svchost.exe    WaitablePort   069c \Security\TRKWKS_PORT
00000200 svchost.exe    Event          06a0 \Security\TRKWKS_EVENT
00000200 svchost.exe    File           06c8 \trkwks
00000200 svchost.exe    File           06cc \trkwks
00000200 svchost.exe    Port           06d4 \RPC Control\trkwks
00000200 svchost.exe    File           06ec \$Extend\$ObjId
00000200 svchost.exe    Event          06f4 \BaseNamedObjects\SENS Started
Event
00000200 svchost.exe    Section        06f8 \BaseNamedObjects\SENS
Information Cache
00000200 svchost.exe    Port           070c \RPC Control\senssvc
00000200 svchost.exe    Key            0710
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}
00000200 svchost.exe    File           0714 \System Volume
Information\tracking.log
00000200 svchost.exe    Event          0724 \BaseNamedObjects\Sens Hidden
Window Cleanup Event
00000200 svchost.exe    Key            0740
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\EventClasses
00000200 svchost.exe    File           0790 \W32TIME
00000200 svchost.exe    File           0794 \W32TIME
00000200 svchost.exe    File           07f4 \Endpoint
00000200 svchost.exe    File           0804 \Endpoint
00000200 svchost.exe    Key            0860
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\EAPOL
00000200 svchost.exe    Key            0868
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions
00000200 svchost.exe    File           08c0 \wzcsvc
00000200 svchost.exe    File           08c4 \wzcsvc
00000200 svchost.exe    Port           08cc \RPC Control\wzcsvc
00000200 svchost.exe    Key            08f0
\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet
Settings
00000200 svchost.exe    File           0910 \WMDMPMSPpipe
00000200 svchost.exe    File           0978 \srvsvc
00000200 svchost.exe    File           0980 \srvsvc
00000200 svchost.exe    File           09cc \wkssvc
00000200 svchost.exe    File           09d0
\{9B365890-165F-11D0-A195-0020AFD156E4}
00000200 svchost.exe    File           09ec \wkssvc
00000200 svchost.exe    File           0a04 \srvsvc
00000200 svchost.exe    File           0a2c \wkssvc
00000200 svchost.exe    File           0a44 \browser
00000200 svchost.exe    File           0a48 \browser
00000200 svchost.exe    Key            0a4c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Browser\Parameters
00000200 svchost.exe    Key            0a60
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EAPOL\Parameters\General\Global
00000200 svchost.exe    Mutant         0a70 \BaseNamedObjects\RasPbFile
00000200 svchost.exe    Key            0a94
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASTLS
00000200 svchost.exe    Key            0aa4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASCHAP
00000200 svchost.exe    Key            0abc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EAPOL\Parameters\Interfaces
00000200 svchost.exe    File           0ad4 \winlogonrpc
00000200 svchost.exe    Desktop        0aec \Default
00000200 svchost.exe    WindowStation  0af0 \Windows\WindowStations\WinSta0
00000200 svchost.exe    File           0af8
\Winsock2\CatalogChangeListener-200-1
00000200 svchost.exe    File           0b64 \svcctl
00000200 svchost.exe    WaitablePort   0b88 \NLAPublicPort
00000200 svchost.exe    WaitablePort   0b8c \NLAPrivatePort
00000200 svchost.exe    Key            0b98
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Network\Location Awareness
00000200 svchost.exe    Key            0bc0
\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows
NT\CurrentVersion\Network\Location Awareness
00000200 svchost.exe    Key            0bc4
\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows
NT\CurrentVersion\Network\Location Awareness
00000200 svchost.exe    Key            0bc8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
00000200 svchost.exe    Key            0be8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale
00000200 svchost.exe    Key            0bf8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
00000200 svchost.exe    File           0c08 \EVENTLOG
00000200 svchost.exe    Key            0c1c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASTAPI
00000200 svchost.exe    Key            0c3c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\tapi32
00000200 svchost.exe    Mutant         0c68 \BaseNamedObjects\RAS_MO_02
00000200 svchost.exe    Mutant         0c6c \BaseNamedObjects\RAS_MO_01
00000200 svchost.exe    File           0c98 \ROUTER
00000200 svchost.exe    File           0c9c \ROUTER
00000200 svchost.exe    Key            0cb8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASMAN
00000200 svchost.exe    Key            0cd0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\PPP
00000200 svchost.exe    Key            0ce0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\BAP
00000200 svchost.exe    Key            0cec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RasMan\PPP
00000200 svchost.exe    Key            0cfc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASSPAP
00000200 svchost.exe    Key            0d0c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASPAP
00000200 svchost.exe    Key            0d1c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASEAP
00000200 svchost.exe    Key            0d2c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASCCP
00000200 svchost.exe    Key            0d3c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASBACP
00000200 svchost.exe    File           0d48 \wkssvc
00000200 svchost.exe    Key            0d68
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASIPHLP
00000200 svchost.exe    Key            0d80
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups
00000200 svchost.exe    Key            0d90
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASIPCP
00000200 svchost.exe    File           0da8 \wkssvc
00000200 svchost.exe    File           0db0 \srvsvc
00000200 svchost.exe    Mutant         0df4
\BaseNamedObjects\_!MSFTHISTORY!_
00000200 svchost.exe    File           0df8 \Documents and Settings\Default
User.WINDOWS\Local Settings\Temporary Internet Files\Content.IE5\index.dat
00000200 svchost.exe    Mutant         0dfc \BaseNamedObjects\c:!documents
and settings!default user.windows!local settings!temporary internet
files!content.ie5!
00000200 svchost.exe    Section        0e00 \BaseNamedObjects\C:_Documents
and Settings_Default User.WINDOWS_Local Settings_Temporary Internet
Files_Content.IE5_index.dat_32768
00000200 svchost.exe    Mutant         0e04 \BaseNamedObjects\c:!documents
and settings!default user.windows!cookies!
00000200 svchost.exe    Mutant         0e08 \BaseNamedObjects\c:!documents
and settings!default user.windows!local settings!history!history.ie5!
00000200 svchost.exe    File           0e0c \Documents and Settings\Default
User.WINDOWS\Cookies\index.dat
00000200 svchost.exe    File           0e10 \Documents and Settings\Default
User.WINDOWS\Local Settings\History\History.IE5\index.dat
00000200 svchost.exe    Section        0e14 \BaseNamedObjects\C:_Documents
and Settings_Default User.WINDOWS_Local
Settings_History_History.IE5_index.dat_16384
00000200 svchost.exe    Mutant         0e1c
\BaseNamedObjects\WininetStartupMutex
00000200 svchost.exe    Section        0e20 \BaseNamedObjects\C:_Documents
and Settings_Default User.WINDOWS_Cookies_index.dat_16384
00000200 svchost.exe    Mutant         0e2c
\BaseNamedObjects\WininetProxyRegistryMutex
00000200 svchost.exe    Key            0e30
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001
00000200 svchost.exe    Section        0e34 \BaseNamedObjects\SENS
Information Cache
00000200 svchost.exe    File           0e50 \ROUTER
00000230 csrss.exe      Directory      0010 \KnownDlls
00000230 csrss.exe      File           0014 \WINDOWS\system32
00000230 csrss.exe      Directory      0018 \Sessions\BNOLINKS
00000230 csrss.exe      SymbolicLink   0020 \Sessions\BNOLINKS\1
00000230 csrss.exe      Directory      0024 \Sessions\1
00000230 csrss.exe      Directory      0028 \Sessions\1\DosDevices
00000230 csrss.exe      Directory      002c \Sessions\1\Windows
00000230 csrss.exe      Directory      003c \Sessions\1\BaseNamedObjects
00000230 csrss.exe      SymbolicLink   0040
\Sessions\1\BaseNamedObjects\Global
00000230 csrss.exe      SymbolicLink   0044
\Sessions\1\BaseNamedObjects\Local
00000230 csrss.exe      SymbolicLink   0048
\Sessions\1\BaseNamedObjects\Session
00000230 csrss.exe      Directory      004c
\Sessions\1\BaseNamedObjects\Restricted
00000230 csrss.exe      Mutant         0050 \Sessions\1\NlsCacheMutant
00000230 csrss.exe      Mutant         0058 \Sessions\1\NlsCacheMutant
00000230 csrss.exe      Directory      0070
\Sessions\1\Windows\WindowStations
00000230 csrss.exe      Directory      007c \Sessions\1\BaseNamedObjects
00000230 csrss.exe      Port           0098 \Sessions\1\Windows\ApiPort
00000230 csrss.exe      Port           009c \Sessions\1\Windows\SbApiPort
00000230 csrss.exe      Event          00c4
\Sessions\1\BaseNamedObjects\ScNetDrvMsg
00000230 csrss.exe      Key            00c8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\PriorityControl
00000234 winlogon.exe   Directory      0010 \KnownDlls
00000234 winlogon.exe   File           0014 \WINDOWS\system32
00000234 winlogon.exe   Directory      0018 \Sessions\1\Windows
00000234 winlogon.exe   Mutant         0024 \Sessions\1\NlsCacheMutant
00000234 winlogon.exe   Key            0030 \REGISTRY\MACHINE
00000234 winlogon.exe   Directory      004c \Sessions\1\BaseNamedObjects
00000234 winlogon.exe   Event          0050 \BaseNamedObjects\userenv:  User
Profile setup event
00000234 winlogon.exe   Mutant         0054 \BaseNamedObjects\userenv:
machine policy mutex
00000234 winlogon.exe   Event          0058 \BaseNamedObjects\userenv:
Machine Group Policy has been applied
00000234 winlogon.exe   Event          005c \BaseNamedObjects\userenv:
Machine Group Policy ForcedRefresh Needs Foreground Processing
00000234 winlogon.exe   Event          0060 \BaseNamedObjects\userenv:
Machine Group Policy Processing is done
00000234 winlogon.exe   Event          0064 \BaseNamedObjects\userenv:
Machine Policy Foreground Done Event
00000234 winlogon.exe   Mutant         0068
\Sessions\1\BaseNamedObjects\userenv: user policy mutex
00000234 winlogon.exe   Event          006c
\Sessions\1\BaseNamedObjects\userenv: User Group Policy has been applied
00000234 winlogon.exe   Event          0070
\Sessions\1\BaseNamedObjects\userenv: User Group Policy ForcedRefresh Needs
Foreground Processing
00000234 winlogon.exe   Event          0074
\Sessions\1\BaseNamedObjects\userenv: User Group Policy Processing is done
00000234 winlogon.exe   Event          0078
\Sessions\1\BaseNamedObjects\userenv: User Policy Foreground Done Event
00000234 winlogon.exe   Event          007c
\BaseNamedObjects\crypt32LogoffEvent
0000025C csrss.exe      Directory      0010 \KnownDlls
0000025C csrss.exe      File           0014 \WINDOWS\system32
0000025C csrss.exe      Directory      0018 \Sessions\BNOLINKS
0000025C csrss.exe      SymbolicLink   0020 \Sessions\BNOLINKS\2
0000025C csrss.exe      Directory      0024 \Sessions\2
0000025C csrss.exe      Directory      0028 \Sessions\2\DosDevices
0000025C csrss.exe      Directory      002c \Sessions\2\Windows
0000025C csrss.exe      Directory      003c \Sessions\2\BaseNamedObjects
0000025C csrss.exe      SymbolicLink   0040
\Sessions\2\BaseNamedObjects\Global
0000025C csrss.exe      SymbolicLink   0044
\Sessions\2\BaseNamedObjects\Local
0000025C csrss.exe      SymbolicLink   0048
\Sessions\2\BaseNamedObjects\Session
0000025C csrss.exe      Directory      004c
\Sessions\2\BaseNamedObjects\Restricted
0000025C csrss.exe      Mutant         0050 \Sessions\2\NlsCacheMutant
0000025C csrss.exe      Mutant         0058 \Sessions\2\NlsCacheMutant
0000025C csrss.exe      Directory      0070
\Sessions\2\Windows\WindowStations
0000025C csrss.exe      Directory      007c \Sessions\2\BaseNamedObjects
0000025C csrss.exe      Port           0098 \Sessions\2\Windows\ApiPort
0000025C csrss.exe      Port           009c \Sessions\2\Windows\SbApiPort
0000025C csrss.exe      Event          00c4
\Sessions\2\BaseNamedObjects\ScNetDrvMsg
0000025C csrss.exe      Key            00c8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\PriorityControl
00000260 winlogon.exe   Directory      0010 \KnownDlls
00000260 winlogon.exe   File           0014 \WINDOWS\system32
00000260 winlogon.exe   Directory      0018 \Sessions\2\Windows
00000260 winlogon.exe   Mutant         0024 \Sessions\2\NlsCacheMutant
00000260 winlogon.exe   Key            0030 \REGISTRY\MACHINE
00000260 winlogon.exe   Directory      004c \Sessions\2\BaseNamedObjects
00000260 winlogon.exe   Event          0050 \BaseNamedObjects\userenv:  User
Profile setup event
00000260 winlogon.exe   Mutant         0054 \BaseNamedObjects\userenv:
machine policy mutex
00000260 winlogon.exe   Event          0058 \BaseNamedObjects\userenv:
Machine Group Policy has been applied
00000260 winlogon.exe   Event          005c \BaseNamedObjects\userenv:
Machine Group Policy ForcedRefresh Needs Foreground Processing
00000260 winlogon.exe   Event          0060 \BaseNamedObjects\userenv:
Machine Group Policy Processing is done
00000260 winlogon.exe   Event          0064 \BaseNamedObjects\userenv:
Machine Policy Foreground Done Event
00000260 winlogon.exe   Mutant         0068
\Sessions\2\BaseNamedObjects\userenv: user policy mutex
00000260 winlogon.exe   Event          006c
\Sessions\2\BaseNamedObjects\userenv: User Group Policy has been applied
00000260 winlogon.exe   Event          0070
\Sessions\2\BaseNamedObjects\userenv: User Group Policy ForcedRefresh Needs
Foreground Processing
00000260 winlogon.exe   Event          0074
\Sessions\2\BaseNamedObjects\userenv: User Group Policy Processing is done
00000260 winlogon.exe   Event          0078
\Sessions\2\BaseNamedObjects\userenv: User Policy Foreground Done Event
00000260 winlogon.exe   Event          007c
\BaseNamedObjects\crypt32LogoffEvent
00000294 svchost.exe    Directory      0010 \KnownDlls
00000294 svchost.exe    File           0014 \WINDOWS\system32
00000294 svchost.exe    Key            0018 \REGISTRY\MACHINE
00000294 svchost.exe    Directory      0024 \Windows
00000294 svchost.exe    Mutant         0030 \NlsCacheMutant
00000294 svchost.exe    File           0038 \net\NtControlPipe5
00000294 svchost.exe    Directory      0078 \BaseNamedObjects
00000294 svchost.exe    File           0080 \svcctl
00000294 svchost.exe    WindowStation  0090
\Windows\WindowStations\Service-0x0-3e4$
00000294 svchost.exe    Desktop        0094 \Default
00000294 svchost.exe    WindowStation  0098
\Windows\WindowStations\Service-0x0-3e4$
00000294 svchost.exe    Key            00b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
00000294 svchost.exe    Key            00b8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
00000294 svchost.exe    Key            00bc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
00000294 svchost.exe    Key            00c0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
00000294 svchost.exe    Key            00d8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
00000294 svchost.exe    Key            00e0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
00000294 svchost.exe    File           00fc \WINDOWS\system32\drivers\etc
00000294 svchost.exe    Section        0108 \RPC Control\DSEC294
00000294 svchost.exe    File           0130 \DNSRSLVR
00000294 svchost.exe    File           0134 \DNSRSLVR
00000294 svchost.exe    File           0144 \DNSRSLVR
00000294 svchost.exe    File           0148 \svcctl
00000294 svchost.exe    File           0164 \DNSRSLVR
00000294 svchost.exe    File           0198 \DNSRSLVR
0000029C svchost.exe    Directory      0010 \KnownDlls
0000029C svchost.exe    File           0014 \WINDOWS\system32
0000029C svchost.exe    Key            0018 \REGISTRY\MACHINE
0000029C svchost.exe    Directory      0024 \Windows
0000029C svchost.exe    Mutant         0030 \NlsCacheMutant
0000029C svchost.exe    File           0038 \net\NtControlPipe6
0000029C svchost.exe    Directory      0078 \BaseNamedObjects
0000029C svchost.exe    File           0080 \svcctl
0000029C svchost.exe    WindowStation  0090
\Windows\WindowStations\Service-0x0-3e5$
0000029C svchost.exe    Desktop        0094 \Default
0000029C svchost.exe    WindowStation  0098
\Windows\WindowStations\Service-0x0-3e5$
0000029C svchost.exe    Key            00b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
0000029C svchost.exe    Key            00b8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
0000029C svchost.exe    Key            00bc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
0000029C svchost.exe    Key            00c0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
0000029C svchost.exe    Key            00f0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
0000029C svchost.exe    Key            00f8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
0000029C svchost.exe    File           0110 \Alerter
0000029C svchost.exe    File           0128
\Winsock2\CatalogChangeListener-29c-0
0000029C svchost.exe    File           0168 \messngr
0000029C svchost.exe    Section        0170 \RPC Control\DSEC29c
0000029C svchost.exe    File           0194 \msgsvc
0000029C svchost.exe    File           0198 \msgsvc
0000029C svchost.exe    File           01d0 \Endpoint
0000029C svchost.exe    Key            01e8
\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet
Settings
0000029C svchost.exe    Key            01f0 \REGISTRY\USER\S-1-5-19
0000029C svchost.exe    Event          01f4
\BaseNamedObjects\crypt32LogoffEvent
0000029C svchost.exe    File           01fc \lsarpc
0000029C svchost.exe    File           0204 \ntsvcs
0000029C svchost.exe    Key            0214
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
0000029C svchost.exe    File           0218
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
0000029C svchost.exe    Semaphore      0220
\BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
0000029C svchost.exe    Mutant         0228
\BaseNamedObjects\_!MSFTHISTORY!_
0000029C svchost.exe    File           022c \Documents and
Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet
Files\Content.IE5\index.dat
0000029C svchost.exe    Mutant         0230 \BaseNamedObjects\c:!documents
and settings!localservice.nt authority!local settings!temporary internet
files!content.ie5!
0000029C svchost.exe    Section        0234 \BaseNamedObjects\C:_Documents
and Settings_LocalService.NT AUTHORITY_Local Settings_Temporary Internet
Files_Content.IE5_index.dat_32768
0000029C svchost.exe    Mutant         0238 \BaseNamedObjects\c:!documents
and settings!localservice.nt authority!cookies!
0000029C svchost.exe    File           023c \Documents and
Settings\LocalService.NT AUTHORITY\Cookies\index.dat
0000029C svchost.exe    Section        0240 \BaseNamedObjects\C:_Documents
and Settings_LocalService.NT AUTHORITY_Cookies_index.dat_16384
0000029C svchost.exe    Mutant         0244 \BaseNamedObjects\c:!documents
and settings!localservice.nt authority!local settings!history!history.ie5!
0000029C svchost.exe    File           0248 \Documents and
Settings\LocalService.NT AUTHORITY\Local
Settings\History\History.IE5\index.dat
0000029C svchost.exe    Section        024c \BaseNamedObjects\C:_Documents
and Settings_LocalService.NT AUTHORITY_Local
Settings_History_History.IE5_index.dat_16384
0000029C svchost.exe    Mutant         0254
\BaseNamedObjects\WininetStartupMutex
0000029C svchost.exe    Mutant         0260
\BaseNamedObjects\WininetProxyRegistryMutex
0000029C svchost.exe    File           02ac \DAV RPC SERVICE
0000029C svchost.exe    File           02b0 \DAV RPC SERVICE
0000029C svchost.exe    File           02b4 \msgsvc
0000029C svchost.exe    File           02c0 \DNSRSLVR
0000029C svchost.exe    Mutant         02d0 \BaseNamedObjects\RasPbFile
0000029C svchost.exe    Key            02f8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
0000029C svchost.exe    Section        0308 \BaseNamedObjects\SENS
Information Cache
0000029C svchost.exe    Key            0310 \REGISTRY\USER
0000029C svchost.exe    Key            0314
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010
0000029C svchost.exe    Key            0318
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001
0000029C svchost.exe    File           0358 \ROUTER
000002D8 spoolsv.exe    Directory      0010 \KnownDlls
000002D8 spoolsv.exe    File           0014 \WINDOWS\system32
000002D8 spoolsv.exe    Directory      001c \Windows
000002D8 spoolsv.exe    Mutant         0024 \NlsCacheMutant
000002D8 spoolsv.exe    Key            0030 \REGISTRY\MACHINE
000002D8 spoolsv.exe    WindowStation  003c \Windows\WindowStations\WinSta0
000002D8 spoolsv.exe    Desktop        0040 \Default
000002D8 spoolsv.exe    WindowStation  0044 \Windows\WindowStations\WinSta0
000002D8 spoolsv.exe    File           0048 \net\NtControlPipe7
000002D8 spoolsv.exe    Directory      0088 \BaseNamedObjects
000002D8 spoolsv.exe    File           0090 \svcctl
000002D8 spoolsv.exe    Event          00a0
\BaseNamedObjects\RouterPreInitEvent
000002D8 spoolsv.exe    Section        00a4 \RPC Control\DSEC2d8
000002D8 spoolsv.exe    File           00cc \spoolss
000002D8 spoolsv.exe    File           00d0 \spoolss
000002D8 spoolsv.exe    Port           00e4 \RPC Control\spoolss
000002D8 spoolsv.exe    Event          0120
\BaseNamedObjects\crypt32LogoffEvent
000002D8 spoolsv.exe    File           0150 \DNSRSLVR
000002D8 spoolsv.exe    Key            0190
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print
000002D8 spoolsv.exe    Key            0194
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Print\Printers
000002D8 spoolsv.exe    Key            01c0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard
TCP/IP Port
000002D8 spoolsv.exe    Key            01c8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000002D8 spoolsv.exe    Key            01d0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000002D8 spoolsv.exe    Key            01ec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001
000002D8 spoolsv.exe    File           0200 \lsarpc
000002D8 spoolsv.exe    File           0208 \ntsvcs
000002D8 spoolsv.exe    Key            0220
\REGISTRY\MACHINE\SOFTWARE\Classes
000002D8 spoolsv.exe    Key            0228
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002D8 spoolsv.exe    Key            0234 \REGISTRY\USER
000002D8 spoolsv.exe    Key            0238
\REGISTRY\MACHINE\SOFTWARE\Classes
000002D8 spoolsv.exe    Key            0244
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002D8 spoolsv.exe    Key            024c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002D8 spoolsv.exe    Key            0254
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000002D8 spoolsv.exe    Key            025c
\REGISTRY\MACHINE\SOFTWARE\Classes
000002D8 spoolsv.exe    Key            0264
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002D8 spoolsv.exe    Key            0270
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002D8 spoolsv.exe    Key            0278
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002D8 spoolsv.exe    Key            0280
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000002D8 spoolsv.exe    Section        0288
\BaseNamedObjects\__R_000000000013_SMem__
000002D8 spoolsv.exe    Key            028c
\REGISTRY\MACHINE\SOFTWARE\Classes
000002D8 spoolsv.exe    Port           02ac \RPC Control\OLE4
000002D8 spoolsv.exe    Key            02e4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
000002D8 spoolsv.exe    Key            02e8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
000002D8 spoolsv.exe    Key            02ec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
000002D8 spoolsv.exe    Key            02f0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
000002D8 spoolsv.exe    Key            0328
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
000002D8 spoolsv.exe    File           0330
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000002D8 spoolsv.exe    Key            0334 \REGISTRY\USER\.DEFAULT
000002D8 spoolsv.exe    Semaphore      0338
\BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
000002D8 spoolsv.exe    Event          0350 \BaseNamedObjects\userenv:  User
Profile setup event
000002FC msdtc.exe      Directory      0010 \KnownDlls
000002FC msdtc.exe      File           0014 \WINDOWS\system32
000002FC msdtc.exe      Directory      0024 \Windows
000002FC msdtc.exe      Mutant         0030 \NlsCacheMutant
000002FC msdtc.exe      Key            0038 \REGISTRY\MACHINE
000002FC msdtc.exe      WindowStation  0044
\Windows\WindowStations\Service-0x0-3e4$
000002FC msdtc.exe      Desktop        0048 \Default
000002FC msdtc.exe      WindowStation  004c
\Windows\WindowStations\Service-0x0-3e4$
000002FC msdtc.exe      Directory      0058 \BaseNamedObjects
000002FC msdtc.exe      Key            00ac
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
000002FC msdtc.exe      File           00c0 \net\NtControlPipe8
000002FC msdtc.exe      File           00d4 \svcctl
000002FC msdtc.exe      Event          00f8
\BaseNamedObjects\EVENT_MSDTC_STARTING
000002FC msdtc.exe      Key            0104
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000002FC msdtc.exe      Key            010c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000002FC msdtc.exe      Key            013c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Tracing\MSDTC\Changed
000002FC msdtc.exe      Section        0150 \RPC Control\DSEC2fc
000002FC msdtc.exe      Port           0158 \RPC
Control\LRPC000002fc.00000001
000002FC msdtc.exe      File           018c \Endpoint
000002FC msdtc.exe      File           01a8
\Winsock2\CatalogChangeListener-2fc-0
000002FC msdtc.exe      File           01ac \Endpoint
000002FC msdtc.exe      Key            01b0
\REGISTRY\MACHINE\SOFTWARE\Classes\CID\41b1f46c-db5e-48b5-b9a7-90c0b862411d
000002FC msdtc.exe      Key            01d0
\REGISTRY\MACHINE\SOFTWARE\Classes\SVCID\ced2de40-bff6-11ce-9de8-00aa00a3f464
000002FC msdtc.exe      Key            01d4
\REGISTRY\MACHINE\SOFTWARE\Classes\CID\41b1f46c-db5e-48b5-b9a7-90c0b862411d
000002FC msdtc.exe      Key            01d8
\REGISTRY\MACHINE\SOFTWARE\Classes\SVCID\ced2de40-bff6-11ce-9de8-00aa00a3f464
000002FC msdtc.exe      Key            01dc
\REGISTRY\MACHINE\SOFTWARE\Classes\CID\41b1f46c-db5e-48b5-b9a7-90c0b862411d
000002FC msdtc.exe      Key            01e0
\REGISTRY\MACHINE\SOFTWARE\Classes\SVCID\ced2de40-bff6-11ce-9de8-00aa00a3f464
000002FC msdtc.exe      Key            0208
\REGISTRY\MACHINE\SOFTWARE\Classes
000002FC msdtc.exe      Key            0210
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002FC msdtc.exe      Key            021c \REGISTRY\USER
000002FC msdtc.exe      Key            0220
\REGISTRY\MACHINE\SOFTWARE\Classes
000002FC msdtc.exe      Key            022c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002FC msdtc.exe      Key            0234
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002FC msdtc.exe      Key            023c
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000002FC msdtc.exe      Key            0244
\REGISTRY\MACHINE\SOFTWARE\Classes
000002FC msdtc.exe      Key            024c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002FC msdtc.exe      Key            0258
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002FC msdtc.exe      Key            0260
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002FC msdtc.exe      Key            0268
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000002FC msdtc.exe      Section        0270
\BaseNamedObjects\__R_000000000013_SMem__
000002FC msdtc.exe      Key            0274 \REGISTRY\USER\S-1-5-20_CLASSES
000002FC msdtc.exe      File           0284
\WINDOWS\system32\MsDtc\MSDTC.LOG
000002FC msdtc.exe      Event          02d8
\BaseNamedObjects\MSDTC_NAMED_EVENT
000003B8 inetinfo.exe   Directory      0010 \KnownDlls
000003B8 inetinfo.exe   File           0014 \WINDOWS\system32
000003B8 inetinfo.exe   Directory      001c \Windows
000003B8 inetinfo.exe   Mutant         0024 \NlsCacheMutant
000003B8 inetinfo.exe   Key            0030 \REGISTRY\MACHINE
000003B8 inetinfo.exe   WindowStation  003c
\Windows\WindowStations\Service-0x0-3e7$
000003B8 inetinfo.exe   Desktop        0040 \Default
000003B8 inetinfo.exe   WindowStation  0044
\Windows\WindowStations\__X78B95_89_IW
000003B8 inetinfo.exe   Directory      0048 \BaseNamedObjects
000003B8 inetinfo.exe   Event          0064
\BaseNamedObjects\W3SVCStartW3WP-aae415e7-4598-4294-a382-0a435d5b32c5
000003B8 inetinfo.exe   File           006c \net\NtControlPipe9
000003B8 inetinfo.exe   File           00b0 \svcctl
000003B8 inetinfo.exe   File           00c0 \svcctl
000003B8 inetinfo.exe   Key            00cc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
000003B8 inetinfo.exe   File           00d0
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000003B8 inetinfo.exe   Key            00d4 \REGISTRY\USER\.DEFAULT
000003B8 inetinfo.exe   Desktop        00e8 \__A8D9S1_42_ID
000003B8 inetinfo.exe   WindowStation  00ec
\Windows\WindowStations\__X78B95_89_IW
000003B8 inetinfo.exe   Key            0124
\REGISTRY\MACHINE\SOFTWARE\Classes
000003B8 inetinfo.exe   Key            012c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000003B8 inetinfo.exe   Key            0138 \REGISTRY\USER
000003B8 inetinfo.exe   Key            013c
\REGISTRY\MACHINE\SOFTWARE\Classes
000003B8 inetinfo.exe   Key            0148
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000003B8 inetinfo.exe   Key            0150
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000003B8 inetinfo.exe   Key            0158
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000003B8 inetinfo.exe   Key            0160
\REGISTRY\MACHINE\SOFTWARE\Classes
000003B8 inetinfo.exe   Key            0168
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000003B8 inetinfo.exe   Key            0174
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000003B8 inetinfo.exe   Key            017c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000003B8 inetinfo.exe   Key            0184
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000003B8 inetinfo.exe   Section        018c
\BaseNamedObjects\__R_000000000013_SMem__
000003B8 inetinfo.exe   File           01c0
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           01c8
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           01d0
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           01d8
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           01e0
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           01e8
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           01f0
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           01f8
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           0200
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           0208
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   Key            0228
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W3SVC\Parameters
000003B8 inetinfo.exe   Semaphore      026c
\BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
000003B8 inetinfo.exe   Event          0284 \BaseNamedObjects\userenv:  User
Profile setup event
000003B8 inetinfo.exe   Event          0288
\BaseNamedObjects\crypt32LogoffEvent
000003B8 inetinfo.exe   Section        02d0 \RPC Control\DSEC3b8
000003B8 inetinfo.exe   Port           02d8 \RPC Control\OLE5
000003B8 inetinfo.exe   Key            0350
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000003B8 inetinfo.exe   Key            0358
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000003B8 inetinfo.exe   Mutant         051c \BaseNamedObjects\DBWinMutex
000003B8 inetinfo.exe   Port           05bc \RPC Control\INETINFO_LPC
000003B8 inetinfo.exe   File           05ec \Endpoint
000003B8 inetinfo.exe   File           05fc
\Winsock2\CatalogChangeListener-3b8-0
000003B8 inetinfo.exe   File           0610 \Endpoint
000003B8 inetinfo.exe   File           0638 \INETINFO
000003B8 inetinfo.exe   File           063c \INETINFO
000003B8 inetinfo.exe   Key            065c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\MosTrace\CurrentVersion\DebugAsyncTrace
000003B8 inetinfo.exe   File           0668 \EVENTLOG
000003B8 inetinfo.exe   Key            0674
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\InetInfo\Parameters
000003B8 inetinfo.exe   File           0698 \Endpoint
000003B8 inetinfo.exe   Key            06c0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip
000003B8 inetinfo.exe   Key            06dc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSFtpsvc\Parameters
000003B8 inetinfo.exe   File           071c \Inetpub\ftproot
000003B8 inetinfo.exe   Event          072c
\BaseNamedObjects\MicrosoftInternetNewsServerVersion2BootCheckEvent
000003B8 inetinfo.exe   File           073c \Endpoint
000003B8 inetinfo.exe   File           0740 \Endpoint
000003B8 inetinfo.exe   File           0744 \Endpoint
000003B8 inetinfo.exe   File           0748 \Endpoint
000003B8 inetinfo.exe   File           074c \Endpoint
000003B8 inetinfo.exe   File           0750 \Endpoint
000003B8 inetinfo.exe   File           0754 \Endpoint
000003B8 inetinfo.exe   File           0758 \Endpoint
000003B8 inetinfo.exe   File           075c \Endpoint
000003B8 inetinfo.exe   File           0760 \Endpoint
000003B8 inetinfo.exe   File           0764 \Endpoint
000003B8 inetinfo.exe   File           076c \Endpoint
000003B8 inetinfo.exe   Port           07f0 \RPC Control\SMTPSVC_LPC
000003B8 inetinfo.exe   File           0824 \SMTPSVC
000003B8 inetinfo.exe   File           0828 \SMTPSVC
000003B8 inetinfo.exe   Port           0830 \RPC Control\NNTPSVC_LPC
000003B8 inetinfo.exe   Section        0858 \BaseNamedObjects\RotHintTable
000003B8 inetinfo.exe   Key            0860
\REGISTRY\MACHINE\SOFTWARE\Classes
000003B8 inetinfo.exe   File           0874 \Endpoint
000003B8 inetinfo.exe   File           08ec \Endpoint
000003B8 inetinfo.exe   File           08f0 \Endpoint
000003B8 inetinfo.exe   File           08f4 \Endpoint
000003B8 inetinfo.exe   File           08f8 \Endpoint
000003B8 inetinfo.exe   File           08fc \Endpoint
000003B8 inetinfo.exe   File           0900 \Endpoint
000003B8 inetinfo.exe   File           0918 \Inetpub\mailroot\Pickup
000003B8 inetinfo.exe   Section        091c \BaseNamedObjects\NTFSDrv
000003B8 inetinfo.exe   Section        0920 \BaseNamedObjects\NTFSDRV_OBJ0
000003B8 inetinfo.exe   File           093c \Endpoint
000003B8 inetinfo.exe   File           0944 \Endpoint
000003B8 inetinfo.exe   File           0948 \Endpoint
000003B8 inetinfo.exe   File           094c \Endpoint
000003B8 inetinfo.exe   File           0950 \Endpoint
000003B8 inetinfo.exe   File           0954 \Endpoint
000003B8 inetinfo.exe   File           0958 \Endpoint
000003B8 inetinfo.exe   File           095c \Endpoint
000003B8 inetinfo.exe   File           0960 \Endpoint
000003B8 inetinfo.exe   File           0964 \Endpoint
000003B8 inetinfo.exe   File           0968 \Endpoint
000003B8 inetinfo.exe   Key            0978
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NntpSvc\Parameters
000003B8 inetinfo.exe   File           0994 \Inetpub\nntpfile\groupvar.lst
000003B8 inetinfo.exe   File           0998 \Inetpub\nntpfile\group.lst
000003B8 inetinfo.exe   File           099c \Inetpub\nntpfile\article.hsh
000003B8 inetinfo.exe   File           09a4 \Inetpub\nntpfile\history.hsh
000003B8 inetinfo.exe   File           09ac \Inetpub\nntpfile\xover.hsh
000003B8 inetinfo.exe   Key            09dc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ContentIndex
000003B8 inetinfo.exe   File           09e0
\Inetpub\nntpfile\root\control\group.vpp
000003B8 inetinfo.exe   File           09e4 \Inetpub\nntpfile\root\control
000003B8 inetinfo.exe   File           09f0 \Inetpub\nntpfile\pickup
000003B8 inetinfo.exe   File           09fc
\Inetpub\nntpfile\root\_slavegroup
000003B8 inetinfo.exe   File           0a00 \Inetpub\nntpfile\root
000003B8 inetinfo.exe   File           0a04 \Inetpub\nntpfile\root\control
000003B8 inetinfo.exe   File           0a10 \Endpoint
000003B8 inetinfo.exe   File           0a18 \Endpoint
000003B8 inetinfo.exe   File           0a1c \Endpoint
000003B8 inetinfo.exe   File           0a20 \Endpoint
000003B8 inetinfo.exe   File           0a24
\Inetpub\nntpfile\root\_slavegroup\group.vpp
000003B8 inetinfo.exe   File           0a28
\Inetpub\nntpfile\root\_slavegroup
000003B8 inetinfo.exe   File           0a30 \Inetpub\nntpfile\root\group.vpp
000003B8 inetinfo.exe   File           0a34 \Inetpub\nntpfile\root
000003B8 inetinfo.exe   File           0a3c \Endpoint
000003B8 inetinfo.exe   File           0a40 \Endpoint
000003B8 inetinfo.exe   File           0a44 \Endpoint
000003B8 inetinfo.exe   File           0a48 \Endpoint
000003B8 inetinfo.exe   File           0a4c \Endpoint
000003B8 inetinfo.exe   File           0a50 \Endpoint
000003B8 inetinfo.exe   File           0a54 \Endpoint
000003B8 inetinfo.exe   File           0a5c \Endpoint
000003B8 inetinfo.exe   File           0a64 \Endpoint
000003B8 inetinfo.exe   File           0a68 \Endpoint
000003B8 inetinfo.exe   File           0a6c \Endpoint
000003B8 inetinfo.exe   File           0a70 \Endpoint
000003B8 inetinfo.exe   File           0a74 \Endpoint
000003B8 inetinfo.exe   File           0a78 \Endpoint
000003B8 inetinfo.exe   File           0a7c \Endpoint
000003B8 inetinfo.exe   File           0a80 \Endpoint
000003B8 inetinfo.exe   File           0a84 \Endpoint
000003B8 inetinfo.exe   File           0a88 \Endpoint
000003B8 inetinfo.exe   File           0ae0 \NNTPSVC
000003B8 inetinfo.exe   File           0ae4 \NNTPSVC
000003B8 inetinfo.exe   File           0b60 \DefaultAppPool
000003B8 inetinfo.exe   File           0b88 \iisipm
000003B8 inetinfo.exe   Key            0bb8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\InetInfo\Parameters
000003B8 inetinfo.exe   Key            0bc8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W3SVC\Parameters
000003B8 inetinfo.exe   File           0bdc \IISCgiStdOut952
000003B8 inetinfo.exe   File           0be4 \IISCgiStdIn952
000003B8 inetinfo.exe   File           0c10 \SSLFilterChannel
000003CC llssrv.exe     Directory      0010 \KnownDlls
000003CC llssrv.exe     File           0014 \WINDOWS\system32
000003CC llssrv.exe     Directory      0024 \Windows
000003CC llssrv.exe     Mutant         0030 \NlsCacheMutant
000003CC llssrv.exe     Key            0038 \REGISTRY\MACHINE
000003CC llssrv.exe     WindowStation  004c
\Windows\WindowStations\Service-0x0-3e4$
000003CC llssrv.exe     Desktop        0050 \Default
000003CC llssrv.exe     WindowStation  0054
\Windows\WindowStations\Service-0x0-3e4$
000003CC llssrv.exe     Directory      005c \BaseNamedObjects
000003CC llssrv.exe     File           0068 \net\NtControlPipe10
000003CC llssrv.exe     File           00ac \svcctl
000003CC llssrv.exe     Key            0120
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000003CC llssrv.exe     Key            0128
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000003CC llssrv.exe     Section        0140 \RPC Control\DSEC3cc
000003CC llssrv.exe     Port           014c \RPC Control\llslpc
000003CC llssrv.exe     File           017c \llsrpc
000003CC llssrv.exe     File           0180 \llsrpc
000003A8 NSPMON.exe     Directory      0010 \KnownDlls
000003A8 NSPMON.exe     File           0014 \WINDOWS\system32
000003A8 NSPMON.exe     Key            0018 \REGISTRY\MACHINE
000003A8 NSPMON.exe     Directory      0024 \Windows
000003A8 NSPMON.exe     Mutant         0030 \NlsCacheMutant
000003A8 NSPMON.exe     WindowStation  0040
\Windows\WindowStations\Service-0x0-b39a$
000003A8 NSPMON.exe     Desktop        0044 \Default
000003A8 NSPMON.exe     WindowStation  0048
\Windows\WindowStations\Service-0x0-b39a$
000003A8 NSPMON.exe     Directory      0050 \BaseNamedObjects
000003A8 NSPMON.exe     Key            005c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000003A8 NSPMON.exe     Key            0064
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000003A8 NSPMON.exe     File           0068 \net\NtControlPipe11
000003A8 NSPMON.exe     File           00ac \svcctl
000003A8 NSPMON.exe     File           00e8 \Endpoint
000003A8 NSPMON.exe     File           00f0 \Endpoint
0000041C NSCM.exe       Directory      0010 \KnownDlls
0000041C NSCM.exe       File           0014 \WINDOWS\system32
0000041C NSCM.exe       Key            0018 \REGISTRY\MACHINE
0000041C NSCM.exe       Directory      0024 \Windows
0000041C NSCM.exe       Mutant         0030 \NlsCacheMutant
0000041C NSCM.exe       WindowStation  0040
\Windows\WindowStations\Service-0x0-b80d$
0000041C NSCM.exe       Desktop        0044 \Default
0000041C NSCM.exe       WindowStation  0048
\Windows\WindowStations\Service-0x0-b80d$
0000041C NSCM.exe       Directory      0050 \BaseNamedObjects
0000041C NSCM.exe       Mutant         0054
\BaseNamedObjects\McmServPERF_REGISTRY_MUTEX
0000041C NSCM.exe       Key            0058
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
0000041C NSCM.exe       Key            005c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
0000041C NSCM.exe       File           0068
\DOCUME~1\NETSHO~1\LOCALS~1\Temp\Perflib_Perfdata_41c.dat
0000041C NSCM.exe       Section        006c
\BaseNamedObjects\Perflib_Perfdata_41c
0000041C NSCM.exe       Key            00ac
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsstation\Performance
0000041C NSCM.exe       Event          00b0
\BaseNamedObjects\McmServPerf_RegChangeEvent
0000041C NSCM.exe       Key            00b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ASP\Performance
0000041C NSCM.exe       Mutant         00b8
\BaseNamedObjects\ASP_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            00bc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ContentFilter\Performance
0000041C NSCM.exe       Mutant         00c0
\BaseNamedObjects\ContentFilter_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            00c4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ContentIndex\Performance
0000041C NSCM.exe       Mutant         00c8
\BaseNamedObjects\ContentIndex_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            00cc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\InetInfo\Performance
0000041C NSCM.exe       Mutant         00d0
\BaseNamedObjects\InetInfo_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            00d4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ISAPISearch\Performance
0000041C NSCM.exe       Mutant         00d8
\BaseNamedObjects\ISAPISearch_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            00dc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC\Performance
0000041C NSCM.exe       Mutant         00e0
\BaseNamedObjects\MSDTC_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            00e4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSFtpsvc\Performance
0000041C NSCM.exe       Mutant         00e8
\BaseNamedObjects\MSFtpsvc_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            00ec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NntpSvc\Performance
0000041C NSCM.exe       Mutant         00f0
\BaseNamedObjects\NntpSvc_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            00f4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsstation\Performance
0000041C NSCM.exe       Mutant         00f8
\BaseNamedObjects\nsstation_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            00fc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsunicast\Performance
0000041C NSCM.exe       Mutant         0100
\BaseNamedObjects\nsunicast_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            0104
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NTFSDRV\Performance
0000041C NSCM.exe       Mutant         0108
\BaseNamedObjects\NTFSDRV_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            010c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfDisk\Performance
0000041C NSCM.exe       Mutant         0110
\BaseNamedObjects\PerfDisk_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            0114
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfNet\Performance
0000041C NSCM.exe       Mutant         0118
\BaseNamedObjects\PerfNet_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            011c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfOS\Performance
0000041C NSCM.exe       Mutant         0120
\BaseNamedObjects\PerfOS_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            0124
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfProc\Performance
0000041C NSCM.exe       Mutant         0128
\BaseNamedObjects\PerfProc_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            012c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess\Performance
0000041C NSCM.exe       Mutant         0130
\BaseNamedObjects\RemoteAccess_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            0134
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RSVP\Performance
0000041C NSCM.exe       Mutant         0138
\BaseNamedObjects\RSVP_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            013c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMTPSVC\Performance
0000041C NSCM.exe       Mutant         0140
\BaseNamedObjects\SMTPSVC_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            0144
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Spooler\Performance
0000041C NSCM.exe       Mutant         0148
\BaseNamedObjects\Spooler_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            014c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TapiSrv\Performance
0000041C NSCM.exe       Mutant         0150
\BaseNamedObjects\TapiSrv_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            0154
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Performance
0000041C NSCM.exe       Mutant         0158
\BaseNamedObjects\Tcpip_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            015c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Performance
0000041C NSCM.exe       Mutant         0160
\BaseNamedObjects\TermService_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            0164
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W3SVC\Performance
0000041C NSCM.exe       Mutant         0168
\BaseNamedObjects\W3SVC_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Key            016c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmiApRpl\Performance
0000041C NSCM.exe       Mutant         0170
\BaseNamedObjects\WmiApRpl_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0174
\BaseNamedObjects\McmServPERF_INFO_MUTEX
0000041C NSCM.exe       File           017c \net\NtControlPipe12
0000041C NSCM.exe       File           0190 \svcctl
0000041C NSCM.exe       Key            019c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
0000041C NSCM.exe       Key            01a4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
0000041C NSCM.exe       Key            01b0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsstation
0000041C NSCM.exe       Key            01b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsstation\Parameters
0000041C NSCM.exe       Key            01c4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\AccessLists\AllowDistribution
0000041C NSCM.exe       Key            01cc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\AccessLists\DisallowDistribution
0000041C NSCM.exe       Section        01d4 \BaseNamedObjects\McmServ
PerfAPI Global Info ShMem
0000041C NSCM.exe       Mutant         01f4 \BaseNamedObjects\Shared Mutex
for McmServ Data Collection_0
0000041C NSCM.exe       Section        01f8 \BaseNamedObjects\McmServ
Counter Name ShMem
0000041C NSCM.exe       Section        01fc \BaseNamedObjects\McmServ
Counter Help ShMem
0000041C NSCM.exe       Section        0200 \BaseNamedObjects\McmServ
PerfAPI Counter Data ShMem_Windows Media Station Service
0000041C NSCM.exe       Key            0218
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsstation\Stations
0000041C NSCM.exe       File           0220 \Endpoint
0000041C NSCM.exe       File           0228 \Endpoint
0000041C NSCM.exe       Section        0250 \RPC Control\DSEC41c
0000041C NSCM.exe       Port           0254 \RPC Control\OLE9
0000041C NSCM.exe       Key            0278
\REGISTRY\MACHINE\SOFTWARE\Classes
0000041C NSCM.exe       Key            0280
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000041C NSCM.exe       Key            028c \REGISTRY\USER
0000041C NSCM.exe       Key            0290
\REGISTRY\MACHINE\SOFTWARE\Classes
0000041C NSCM.exe       Key            029c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000041C NSCM.exe       Key            02a4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000041C NSCM.exe       Key            02ac
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
0000041C NSCM.exe       Key            02b4
\REGISTRY\MACHINE\SOFTWARE\Classes
0000041C NSCM.exe       Key            02bc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000041C NSCM.exe       Key            02c8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000041C NSCM.exe       Key            02d0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000041C NSCM.exe       Key            02d8
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
0000041C NSCM.exe       Section        02e0
\BaseNamedObjects\__R_000000000013_SMem__
0000041C NSCM.exe       Key            02e4
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000_CLASSES
0000041C NSCM.exe       File           02f0 \lsarpc
0000046C svchost.exe    Directory      0010 \KnownDlls
0000046C svchost.exe    File           0014 \WINDOWS\system32
0000046C svchost.exe    Key            0018 \REGISTRY\MACHINE
0000046C svchost.exe    Directory      0024 \Windows
0000046C svchost.exe    Mutant         0030 \NlsCacheMutant
0000046C svchost.exe    File           0038 \net\NtControlPipe13
0000046C svchost.exe    Directory      0078 \BaseNamedObjects
0000046C svchost.exe    File           0080 \svcctl
0000046C svchost.exe    Section        0098 \RPC Control\DSEC46c
0000046C svchost.exe    File           00c0 \winreg
0000046C svchost.exe    File           00c4 \winreg
0000046C svchost.exe    Event          00d0
\BaseNamedObjects\Microsoft.RPC_Registry_Server
000004C0 svchost.exe    Directory      0010 \KnownDlls
000004C0 svchost.exe    File           0014 \WINDOWS\system32
000004C0 svchost.exe    Directory      001c \Windows
000004C0 svchost.exe    Mutant         0024 \NlsCacheMutant
000004C0 svchost.exe    Key            002c \REGISTRY\MACHINE
000004C0 svchost.exe    WindowStation  003c
\Windows\WindowStations\Service-0x0-3e7$
000004C0 svchost.exe    Desktop        0040 \Default
000004C0 svchost.exe    WindowStation  0044
\Windows\WindowStations\Service-0x0-3e7$
000004C0 svchost.exe    Directory      0048 \BaseNamedObjects
000004C0 svchost.exe    File           008c \net\NtControlPipe14
000004C0 svchost.exe    File           00a0 \svcctl
000004C0 svchost.exe    Event          00cc
\BaseNamedObjects\WINMGMT_COREDLL_CANSHUTDOWN
000004C0 svchost.exe    File           00d0 \WINDOWS\system32\wbem\mof
000004C0 svchost.exe    Event          00d4
\BaseNamedObjects\WINMGMT_PROVIDER_CANSHUTDOWN
000004C0 svchost.exe    Event          00d8
\BaseNamedObjects\WINMGMT_COREDLL_UNLOADED
000004C0 svchost.exe    Event          00dc
\BaseNamedObjects\WINMGMT_COREDLL_LOADED
000004C0 svchost.exe    Event          00e0
\BaseNamedObjects\WINMGMT_MARSHALLING_SERVER_TERMINATE
000004C0 svchost.exe    Mutant         00e4
\BaseNamedObjects\WINMGMT_MARSHALLING_SERVER
000004C0 svchost.exe    Event          00e8
\BaseNamedObjects\WINMGMT_NEED_REGISTRATION
000004C0 svchost.exe    Event          00ec
\BaseNamedObjects\WINMGMT_REGISTRATION_DONE
000004C0 svchost.exe    Mutant         00f0
\BaseNamedObjects\WINMGMT_KEEP_NEW_CLIENTS_AT_BAY
000004C0 svchost.exe    Event          00f4
\BaseNamedObjects\WMI_SysEvent_LodCtr
000004C0 svchost.exe    Event          00f8
\BaseNamedObjects\WMI_SysEvent_UnLodCtr
000004C0 svchost.exe    Section        0100 \RPC Control\DSEC4c0
000004C0 svchost.exe    Port           0104 \RPC Control\OLEa
000004C0 svchost.exe    Key            0124
\REGISTRY\MACHINE\SOFTWARE\Classes
000004C0 svchost.exe    Key            012c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004C0 svchost.exe    Key            0138 \REGISTRY\USER
000004C0 svchost.exe    Key            013c
\REGISTRY\MACHINE\SOFTWARE\Classes
000004C0 svchost.exe    Key            0148
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004C0 svchost.exe    Key            0150
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004C0 svchost.exe    Key            0158
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000004C0 svchost.exe    Key            0160
\REGISTRY\MACHINE\SOFTWARE\Classes
000004C0 svchost.exe    Key            0168
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004C0 svchost.exe    Key            0174
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004C0 svchost.exe    Key            017c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004C0 svchost.exe    Key            0184
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000004C0 svchost.exe    Section        018c
\BaseNamedObjects\__R_000000000013_SMem__
000004C0 svchost.exe    Key            0190
\REGISTRY\MACHINE\SOFTWARE\Classes
000004C0 svchost.exe    Key            0214
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
000004C0 svchost.exe    Key            021c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale
000004C0 svchost.exe    Key            0220
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups
000004C0 svchost.exe    Mutant         0238 \BaseNamedObjects\WINMGMT_ACTIVE
000004C0 svchost.exe    File           025c
\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA
000004C0 svchost.exe    File           0260
\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR
000004C0 svchost.exe    Key            027c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM
000004C0 svchost.exe    Section        0284 \BaseNamedObjects\Wmi Provider
Sub System Counters
000004C0 svchost.exe    Event          029c
\BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS
000004C0 svchost.exe    Event          02b4
\BaseNamedObjects\WINMGMT_PROVIDER_CANSHUTDOWN
000004C0 svchost.exe    Job            02b8
\BaseNamedObjects\WmiProviderSubSystemHostJob
000004C0 svchost.exe    Event          02e4
\BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS
000004C0 svchost.exe    Event          02ec
\BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS
000004C0 svchost.exe    Event          04e0
\BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS
000004C0 svchost.exe    Event          0500
\BaseNamedObjects\EVENT_READYROOT/CIMV2SCM EVENT PROVIDER
000004C0 svchost.exe    File           050c \PIPE_EVENTROOT\CIMV2SCM EVENT
PROVIDER
000004C0 svchost.exe    Event          0518
\BaseNamedObjects\EVENT_READYROOT/CIMV2PROVIDERSUBSYSTEM
000004C0 svchost.exe    Event          0524
\BaseNamedObjects\EVENT_READYROOT/CIMV2WMI SELF-INSTRUMENTATION EVENT
PROVIDER
000004C0 svchost.exe    Event          0530
\BaseNamedObjects\EVENT_READYROOT/CIMV2STANDARD NON-COM EVENT PROVIDER
000004C0 svchost.exe    File           0538 \PIPE_EVENTROOT\CIMV2SCM EVENT
PROVIDER
000003DC dfssvc.exe     Directory      0010 \KnownDlls
000003DC dfssvc.exe     File           0014 \WINDOWS\system32
000003DC dfssvc.exe     Directory      0018 \Windows
000003DC dfssvc.exe     Mutant         0024 \NlsCacheMutant
000003DC dfssvc.exe     Key            0030 \REGISTRY\MACHINE
000003DC dfssvc.exe     WindowStation  0044
\Windows\WindowStations\Service-0x0-3e7$
000003DC dfssvc.exe     Desktop        0048 \Default
000003DC dfssvc.exe     WindowStation  004c
\Windows\WindowStations\Service-0x0-3e7$
000003DC dfssvc.exe     Directory      0050 \BaseNamedObjects
000003DC dfssvc.exe     Event          0064 \BaseNamedObjects\userenv:  User
Profile setup event
000003DC dfssvc.exe     File           0070 \net\NtControlPipe15
000003DC dfssvc.exe     File           00b4 \svcctl
000003DC dfssvc.exe     Section        00d0 \RPC Control\DSEC3dc
000003DC dfssvc.exe     File           00fc \netdfs
000003DC dfssvc.exe     File           0100 \netdfs
000003DC dfssvc.exe     File           0110 \wkssvc
000004F0 NSUM.exe       Directory      0010 \KnownDlls
000004F0 NSUM.exe       File           0014 \WINDOWS\system32
000004F0 NSUM.exe       Key            001c \REGISTRY\MACHINE
000004F0 NSUM.exe       Directory      0024 \Windows
000004F0 NSUM.exe       Mutant         0030 \NlsCacheMutant
000004F0 NSUM.exe       WindowStation  0040
\Windows\WindowStations\Service-0x0-c3f3$
000004F0 NSUM.exe       Desktop        0044 \Default
000004F0 NSUM.exe       WindowStation  0048
\Windows\WindowStations\Service-0x0-c3f3$
000004F0 NSUM.exe       Directory      0050 \BaseNamedObjects
000004F0 NSUM.exe       Mutant         0054
\BaseNamedObjects\AsfServPERF_REGISTRY_MUTEX
000004F0 NSUM.exe       Key            0058
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
000004F0 NSUM.exe       Key            005c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
000004F0 NSUM.exe       File           0068
\DOCUME~1\NETSHO~1\LOCALS~1\Temp\Perflib_Perfdata_4f0.dat
000004F0 NSUM.exe       Section        006c
\BaseNamedObjects\Perflib_Perfdata_4f0
000004F0 NSUM.exe       Key            00ac
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsunicast\Performance
000004F0 NSUM.exe       Event          00b0
\BaseNamedObjects\AsfServPerf_RegChangeEvent
000004F0 NSUM.exe       Key            00b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ASP\Performance
000004F0 NSUM.exe       Mutant         00b8
\BaseNamedObjects\ASP_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            00bc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ContentFilter\Performance
000004F0 NSUM.exe       Mutant         00c0
\BaseNamedObjects\ContentFilter_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            00c4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ContentIndex\Performance
000004F0 NSUM.exe       Mutant         00c8
\BaseNamedObjects\ContentIndex_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            00cc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\InetInfo\Performance
000004F0 NSUM.exe       Mutant         00d0
\BaseNamedObjects\InetInfo_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            00d4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ISAPISearch\Performance
000004F0 NSUM.exe       Mutant         00d8
\BaseNamedObjects\ISAPISearch_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            00dc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC\Performance
000004F0 NSUM.exe       Mutant         00e0
\BaseNamedObjects\MSDTC_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            00e4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSFtpsvc\Performance
000004F0 NSUM.exe       Mutant         00e8
\BaseNamedObjects\MSFtpsvc_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            00ec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NntpSvc\Performance
000004F0 NSUM.exe       Mutant         00f0
\BaseNamedObjects\NntpSvc_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            00f4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsstation\Performance
000004F0 NSUM.exe       Mutant         00f8
\BaseNamedObjects\nsstation_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            00fc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsunicast\Performance
000004F0 NSUM.exe       Mutant         0100
\BaseNamedObjects\nsunicast_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            0104
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NTFSDRV\Performance
000004F0 NSUM.exe       Mutant         0108
\BaseNamedObjects\NTFSDRV_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            010c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfDisk\Performance
000004F0 NSUM.exe       Mutant         0110
\BaseNamedObjects\PerfDisk_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            0114
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfNet\Performance
000004F0 NSUM.exe       Mutant         0118
\BaseNamedObjects\PerfNet_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            011c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfOS\Performance
000004F0 NSUM.exe       Mutant         0120
\BaseNamedObjects\PerfOS_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            0124
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfProc\Performance
000004F0 NSUM.exe       Mutant         0128
\BaseNamedObjects\PerfProc_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            012c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess\Performance
000004F0 NSUM.exe       Mutant         0130
\BaseNamedObjects\RemoteAccess_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            0134
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RSVP\Performance
000004F0 NSUM.exe       Mutant         0138
\BaseNamedObjects\RSVP_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            013c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMTPSVC\Performance
000004F0 NSUM.exe       Mutant         0140
\BaseNamedObjects\SMTPSVC_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            0144
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Spooler\Performance
000004F0 NSUM.exe       Mutant         0148
\BaseNamedObjects\Spooler_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            014c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TapiSrv\Performance
000004F0 NSUM.exe       Mutant         0150
\BaseNamedObjects\TapiSrv_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            0154
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Performance
000004F0 NSUM.exe       Mutant         0158
\BaseNamedObjects\Tcpip_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            015c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Performance
000004F0 NSUM.exe       Mutant         0160
\BaseNamedObjects\TermService_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            0164
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W3SVC\Performance
000004F0 NSUM.exe       Mutant         0168
\BaseNamedObjects\W3SVC_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Key            016c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmiApRpl\Performance
000004F0 NSUM.exe       Mutant         0170
\BaseNamedObjects\WmiApRpl_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0174
\BaseNamedObjects\AsfServPERF_INFO_MUTEX
000004F0 NSUM.exe       Key            0180
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
000004F0 NSUM.exe       File           0184 \net\NtControlPipe16
000004F0 NSUM.exe       File           019c \svcctl
000004F0 NSUM.exe       Key            01c4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000004F0 NSUM.exe       Key            01d0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000004F0 NSUM.exe       Section        01d8 \BaseNamedObjects\AsfServ
PerfAPI Global Info ShMem
000004F0 NSUM.exe       Mutant         01dc \BaseNamedObjects\Shared Mutex
for AsfServ Data Collection_0
000004F0 NSUM.exe       Section        01e0 \BaseNamedObjects\AsfServ
Counter Name ShMem
000004F0 NSUM.exe       Section        01e4 \BaseNamedObjects\AsfServ
Counter Help ShMem
000004F0 NSUM.exe       Section        01e8 \BaseNamedObjects\AsfServ
PerfAPI Counter Data ShMem_Windows Media Unicast Service
000004F0 NSUM.exe       Key            0228
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsunicast\Parameters\Virtual
Roots
000004F0 NSUM.exe       Key            022c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsunicast\Parameters
000004F0 NSUM.exe       Key            023c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\AccessLists\AllowUnicastClients
000004F0 NSUM.exe       Key            0240
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\AccessLists\DisallowUnicastClients
000004F0 NSUM.exe       Key            0248
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\AccessLists\AllowDistribution
000004F0 NSUM.exe       Key            0250
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\AccessLists\DisallowDistribution
000004F0 NSUM.exe       File           0278 \Endpoint
000004F0 NSUM.exe       File           0280 \Endpoint
000004F0 NSUM.exe       File           0284 \Endpoint
000004F0 NSUM.exe       File           028c \Endpoint
000004F0 NSUM.exe       File           0290 \Endpoint
000004F0 NSUM.exe       Section        029c \RPC Control\DSEC4f0
000004F0 NSUM.exe       Port           02ac \RPC Control\OLEb
000004F0 NSUM.exe       Key            02b8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\Servers\Default\Event
Notification\ACL Check
000004F0 NSUM.exe       Key            02cc
\REGISTRY\MACHINE\SOFTWARE\Classes
000004F0 NSUM.exe       Key            02d4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004F0 NSUM.exe       Key            02e0 \REGISTRY\USER
000004F0 NSUM.exe       Key            02e4
\REGISTRY\MACHINE\SOFTWARE\Classes
000004F0 NSUM.exe       Key            02f0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004F0 NSUM.exe       Key            02f8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004F0 NSUM.exe       Key            0300
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000004F0 NSUM.exe       Key            0308
\REGISTRY\MACHINE\SOFTWARE\Classes
000004F0 NSUM.exe       Key            0310
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004F0 NSUM.exe       Key            031c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004F0 NSUM.exe       Key            0324
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004F0 NSUM.exe       Key            032c
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000004F0 NSUM.exe       Section        0334
\BaseNamedObjects\__R_000000000013_SMem__
000004F0 NSUM.exe       Key            0338
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000_CLASSES
000004F0 NSUM.exe       Key            033c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\Servers\Default\Authentication\HTTP
BASIC-Membership
000004F0 NSUM.exe       Key            0340
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\Servers\Default\Authentication\HTTP
BASIC-NTLM
000004F0 NSUM.exe       Key            0344
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\Servers\Default\Authentication\NTLM-NTLM
00000548 nspm.exe       Directory      0010 \KnownDlls
00000548 nspm.exe       File           0014 \WINDOWS\system32
00000548 nspm.exe       Key            0018 \REGISTRY\MACHINE
00000548 nspm.exe       Directory      0024 \Windows
00000548 nspm.exe       Mutant         0030 \NlsCacheMutant
00000548 nspm.exe       WindowStation  0044
\Windows\WindowStations\Service-0x0-ce4b$
00000548 nspm.exe       Desktop        0048 \Default
00000548 nspm.exe       WindowStation  004c
\Windows\WindowStations\Service-0x0-ce4b$
00000548 nspm.exe       Directory      0050 \BaseNamedObjects
00000548 nspm.exe       Key            005c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
00000548 nspm.exe       Key            0068
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000\Control
Panel\International
00000548 nspm.exe       File           00c0 \net\NtControlPipe17
00000548 nspm.exe       File           00c4 \svcctl
00000548 nspm.exe       Key            00e8
\REGISTRY\MACHINE\SOFTWARE\Classes
00000548 nspm.exe       Key            00f0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000548 nspm.exe       Key            00fc \REGISTRY\USER
00000548 nspm.exe       Key            0100
\REGISTRY\MACHINE\SOFTWARE\Classes
00000548 nspm.exe       Key            010c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000548 nspm.exe       Key            0114
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000548 nspm.exe       Key            011c
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000548 nspm.exe       Key            0124
\REGISTRY\MACHINE\SOFTWARE\Classes
00000548 nspm.exe       Key            012c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000548 nspm.exe       Key            0138
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000548 nspm.exe       Key            0140
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000548 nspm.exe       Key            0148
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000548 nspm.exe       Section        0150
\BaseNamedObjects\__R_000000000013_SMem__
00000548 nspm.exe       Key            0154
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000_CLASSES
00000548 nspm.exe       Section        0160 \RPC Control\DSEC548
00000548 nspm.exe       Port           0168 \RPC Control\OLEd
00000548 nspm.exe       Key            0198
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000
00000548 nspm.exe       File           019c
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
00000548 nspm.exe       Key            01a0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
00000548 nspm.exe       Key            01a8
\REGISTRY\MACHINE\SOFTWARE\ODBC\Temporary (volatile) Jet DSN for process
0x548 Thread 0x5d0 DBC 0x37684 Jet
00000548 nspm.exe       Key            01c0
\REGISTRY\MACHINE\SOFTWARE\ODBC\Temporary (volatile) Jet DSN for process
0x548 Thread 0x5d0 DBC 0x37684 Jet\Engines\Jet
00000548 nspm.exe       File           01d8
\DOCUME~1\NETSHO~1\LOCALS~1\Temp\JETA66.tmp
00000548 nspm.exe       File           01f8
\DOCUME~1\NETSHO~1\LOCALS~1\Temp\JET1.tmp
00000548 nspm.exe       File           0218 \WINDOWS\system32\Windows
Media\Server\ASDB\mdsas.mdb
00000548 nspm.exe       File           021c \WINDOWS\system32\Windows
Media\Server\ASDB\mdsas.ldb
000005C8 svchost.exe    Directory      0010 \KnownDlls
000005C8 svchost.exe    File           0014 \WINDOWS\system32
000005C8 svchost.exe    Directory      001c \Windows
000005C8 svchost.exe    Mutant         0024 \NlsCacheMutant
000005C8 svchost.exe    Key            002c \REGISTRY\MACHINE
000005C8 svchost.exe    WindowStation  003c \Windows\WindowStations\WinSta0
000005C8 svchost.exe    Desktop        0040 \Default
000005C8 svchost.exe    WindowStation  0044 \Windows\WindowStations\WinSta0
000005C8 svchost.exe    Directory      0048 \BaseNamedObjects
000005C8 svchost.exe    File           008c \net\NtControlPipe18
000005C8 svchost.exe    File           00a0 \svcctl
000005C8 svchost.exe    Event          00b8
\BaseNamedObjects\crypt32LogoffEvent
000005C8 svchost.exe    Event          00e0 \BaseNamedObjects\userenv:  User
Profile setup event
000005C8 svchost.exe    Key            00e4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W3SVC\Parameters
000005C8 svchost.exe    File           014c \SSLFilterChannel
000005C8 svchost.exe    Key            0164
\REGISTRY\MACHINE\SOFTWARE\Classes
000005C8 svchost.exe    Key            016c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000005C8 svchost.exe    Key            0178 \REGISTRY\USER
000005C8 svchost.exe    Key            017c
\REGISTRY\MACHINE\SOFTWARE\Classes
000005C8 svchost.exe    Key            0188
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000005C8 svchost.exe    Key            0190
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000005C8 svchost.exe    Key            0198
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000005C8 svchost.exe    Key            01a0
\REGISTRY\MACHINE\SOFTWARE\Classes
000005C8 svchost.exe    Key            01a8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000005C8 svchost.exe    Key            01b4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000005C8 svchost.exe    Key            01bc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000005C8 svchost.exe    Key            01c4
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000005C8 svchost.exe    Section        01cc
\BaseNamedObjects\__R_000000000013_SMem__
000005C8 svchost.exe    Key            01d0
\REGISTRY\MACHINE\SOFTWARE\Classes
000005C8 svchost.exe    Section        01d4 \RPC Control\DSEC5c8
000005C8 svchost.exe    Port           01e0 \RPC Control\OLEf
000005C8 svchost.exe    Section        0214
\BaseNamedObjects\IISCacheCounters-c205a604-4df5-42b6-8fe9-dbfe18f022a0_1_A
000005C8 svchost.exe    Section        0218
\BaseNamedObjects\IISCounterControlBlock-46382a23-095e-4559-8d63-6fdeaf552c23
000005C8 svchost.exe    Event          0220
\BaseNamedObjects\W3SVCStartW3WP-aae415e7-4598-4294-a382-0a435d5b32c5
000005C8 svchost.exe    Key            0228
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
000005C8 svchost.exe    File           022c
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000005C8 svchost.exe    Key            0230 \REGISTRY\USER\.DEFAULT
000005C8 svchost.exe    Semaphore      0234
\BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
000005C8 svchost.exe    File           0278 \DefaultAppPool
000005C8 svchost.exe    Section        02a4
\BaseNamedObjects\IISCacheCounters-c205a604-4df5-42b6-8fe9-dbfe18f022a0_1_B
000005C8 svchost.exe    Section        02a8
\BaseNamedObjects\IISSitesCounters-99c62c38-377d-4a73-af40-6ea7ed1f5896_1_A
000005C8 svchost.exe    Section        02ac
\BaseNamedObjects\IISSitesCounters-99c62c38-377d-4a73-af40-6ea7ed1f5896_1_B
000005C8 svchost.exe    Event          02b0
\BaseNamedObjects\WASPerfCount-c40da922-9c0a-4def-8aba-cd0bb5f093e1
000005C8 svchost.exe    File           02bc \iisipm
000000F8 explorer.exe   Directory      0010 \KnownDlls
000000F8 explorer.exe   File           0014 \Documents and
Settings\user.XP
000000F8 explorer.exe   Directory      0018 \Windows
000000F8 explorer.exe   Mutant         0024 \NlsCacheMutant
000000F8 explorer.exe   Key            0030 \REGISTRY\MACHINE
000000F8 explorer.exe   WindowStation  003c \Windows\WindowStations\WinSta0
000000F8 explorer.exe   Desktop        0040 \Default
000000F8 explorer.exe   WindowStation  0044 \Windows\WindowStations\WinSta0
000000F8 explorer.exe   Key            0048
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
000000F8 explorer.exe   File           004c
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   Key            0050
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010
000000F8 explorer.exe   Directory      0054 \BaseNamedObjects
000000F8 explorer.exe   Key            0058
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010_CLASSES
000000F8 explorer.exe   File           005c
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   Key            0060
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer
000000F8 explorer.exe   File           0064
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   File           0068
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   Key            006c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows
NT\CurrentVersion\Windows
000000F8 explorer.exe   Mutant         0070
\BaseNamedObjects\ExplorerIsShellMutex
000000F8 explorer.exe   Semaphore      0074
\BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
000000F8 explorer.exe   Semaphore      0080
\BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
000000F8 explorer.exe   Key            0094
\REGISTRY\MACHINE\SOFTWARE\Classes
000000F8 explorer.exe   Key            009c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000000F8 explorer.exe   Key            00a8 \REGISTRY\USER
000000F8 explorer.exe   Key            00ac
\REGISTRY\MACHINE\SOFTWARE\Classes
000000F8 explorer.exe   Key            00b8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000000F8 explorer.exe   Key            00c0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000000F8 explorer.exe   Key            00c8
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000000F8 explorer.exe   Key            00d0
\REGISTRY\MACHINE\SOFTWARE\Classes
000000F8 explorer.exe   Key            00d8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000000F8 explorer.exe   Key            00e4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000000F8 explorer.exe   Key            00ec
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000000F8 explorer.exe   Key            00f4
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000000F8 explorer.exe   Section        00fc
\BaseNamedObjects\__R_000000000013_SMem__
000000F8 explorer.exe   Semaphore      0104
\BaseNamedObjects\shell.{090851A5-EB96-11D2-8BE4-00C04FA31A66}
000000F8 explorer.exe   File           0108
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   Section        0150 \RPC Control\DSECf8
000000F8 explorer.exe   Port           0164 \RPC Control\OLE11
000000F8 explorer.exe   Key            0188
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
000000F8 explorer.exe   File           018c \Documents and Settings\All
Users.WINDOWS\Desktop
000000F8 explorer.exe   Key            0190
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer
000000F8 explorer.exe   Semaphore      0198
\BaseNamedObjects\shell.{7CB834F0-527B-11D2-9D1F-0000F805CA57}
000000F8 explorer.exe   File           01a0 \Documents and
Settings\user.XP\Desktop
000000F8 explorer.exe   Event          01c4 \BaseNamedObjects\userenv:  User
Profile setup event
000000F8 explorer.exe   Key            01c8
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Internet
Explorer\Security\P3Global
000000F8 explorer.exe   Key            01cc
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Internet
Explorer\Security\P3Sites
000000F8 explorer.exe   Key            01d8
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000000F8 explorer.exe   Key            01dc
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\Shell
000000F8 explorer.exe   Key            01e4
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\ShellNoRoam
000000F8 explorer.exe   Key            01e8
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\ShellNoRoam\MUICache
000000F8 explorer.exe   File           01f0 \Documents and Settings\All
Users.WINDOWS\Start Menu
000000F8 explorer.exe   Key            0200
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start
Menu
000000F8 explorer.exe   File           0204 \Documents and
Settings\user.XP\Start Menu
000000F8 explorer.exe   Semaphore      020c
\BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
000000F8 explorer.exe   File           0218 \Documents and
Settings\user.XP\Application Data\Microsoft\Internet Explorer\Quick
Launch
000000F8 explorer.exe   Key            0224
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
000000F8 explorer.exe   Section        022c
\BaseNamedObjects\ShimSharedMemory[S-1-5-21-484763869-113007714-839522115-1010]
000000F8 explorer.exe   Key            0230
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer
000000F8 explorer.exe   Key            023c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
000000F8 explorer.exe   Key            0250
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
000000F8 explorer.exe   File           0258
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   Mutant         025c
\BaseNamedObjects\_!MSFTHISTORY!_
000000F8 explorer.exe   File           0264 \srvsvc
000000F8 explorer.exe   Semaphore      0274
\BaseNamedObjects\PowerProfileRegistrySemaphore
000000F8 explorer.exe   File           02a4 \Documents and
Settings\user.XP\Cookies\index.dat
000000F8 explorer.exe   Key            02a8
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start
Menu\Programs\Accessories
000000F8 explorer.exe   Mutant         02b0 \BaseNamedObjects\_SHuassist.mtx
000000F8 explorer.exe   Section        02b8 \BaseNamedObjects\C:_Documents
and Settings_user.XP_Cookies_index.dat_32768
000000F8 explorer.exe   Mutant         02bc \BaseNamedObjects\c:!documents
and settings!user.xp!local
settings!history!history.ie5!mshist012001052220010523!
000000F8 explorer.exe   File           02d0 \lsarpc
000000F8 explorer.exe   Event          02dc
\BaseNamedObjects\ShellReadyEvent
000000F8 explorer.exe   File           02e0
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   File           02e4
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   Key            02e8
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start
Menu\Programs\Accessories\Entertainment
000000F8 explorer.exe   Mutant         02f0
\BaseNamedObjects\ShimCacheMutex[S-1-5-21-484763869-113007714-839522115-1010]
000000F8 explorer.exe   Key            02f4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
000000F8 explorer.exe   Key            0300
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count
000000F8 explorer.exe   Mutant         0304
\BaseNamedObjects\GuardMutexmmGlobalPnpInfoGuard
000000F8 explorer.exe   Event          0308
\BaseNamedObjects\GuardEventmmGlobalPnpInfoGuard
000000F8 explorer.exe   Semaphore      030c
\BaseNamedObjects\GuardSemmmGlobalPnpInfoGuard
000000F8 explorer.exe   Section        0310
\BaseNamedObjects\mmGlobalPnpInfo
000000F8 explorer.exe   Section        0314
\BaseNamedObjects\WDMAUD_Path_Size
000000F8 explorer.exe   Section        0318
\BaseNamedObjects\WDMAUD_Path_Size
000000F8 explorer.exe   Section        031c
\BaseNamedObjects\WDMAUD_Path_Size
000000F8 explorer.exe   File           0320
\{9B365890-165F-11D0-A195-0020AFD156E4}
000000F8 explorer.exe   Section        0324
\BaseNamedObjects\WDMAUD_Callbacks
000000F8 explorer.exe   Mutant         0328 \BaseNamedObjects\mxrapi
000000F8 explorer.exe   Event          032c \BaseNamedObjects\mixercallback
000000F8 explorer.exe   Key            0330
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#ISAPNP#CTL0070_DEV0000#FFFFFFFF#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#Wave\Device
Parameters\Mixer
000000F8 explorer.exe   Event          0334
\BaseNamedObjects\hardwaremixercallback
000000F8 explorer.exe   Event          0350
\BaseNamedObjects\HPlugEjectEvent
000000F8 explorer.exe   File           0364 \ntsvcs
000000F8 explorer.exe   File           0380 \AudioSrv
000000F8 explorer.exe   File           0388
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   File           038c \wkssvc
000000F8 explorer.exe   File           03c8 \Documents and
Settings\user.XP\PrintHood
000000F8 explorer.exe   Key            03e0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
000000F8 explorer.exe   Key            03e4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
000000F8 explorer.exe   Key            03e8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
000000F8 explorer.exe   Key            03ec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
000000F8 explorer.exe   Key            0414
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FindExtensions\Static\ShellSearch\1
000000F8 explorer.exe   Key            0424
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FindExtensions
000000F8 explorer.exe   File           042c
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   Key            0434
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FindExtensions\Static\ShellSearch\2
000000F8 explorer.exe   Key            0438
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FindExtensions\Static\ShellSearch\1
000000F8 explorer.exe   Key            0444
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FindExtensions\Static\ShellSearch\2
000000F8 explorer.exe   Mutant         0448 \BaseNamedObjects\c:!documents
and settings!user.xp!cookies!
000000F8 explorer.exe   Key            044c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start
Menu\Programs
000000F8 explorer.exe   Event          0450
\BaseNamedObjects\crypt32LogoffEvent
000000F8 explorer.exe   Key            0454
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
000000F8 explorer.exe   Key            046c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Internet
Settings
000000F8 explorer.exe   Mutant         0470 \BaseNamedObjects\c:!documents
and settings!user.xp!local settings!temporary internet files!content.ie5!
000000F8 explorer.exe   Section        0478 \BaseNamedObjects\C:_Documents
and Settings_user.XP_Local Settings_Temporary Internet
Files_Content.IE5_index.dat_278528
000000F8 explorer.exe   File           0488 \Documents and
Settings\user.XP\Local Settings\History\History.IE5\index.dat
000000F8 explorer.exe   File           048c \Documents and
Settings\user.XP\Local Settings\Temporary Internet
Files\Content.IE5\index.dat
000000F8 explorer.exe   Mutant         0498 \BaseNamedObjects\c:!documents
and settings!user.xp!local settings!history!history.ie5!
000000F8 explorer.exe   Mutant         04a0
\BaseNamedObjects\_!SHMSFTHISTORY!_
000000F8 explorer.exe   File           04a4 \Documents and
Settings\user.XP\Local
Settings\History\History.IE5\MSHist012001052220010523\index.dat
000000F8 explorer.exe   Section        04a8 \BaseNamedObjects\C:_Documents
and Settings_user.XP_Local Settings_History_History.IE5_index.dat_98304
000000F8 explorer.exe   Section        04ac \BaseNamedObjects\C:_Documents
and Settings_user.XP_Local
Settings_History_History.IE5_MSHist012001052220010523_index.dat_32768
00000720 idwlog.exe     Directory      0010 \KnownDlls
00000720 idwlog.exe     File           0014 \Documents and
Settings\user.XP
00000720 idwlog.exe     Directory      0024 \Windows
00000720 idwlog.exe     Mutant         0030 \NlsCacheMutant
00000720 idwlog.exe     Key            0038 \REGISTRY\MACHINE
00000720 idwlog.exe     WindowStation  0044 \Windows\WindowStations\WinSta0
00000720 idwlog.exe     Desktop        0048 \Default
00000720 idwlog.exe     WindowStation  004c \Windows\WindowStations\WinSta0
00000720 idwlog.exe     Key            006c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
00000720 idwlog.exe     File           0078 \Idwlog.log
00000720 idwlog.exe     File           007c \WINDOWS\system32
00000720 idwlog.exe     File           0084 \WINDOWS\system32
00000720 idwlog.exe     File           00c4 \ntsvcs
00000720 idwlog.exe     File           00d0 \WINDOWS\system32
00000720 idwlog.exe     Key            00e0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\World
Full Access Shared Parameters
00000720 idwlog.exe     Directory      00ec \BaseNamedObjects
00000720 idwlog.exe     File           00f8 \DAV RPC SERVICE
0000079C svchost.exe    Directory      0010 \KnownDlls
0000079C svchost.exe    File           0014 \WINDOWS\system32
0000079C svchost.exe    Directory      001c \Windows
0000079C svchost.exe    Mutant         0024 \NlsCacheMutant
0000079C svchost.exe    Key            002c \REGISTRY\MACHINE
0000079C svchost.exe    File           0054 \net\NtControlPipe20
0000079C svchost.exe    Directory      0070 \BaseNamedObjects
0000079C svchost.exe    File           0078 \svcctl
0000079C svchost.exe    WindowStation  0088
\Windows\WindowStations\Service-0x0-3e7$
0000079C svchost.exe    Desktop        008c \Default
0000079C svchost.exe    WindowStation  0090
\Windows\WindowStations\Service-0x0-3e7$
0000079C svchost.exe    Key            00c0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\tapisrv
0000079C svchost.exe    Event          00dc
\BaseNamedObjects\SC_AutoStartComplete
0000079C svchost.exe    Section        00e4 \RPC Control\DSEC79c
0000079C svchost.exe    File           010c \tapsrv
0000079C svchost.exe    File           0110 \tapsrv
0000079C svchost.exe    Port           0124 \RPC Control\tapsrvlpc
0000079C svchost.exe    File           01c0 \53cb31a0\UnimodemNotifyTSP
0000079C svchost.exe    Event          01c4
\BaseNamedObjects\--.-mailslot-53cb31a0-UnimodemNotifyTSP
0000079C svchost.exe    File           01dc \ntsvcs
0000079C svchost.exe    Key            0200
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\KMDDSP
0000079C svchost.exe    Key            02b4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\NDPTSP
0000079C svchost.exe    Key            036c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\conftsp
0000079C svchost.exe    Key            03a0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
0000079C svchost.exe    Key            03a8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
0000079C svchost.exe    File           03ac \WINDOWS\system32\h323log.txt
0000079C svchost.exe    Key            03b4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\H323TSP
0000079C svchost.exe    Key            03e8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
0000079C svchost.exe    Event          03ec \BaseNamedObjects\DINPUTWINMM
0000079C svchost.exe    Key            03fc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\hidphone
00000668 svchost.exe    Directory      0010 \KnownDlls
00000668 svchost.exe    File           0014 \WINDOWS\system32
00000668 svchost.exe    Directory      001c \Windows
00000668 svchost.exe    Mutant         0024 \NlsCacheMutant
00000668 svchost.exe    Key            002c \REGISTRY\MACHINE
00000668 svchost.exe    File           0030 \net\NtControlPipe21
00000668 svchost.exe    Directory      0070 \BaseNamedObjects
00000668 svchost.exe    File           0078 \svcctl
00000668 svchost.exe    WindowStation  0088 \Windows\WindowStations\WinSta0
00000668 svchost.exe    Desktop        008c \Default
00000668 svchost.exe    WindowStation  0090 \Windows\WindowStations\WinSta0
00000668 svchost.exe    Event          00b8 \BaseNamedObjects\userenv:  User
Profile setup event
00000668 svchost.exe    Key            00c0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
00000668 svchost.exe    File           00c4
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
00000668 svchost.exe    Key            00c8 \REGISTRY\USER\.DEFAULT
00000668 svchost.exe    File           00fc \WINDOWS\Sti_Trace.log
00000668 svchost.exe    Mutant         0100
\BaseNamedObjects\StiTraceMutexSti_Trace.log
00000668 svchost.exe    Section        010c \RPC Control\DSEC668
00000668 svchost.exe    Port           0110 \RPC Control\OLE14
00000668 svchost.exe    Key            0134
\REGISTRY\MACHINE\SOFTWARE\Classes
00000668 svchost.exe    Key            013c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000668 svchost.exe    Key            0148 \REGISTRY\USER
00000668 svchost.exe    Key            014c
\REGISTRY\MACHINE\SOFTWARE\Classes
00000668 svchost.exe    Key            0158
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000668 svchost.exe    Key            0160
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000668 svchost.exe    Key            0168
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000668 svchost.exe    Key            0170
\REGISTRY\MACHINE\SOFTWARE\Classes
00000668 svchost.exe    Key            0178
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000668 svchost.exe    Key            0184
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000668 svchost.exe    Key            018c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000668 svchost.exe    Key            0194
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000668 svchost.exe    Section        019c
\BaseNamedObjects\__R_000000000013_SMem__
00000668 svchost.exe    Key            01a0
\REGISTRY\MACHINE\SOFTWARE\Classes
00000668 svchost.exe    File           01a4 \WINDOWS\wiaservc.log
00000668 svchost.exe    File           01cc \ntsvcs
00000668 svchost.exe    Semaphore      01ec
\BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
00000668 svchost.exe    Port           0264 \RPC Control\STI_LRPC
00000668 svchost.exe    File           0288 \WINDOWS\Sti_Trace.log
00000668 svchost.exe    Mutant         028c
\BaseNamedObjects\StiTraceMutexSti_Trace.log
00000870 wmiprvse.exe   Directory      0010 \KnownDlls
00000870 wmiprvse.exe   File           0014 \WINDOWS\system32
00000870 wmiprvse.exe   Directory      0024 \Windows
00000870 wmiprvse.exe   Mutant         0030 \NlsCacheMutant
00000870 wmiprvse.exe   Key            0038 \REGISTRY\MACHINE
00000870 wmiprvse.exe   WindowStation  0044
\Windows\WindowStations\Service-0x0-3e7$
00000870 wmiprvse.exe   Desktop        0048 \Default
00000870 wmiprvse.exe   WindowStation  004c
\Windows\WindowStations\Service-0x0-3e7$
00000870 wmiprvse.exe   Directory      0050 \BaseNamedObjects
00000870 wmiprvse.exe   Section        00ac \BaseNamedObjects\Wmi Provider
Sub System Counters
00000870 wmiprvse.exe   Event          00d0
\BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS
00000870 wmiprvse.exe   Event          00ec
\BaseNamedObjects\EVENT_READYROOT/CIMV2PROVIDERSUBSYSTEM
00000870 wmiprvse.exe   Section        00f0 \RPC Control\DSEC870
00000870 wmiprvse.exe   Port           00fc \RPC Control\OLE15
00000870 wmiprvse.exe   Key            011c
\REGISTRY\MACHINE\SOFTWARE\Classes
00000870 wmiprvse.exe   Key            0124
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000870 wmiprvse.exe   Key            0130 \REGISTRY\USER
00000870 wmiprvse.exe   Key            0134
\REGISTRY\MACHINE\SOFTWARE\Classes
00000870 wmiprvse.exe   Key            0140
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000870 wmiprvse.exe   Key            0148
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000870 wmiprvse.exe   Key            0150
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000870 wmiprvse.exe   Key            0158
\REGISTRY\MACHINE\SOFTWARE\Classes
00000870 wmiprvse.exe   Key            0160
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000870 wmiprvse.exe   Key            016c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000870 wmiprvse.exe   Key            0174
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000870 wmiprvse.exe   Key            017c
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000870 wmiprvse.exe   Section        0184
\BaseNamedObjects\__R_000000000013_SMem__
00000870 wmiprvse.exe   Key            0188
\REGISTRY\MACHINE\SOFTWARE\Classes
0000076C wuauclt.exe    Directory      0010 \KnownDlls
0000076C wuauclt.exe    File           0014 \WINDOWS\system32
0000076C wuauclt.exe    File           0018
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
0000076C wuauclt.exe    Directory      0028 \Windows
0000076C wuauclt.exe    Mutant         0034 \NlsCacheMutant
0000076C wuauclt.exe    Key            003c \REGISTRY\MACHINE
0000076C wuauclt.exe    WindowStation  0048 \Windows\WindowStations\WinSta0
0000076C wuauclt.exe    Desktop        004c \Default
0000076C wuauclt.exe    WindowStation  0050 \Windows\WindowStations\WinSta0
0000076C wuauclt.exe    Key            0054
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
0000076C wuauclt.exe    File           0058
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
0000076C wuauclt.exe    Directory      005c \BaseNamedObjects
0000076C wuauclt.exe    Mutant         0064
\BaseNamedObjects\ZonesCounterMutex
0000076C wuauclt.exe    Mutant         0068
\BaseNamedObjects\ZonesCacheCounterMutex
0000076C wuauclt.exe    Key            006c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010_CLASSES
0000076C wuauclt.exe    Key            0070
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010
0000076C wuauclt.exe    Mutant         0078
\BaseNamedObjects\AutoUpdateSingleInstance
0000076C wuauclt.exe    Key            008c
\REGISTRY\MACHINE\SOFTWARE\Classes
0000076C wuauclt.exe    Key            0094
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000076C wuauclt.exe    Key            00a0 \REGISTRY\USER
0000076C wuauclt.exe    Key            00a4
\REGISTRY\MACHINE\SOFTWARE\Classes
0000076C wuauclt.exe    Key            00b0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000076C wuauclt.exe    Key            00b8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000076C wuauclt.exe    Key            00c0
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
0000076C wuauclt.exe    Key            00c8
\REGISTRY\MACHINE\SOFTWARE\Classes
0000076C wuauclt.exe    Key            00d0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000076C wuauclt.exe    Key            00dc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000076C wuauclt.exe    Key            00e4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000076C wuauclt.exe    Key            00ec
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
0000076C wuauclt.exe    Section        00f4
\BaseNamedObjects\__R_000000000013_SMem__
0000076C wuauclt.exe    Section        0134 \RPC Control\DSEC76c
0000076C wuauclt.exe    Port           0148 \RPC Control\OLE16
0000076C wuauclt.exe    File           0188 \lsarpc
0000076C wuauclt.exe    Semaphore      01b8
\BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
0000076C wuauclt.exe    Mutant         01ec \BaseNamedObjects\RasPbFile
0000076C wuauclt.exe    Key            0214
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
0000076C wuauclt.exe    File           0220 \svcctl
0000076C wuauclt.exe    Key            022c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
0000076C wuauclt.exe    Key            0234
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
0000076C wuauclt.exe    File           023c \ROUTER
0000076C wuauclt.exe    Key            0254
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001
0000076C wuauclt.exe    Event          026c \BaseNamedObjects\userenv:  User
Profile setup event
0000076C wuauclt.exe    Key            0290
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
0000076C wuauclt.exe    Key            0294
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
0000076C wuauclt.exe    Key            0298
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
0000076C wuauclt.exe    Key            029c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
00000838 cmd.exe        Directory      0010 \KnownDlls
00000838 cmd.exe        File           0014 \Documents and
Settings\user.XP
00000838 cmd.exe        Directory      0024 \Windows
00000838 cmd.exe        Mutant         0030 \NlsCacheMutant
00000838 cmd.exe        WindowStation  0040 \Windows\WindowStations\WinSta0
00000838 cmd.exe        WindowStation  0044 \Windows\WindowStations\WinSta0
00000838 cmd.exe        Desktop        0048 \Default
00000838 cmd.exe        Key            0050 \REGISTRY\MACHINE
00000838 cmd.exe        Key            0054
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010
00000838 cmd.exe        Key            0058
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale
00000838 cmd.exe        Key            005c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
00000838 cmd.exe        Key            0060
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups
00000838 cmd.exe        File           006c \output\ohall.txt
00000778 oh.exe         File           0014 \Documents and
Settings\user.XP
00000778 oh.exe         File           006c \output\ohall.txt
00000778 oh.exe         WindowStation  07c4 \Windows\WindowStations\WinSta0
00000778 oh.exe         Key            07d0 \REGISTRY\MACHINE
00000778 oh.exe         Mutant         07d4 \NlsCacheMutant
00000778 oh.exe         Directory      07e0 \Windows
00000778 oh.exe         Directory      07f0 \KnownDlls

Example 3: List Handles for Key Objects with Open Windows

To generate a list of key objects and send the output to the file C:\Output\Ohkey.txt, type the following at the command line:

oh /t key /o c:\output\ohkey.txt

Looking in Ohkey.txt, you then see output similar to the following:

00000004 System         Key            000c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\WPA
00000004 System         Key            0010 \REGISTRY
00000004 System         Key            0014
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session
Manager\WPA\SigningHash-PRCRFTFJWDC27Q
00000004 System         Key            0018
\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter
00000004 System         Key            001c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Executive
00000004 System         Key            0020 \REGISTRY\MACHINE\SYSTEM\Setup
00000004 System         Key            0024
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ProductOptions
00000004 System         Key            0028
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Eventlog
00000004 System         Key            0040
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\USB\ROOT_HUB\3&29761208&0\Device
Parameters
00000004 System         Key            0048
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_8086&DEV_7112&SUBSYS_00000000&REV_01\2&ebb567f&0&22\Device
Parameters
00000004 System         Key            004c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_8086&DEV_7112&SUBSYS_00000000&REV_01\2&ebb567f&0&22\Device
Parameters
00000004 System         Key            0050
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0000
00000004 System         Key            0054
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0000
00000004 System         Key            0058
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Video\{67BA24C1-E772-4266-BBE5-D44FE7A9D9A4}\0000\VolatileSettings
00000004 System         Key            005c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0000
00000004 System         Key            006c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Memory
Management\PrefetchParameters
000000C0 smss.exe       Key            0030
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
000000C0 smss.exe       Key            0034
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CrashControl
000000D8 csrss.exe      Key            00a0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\PriorityControl
000000D8 csrss.exe      Key            0650 \REGISTRY\MACHINE
000000D8 csrss.exe      Key            0680
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale
000000D8 csrss.exe      Key            0684
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
000000D8 csrss.exe      Key            0688
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups
000000D8 csrss.exe      Key            0698
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Control
Panel\International
000000D8 csrss.exe      Key            069c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Control
Panel\International
000000E0 winlogon.exe   Key            0030 \REGISTRY\MACHINE
000000E0 winlogon.exe   Key            00b0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
000000E0 winlogon.exe   Key            00b8 \REGISTRY\USER\.DEFAULT
000000E0 winlogon.exe   Key            00dc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\crypt32chain
000000E0 winlogon.exe   Key            00e0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\cryptnet
000000E0 winlogon.exe   Key            00f0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\sclgntfy
000000E0 winlogon.exe   Key            00fc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa
000000E0 winlogon.exe   Key            01d0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
000000E0 winlogon.exe   Key            01e0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
000000E0 winlogon.exe   Key            020c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
000000E0 winlogon.exe   Key            02e0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Credentials
000000E0 winlogon.exe   Key            05f0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#ISAPNP#CTL0070_DEV0000#FFFFFFFF#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#Wave\Device
Parameters\Mixer
000000E0 winlogon.exe   Key            05f8 \REGISTRY\USER
000000E0 winlogon.exe   Key            0650
\REGISTRY\MACHINE\SOFTWARE\Classes
000000E0 winlogon.exe   Key            06c4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
000000E0 winlogon.exe   Key            0774
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\ScCertProp
000000E0 winlogon.exe   Key            0790
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010
000000E0 winlogon.exe   Key            079c
\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache
000000E0 winlogon.exe   Key            07a0
\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam
000000E0 winlogon.exe   Key            0838
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
00000110 services.exe   Key            0038 \REGISTRY\MACHINE
00000110 services.exe   Key            0068
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
00000110 services.exe   Key            006c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale
00000110 services.exe   Key            0070
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups
00000110 services.exe   Key            0074
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum
00000110 services.exe   Key            007c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services
00000110 services.exe   Key            0080
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class
00000110 services.exe   Key            0084
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\PerHwIdStorage
00000110 services.exe   Key            0190
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\Order
00000110 services.exe   Key            01d4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ServiceGroupOrder
00000110 services.exe   Key            031c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent
00000110 services.exe   Key            0348
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Eventlog
00000110 services.exe   Key            036c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName
00000110 services.exe   Key            042c \REGISTRY\USER
00000110 services.exe   Key            0430 \REGISTRY\USER\S-1-5-20
00000110 services.exe   Key            0454 \REGISTRY\USER\S-1-5-19
00000110 services.exe   Key            04c0 \REGISTRY\USER\S-1-5-20
00000110 services.exe   Key            051c \REGISTRY\USER\S-1-5-20
00000110 services.exe   Key            0544
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
00000110 services.exe   Key            055c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000
00000110 services.exe   Key            0570
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000
00000110 services.exe   Key            05c4 \REGISTRY\USER\S-1-5-19
00000110 services.exe   Key            0614
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000
00000110 services.exe   Key            0640
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000
0000011C lsass.exe      Key            0038 \REGISTRY\MACHINE
0000011C lsass.exe      Key            0060
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
0000011C lsass.exe      Key            0084
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll
0000011C lsass.exe      Key            0088
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll
0000011C lsass.exe      Key            008c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll
0000011C lsass.exe      Key            00a8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa
0000011C lsass.exe      Key            00dc \REGISTRY\MACHINE\SECURITY
0000011C lsass.exe      Key            00e0 \REGISTRY\MACHINE\SECURITY\RXACT
0000011C lsass.exe      Key            0110
\REGISTRY\MACHINE\SECURITY\Policy
0000011C lsass.exe      Key            0130
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Kerberos
0000011C lsass.exe      Key            0164
\REGISTRY\MACHINE\SECURITY\Policy
0000011C lsass.exe      Key            016c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Kerberos\SidCache
0000011C lsass.exe      Key            017c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Kerberos\Domains
0000011C lsass.exe      Key            018c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
0000011C lsass.exe      Key            0194
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
0000011C lsass.exe      Key            01a4
\REGISTRY\MACHINE\SECURITY\Policy
0000011C lsass.exe      Key            01b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa
0000011C lsass.exe      Key            01b8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\MSV1_0
0000011C lsass.exe      Key            02a0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb
0000011C lsass.exe      Key            0384 \REGISTRY\MACHINE\SAM\SAM
0000011C lsass.exe      Key            0388 \REGISTRY\MACHINE\SAM\SAM\RXACT
0000011C lsass.exe      Key            038c
\REGISTRY\MACHINE\SAM\SAM\Domains\Builtin
0000011C lsass.exe      Key            0390
\REGISTRY\MACHINE\SAM\SAM\Domains\Account
0000011C lsass.exe      Key            03e4 \REGISTRY\USER\S-1-5-20
0000011C lsass.exe      Key            03f0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
0000011C lsass.exe      Key            03f8 \REGISTRY\USER
0000011C lsass.exe      Key            04a0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
0000011C lsass.exe      Key            04a4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
0000011C lsass.exe      Key            04a8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
0000011C lsass.exe      Key            04ac
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
000001A0 svchost.exe    Key            002c \REGISTRY\MACHINE
000001A0 svchost.exe    Key            00b0
\REGISTRY\MACHINE\SOFTWARE\Classes
000001A0 svchost.exe    Key            00c8
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000001A0 svchost.exe    Key            00d0
\REGISTRY\MACHINE\SOFTWARE\Classes\AppID
000001A0 svchost.exe    Key            00f4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Ole
000001A0 svchost.exe    Key            0120
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000001A0 svchost.exe    Key            0128
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000001A0 svchost.exe    Key            0190
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
000001A0 svchost.exe    Key            01b0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
000001A0 svchost.exe    Key            01b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
000001A0 svchost.exe    Key            01b8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
000001A0 svchost.exe    Key            0214
\REGISTRY\MACHINE\SOFTWARE\Classes
000001A0 svchost.exe    Key            021c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000001A0 svchost.exe    Key            0228 \REGISTRY\USER
000001A0 svchost.exe    Key            022c
\REGISTRY\MACHINE\SOFTWARE\Classes
000001A0 svchost.exe    Key            0238
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000001A0 svchost.exe    Key            0240
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000001A0 svchost.exe    Key            0248
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000001A0 svchost.exe    Key            0250
\REGISTRY\MACHINE\SOFTWARE\Classes
000001A0 svchost.exe    Key            0258
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000001A0 svchost.exe    Key            0264
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000001A0 svchost.exe    Key            026c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000001A0 svchost.exe    Key            0274
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000001BC svchost.exe    Key            002c \REGISTRY\MACHINE
000001BC svchost.exe    Key            00ec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\Licensing
Core
000001BC svchost.exe    Key            0108
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters
000001BC svchost.exe    Key            0180
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000001BC svchost.exe    Key            0188
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000001BC svchost.exe    Key            0260
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Terminal Server
000001BC svchost.exe    Key            0274
\REGISTRY\MACHINE\SOFTWARE\Policies
000001BC svchost.exe    Key            02fc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\AddIns
000001BC svchost.exe    Key            0364 \REGISTRY\USER
00000200 svchost.exe    Key            002c \REGISTRY\MACHINE
00000200 svchost.exe    Key            00a8 \REGISTRY\USER\.DEFAULT
00000200 svchost.exe    Key            00b8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
00000200 svchost.exe    Key            0108
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
00000200 svchost.exe    Key            010c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
00000200 svchost.exe    Key            0110
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
00000200 svchost.exe    Key            0114
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
00000200 svchost.exe    Key            012c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
00000200 svchost.exe    Key            0134
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
00000200 svchost.exe    Key            0140
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Dhcp\Parameters
00000200 svchost.exe    Key            0144
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
00000200 svchost.exe    Key            0148
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Dhcp\Parameters\Options
00000200 svchost.exe    Key            014c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services
00000200 svchost.exe    Key            0178
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DNSRegisteredAdapters
00000200 svchost.exe    Key            0194
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{81A3AA37-6FFD-4907-99BB-47F19F605A44}
00000200 svchost.exe    Key            01f8
\REGISTRY\MACHINE\SOFTWARE\Classes
00000200 svchost.exe    Key            0200
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000200 svchost.exe    Key            020c \REGISTRY\USER
00000200 svchost.exe    Key            0210
\REGISTRY\MACHINE\SOFTWARE\Classes
00000200 svchost.exe    Key            021c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000200 svchost.exe    Key            0224
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000200 svchost.exe    Key            022c
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000200 svchost.exe    Key            0234
\REGISTRY\MACHINE\SOFTWARE\Classes
00000200 svchost.exe    Key            023c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000200 svchost.exe    Key            0248
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000200 svchost.exe    Key            0250
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000200 svchost.exe    Key            0258
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000200 svchost.exe    Key            0268
\REGISTRY\MACHINE\SOFTWARE\Classes
00000200 svchost.exe    Key            0478
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lanmanworkstation\parameters
00000200 svchost.exe    Key            0570
\REGISTRY\MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting
00000200 svchost.exe    Key            0630
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\parameters
00000200 svchost.exe    Key            0710
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}
00000200 svchost.exe    Key            0740
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\EventClasses
00000200 svchost.exe    Key            0860
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\EAPOL
00000200 svchost.exe    Key            0868
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions
00000200 svchost.exe    Key            08f0
\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet
Settings
00000200 svchost.exe    Key            0a4c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Browser\Parameters
00000200 svchost.exe    Key            0a60
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EAPOL\Parameters\General\Global
00000200 svchost.exe    Key            0a94
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASTLS
00000200 svchost.exe    Key            0aa4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASCHAP
00000200 svchost.exe    Key            0abc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EAPOL\Parameters\Interfaces
00000200 svchost.exe    Key            0b98
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Network\Location Awareness
00000200 svchost.exe    Key            0bc0
\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows
NT\CurrentVersion\Network\Location Awareness
00000200 svchost.exe    Key            0bc4
\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows
NT\CurrentVersion\Network\Location Awareness
00000200 svchost.exe    Key            0bc8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
00000200 svchost.exe    Key            0be8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale
00000200 svchost.exe    Key            0bf8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
00000200 svchost.exe    Key            0c1c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASTAPI
00000200 svchost.exe    Key            0c3c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\tapi32
00000200 svchost.exe    Key            0cb8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASMAN
00000200 svchost.exe    Key            0cd0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\PPP
00000200 svchost.exe    Key            0ce0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\BAP
00000200 svchost.exe    Key            0cec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RasMan\PPP
00000200 svchost.exe    Key            0cfc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASSPAP
00000200 svchost.exe    Key            0d0c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASPAP
00000200 svchost.exe    Key            0d1c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASEAP
00000200 svchost.exe    Key            0d2c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASCCP
00000200 svchost.exe    Key            0d3c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASBACP
00000200 svchost.exe    Key            0d68
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASIPHLP
00000200 svchost.exe    Key            0d80
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups
00000200 svchost.exe    Key            0d90
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASIPCP
00000200 svchost.exe    Key            0e30
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001
00000230 csrss.exe      Key            00c8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\PriorityControl
00000234 winlogon.exe   Key            0030 \REGISTRY\MACHINE
0000025C csrss.exe      Key            00c8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\PriorityControl
00000260 winlogon.exe   Key            0030 \REGISTRY\MACHINE
00000294 svchost.exe    Key            0018 \REGISTRY\MACHINE
00000294 svchost.exe    Key            00b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
00000294 svchost.exe    Key            00b8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
00000294 svchost.exe    Key            00bc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
00000294 svchost.exe    Key            00c0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
00000294 svchost.exe    Key            00d8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
00000294 svchost.exe    Key            00e0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
0000029C svchost.exe    Key            0018 \REGISTRY\MACHINE
0000029C svchost.exe    Key            00b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
0000029C svchost.exe    Key            00b8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
0000029C svchost.exe    Key            00bc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
0000029C svchost.exe    Key            00c0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
0000029C svchost.exe    Key            00f0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
0000029C svchost.exe    Key            00f8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
0000029C svchost.exe    Key            01e8
\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet
Settings
0000029C svchost.exe    Key            01f0 \REGISTRY\USER\S-1-5-19
0000029C svchost.exe    Key            0214
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
0000029C svchost.exe    Key            02f8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
0000029C svchost.exe    Key            0310 \REGISTRY\USER
0000029C svchost.exe    Key            0314
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010
0000029C svchost.exe    Key            0318
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001
000002D8 spoolsv.exe    Key            0030 \REGISTRY\MACHINE
000002D8 spoolsv.exe    Key            0190
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print
000002D8 spoolsv.exe    Key            0194
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Print\Printers
000002D8 spoolsv.exe    Key            01c0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard
TCP/IP Port
000002D8 spoolsv.exe    Key            01c8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000002D8 spoolsv.exe    Key            01d0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000002D8 spoolsv.exe    Key            01ec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001
000002D8 spoolsv.exe    Key            0220
\REGISTRY\MACHINE\SOFTWARE\Classes
000002D8 spoolsv.exe    Key            0228
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002D8 spoolsv.exe    Key            0234 \REGISTRY\USER
000002D8 spoolsv.exe    Key            0238
\REGISTRY\MACHINE\SOFTWARE\Classes
000002D8 spoolsv.exe    Key            0244
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002D8 spoolsv.exe    Key            024c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002D8 spoolsv.exe    Key            0254
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000002D8 spoolsv.exe    Key            025c
\REGISTRY\MACHINE\SOFTWARE\Classes
000002D8 spoolsv.exe    Key            0264
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002D8 spoolsv.exe    Key            0270
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002D8 spoolsv.exe    Key            0278
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002D8 spoolsv.exe    Key            0280
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000002D8 spoolsv.exe    Key            028c
\REGISTRY\MACHINE\SOFTWARE\Classes
000002D8 spoolsv.exe    Key            02e4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
000002D8 spoolsv.exe    Key            02e8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
000002D8 spoolsv.exe    Key            02ec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
000002D8 spoolsv.exe    Key            02f0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
000002D8 spoolsv.exe    Key            0328
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
000002D8 spoolsv.exe    Key            0334 \REGISTRY\USER\.DEFAULT
000002FC msdtc.exe      Key            0038 \REGISTRY\MACHINE
000002FC msdtc.exe      Key            00ac
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
000002FC msdtc.exe      Key            0104
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000002FC msdtc.exe      Key            010c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000002FC msdtc.exe      Key            013c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Tracing\MSDTC\Changed
000002FC msdtc.exe      Key            01b0
\REGISTRY\MACHINE\SOFTWARE\Classes\CID\41b1f46c-db5e-48b5-b9a7-90c0b862411d
000002FC msdtc.exe      Key            01d0
\REGISTRY\MACHINE\SOFTWARE\Classes\SVCID\ced2de40-bff6-11ce-9de8-00aa00a3f464
000002FC msdtc.exe      Key            01d4
\REGISTRY\MACHINE\SOFTWARE\Classes\CID\41b1f46c-db5e-48b5-b9a7-90c0b862411d
000002FC msdtc.exe      Key            01d8
\REGISTRY\MACHINE\SOFTWARE\Classes\SVCID\ced2de40-bff6-11ce-9de8-00aa00a3f464
000002FC msdtc.exe      Key            01dc
\REGISTRY\MACHINE\SOFTWARE\Classes\CID\41b1f46c-db5e-48b5-b9a7-90c0b862411d
000002FC msdtc.exe      Key            01e0
\REGISTRY\MACHINE\SOFTWARE\Classes\SVCID\ced2de40-bff6-11ce-9de8-00aa00a3f464
000002FC msdtc.exe      Key            0208
\REGISTRY\MACHINE\SOFTWARE\Classes
000002FC msdtc.exe      Key            0210
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002FC msdtc.exe      Key            021c \REGISTRY\USER
000002FC msdtc.exe      Key            0220
\REGISTRY\MACHINE\SOFTWARE\Classes
000002FC msdtc.exe      Key            022c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002FC msdtc.exe      Key            0234
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002FC msdtc.exe      Key            023c
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000002FC msdtc.exe      Key            0244
\REGISTRY\MACHINE\SOFTWARE\Classes
000002FC msdtc.exe      Key            024c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002FC msdtc.exe      Key            0258
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002FC msdtc.exe      Key            0260
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000002FC msdtc.exe      Key            0268
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000002FC msdtc.exe      Key            0274 \REGISTRY\USER\S-1-5-20_CLASSES
000003B8 inetinfo.exe   Key            0030 \REGISTRY\MACHINE
000003B8 inetinfo.exe   Key            00cc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
000003B8 inetinfo.exe   Key            00d4 \REGISTRY\USER\.DEFAULT
000003B8 inetinfo.exe   Key            0124
\REGISTRY\MACHINE\SOFTWARE\Classes
000003B8 inetinfo.exe   Key            012c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000003B8 inetinfo.exe   Key            0138 \REGISTRY\USER
000003B8 inetinfo.exe   Key            013c
\REGISTRY\MACHINE\SOFTWARE\Classes
000003B8 inetinfo.exe   Key            0148
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000003B8 inetinfo.exe   Key            0150
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000003B8 inetinfo.exe   Key            0158
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000003B8 inetinfo.exe   Key            0160
\REGISTRY\MACHINE\SOFTWARE\Classes
000003B8 inetinfo.exe   Key            0168
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000003B8 inetinfo.exe   Key            0174
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000003B8 inetinfo.exe   Key            017c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000003B8 inetinfo.exe   Key            0184
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000003B8 inetinfo.exe   Key            0228
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W3SVC\Parameters
000003B8 inetinfo.exe   Key            0350
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000003B8 inetinfo.exe   Key            0358
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000003B8 inetinfo.exe   Key            065c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\MosTrace\CurrentVersion\DebugAsyncTrace
000003B8 inetinfo.exe   Key            0674
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\InetInfo\Parameters
000003B8 inetinfo.exe   Key            06c0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip
000003B8 inetinfo.exe   Key            06dc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSFtpsvc\Parameters
000003B8 inetinfo.exe   Key            0860
\REGISTRY\MACHINE\SOFTWARE\Classes
000003B8 inetinfo.exe   Key            0978
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NntpSvc\Parameters
000003B8 inetinfo.exe   Key            09dc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ContentIndex
000003B8 inetinfo.exe   Key            0bb8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\InetInfo\Parameters
000003B8 inetinfo.exe   Key            0bc8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W3SVC\Parameters
000003CC llssrv.exe     Key            0038 \REGISTRY\MACHINE
000003CC llssrv.exe     Key            0120
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000003CC llssrv.exe     Key            0128
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000003A8 NSPMON.exe     Key            0018 \REGISTRY\MACHINE
000003A8 NSPMON.exe     Key            005c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000003A8 NSPMON.exe     Key            0064
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
0000041C NSCM.exe       Key            0018 \REGISTRY\MACHINE
0000041C NSCM.exe       Key            0058
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
0000041C NSCM.exe       Key            005c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
0000041C NSCM.exe       Key            00ac
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsstation\Performance
0000041C NSCM.exe       Key            00b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ASP\Performance
0000041C NSCM.exe       Key            00bc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ContentFilter\Performance
0000041C NSCM.exe       Key            00c4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ContentIndex\Performance
0000041C NSCM.exe       Key            00cc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\InetInfo\Performance
0000041C NSCM.exe       Key            00d4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ISAPISearch\Performance
0000041C NSCM.exe       Key            00dc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC\Performance
0000041C NSCM.exe       Key            00e4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSFtpsvc\Performance
0000041C NSCM.exe       Key            00ec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NntpSvc\Performance
0000041C NSCM.exe       Key            00f4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsstation\Performance
0000041C NSCM.exe       Key            00fc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsunicast\Performance
0000041C NSCM.exe       Key            0104
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NTFSDRV\Performance
0000041C NSCM.exe       Key            010c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfDisk\Performance
0000041C NSCM.exe       Key            0114
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfNet\Performance
0000041C NSCM.exe       Key            011c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfOS\Performance
0000041C NSCM.exe       Key            0124
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfProc\Performance
0000041C NSCM.exe       Key            012c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess\Performance
0000041C NSCM.exe       Key            0134
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RSVP\Performance
0000041C NSCM.exe       Key            013c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMTPSVC\Performance
0000041C NSCM.exe       Key            0144
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Spooler\Performance
0000041C NSCM.exe       Key            014c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TapiSrv\Performance
0000041C NSCM.exe       Key            0154
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Performance
0000041C NSCM.exe       Key            015c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Performance
0000041C NSCM.exe       Key            0164
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W3SVC\Performance
0000041C NSCM.exe       Key            016c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmiApRpl\Performance
0000041C NSCM.exe       Key            019c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
0000041C NSCM.exe       Key            01a4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
0000041C NSCM.exe       Key            01b0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsstation
0000041C NSCM.exe       Key            01b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsstation\Parameters
0000041C NSCM.exe       Key            01c4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\AccessLists\AllowDistribution
0000041C NSCM.exe       Key            01cc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\AccessLists\DisallowDistribution
0000041C NSCM.exe       Key            0218
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsstation\Stations
0000041C NSCM.exe       Key            0278
\REGISTRY\MACHINE\SOFTWARE\Classes
0000041C NSCM.exe       Key            0280
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000041C NSCM.exe       Key            028c \REGISTRY\USER
0000041C NSCM.exe       Key            0290
\REGISTRY\MACHINE\SOFTWARE\Classes
0000041C NSCM.exe       Key            029c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000041C NSCM.exe       Key            02a4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000041C NSCM.exe       Key            02ac
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
0000041C NSCM.exe       Key            02b4
\REGISTRY\MACHINE\SOFTWARE\Classes
0000041C NSCM.exe       Key            02bc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000041C NSCM.exe       Key            02c8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000041C NSCM.exe       Key            02d0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000041C NSCM.exe       Key            02d8
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
0000041C NSCM.exe       Key            02e4
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000_CLASSES
0000046C svchost.exe    Key            0018 \REGISTRY\MACHINE
000004C0 svchost.exe    Key            002c \REGISTRY\MACHINE
000004C0 svchost.exe    Key            0124
\REGISTRY\MACHINE\SOFTWARE\Classes
000004C0 svchost.exe    Key            012c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004C0 svchost.exe    Key            0138 \REGISTRY\USER
000004C0 svchost.exe    Key            013c
\REGISTRY\MACHINE\SOFTWARE\Classes
000004C0 svchost.exe    Key            0148
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004C0 svchost.exe    Key            0150
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004C0 svchost.exe    Key            0158
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000004C0 svchost.exe    Key            0160
\REGISTRY\MACHINE\SOFTWARE\Classes
000004C0 svchost.exe    Key            0168
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004C0 svchost.exe    Key            0174
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004C0 svchost.exe    Key            017c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004C0 svchost.exe    Key            0184
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000004C0 svchost.exe    Key            0190
\REGISTRY\MACHINE\SOFTWARE\Classes
000004C0 svchost.exe    Key            0214
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
000004C0 svchost.exe    Key            021c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale
000004C0 svchost.exe    Key            0220
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups
000004C0 svchost.exe    Key            027c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM
000003DC dfssvc.exe     Key            0030 \REGISTRY\MACHINE
000004F0 NSUM.exe       Key            001c \REGISTRY\MACHINE
000004F0 NSUM.exe       Key            0058
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
000004F0 NSUM.exe       Key            005c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
000004F0 NSUM.exe       Key            00ac
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsunicast\Performance
000004F0 NSUM.exe       Key            00b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ASP\Performance
000004F0 NSUM.exe       Key            00bc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ContentFilter\Performance
000004F0 NSUM.exe       Key            00c4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ContentIndex\Performance
000004F0 NSUM.exe       Key            00cc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\InetInfo\Performance
000004F0 NSUM.exe       Key            00d4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ISAPISearch\Performance
000004F0 NSUM.exe       Key            00dc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC\Performance
000004F0 NSUM.exe       Key            00e4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSFtpsvc\Performance
000004F0 NSUM.exe       Key            00ec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NntpSvc\Performance
000004F0 NSUM.exe       Key            00f4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsstation\Performance
000004F0 NSUM.exe       Key            00fc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsunicast\Performance
000004F0 NSUM.exe       Key            0104
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NTFSDRV\Performance
000004F0 NSUM.exe       Key            010c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfDisk\Performance
000004F0 NSUM.exe       Key            0114
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfNet\Performance
000004F0 NSUM.exe       Key            011c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfOS\Performance
000004F0 NSUM.exe       Key            0124
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfProc\Performance
000004F0 NSUM.exe       Key            012c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess\Performance
000004F0 NSUM.exe       Key            0134
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RSVP\Performance
000004F0 NSUM.exe       Key            013c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMTPSVC\Performance
000004F0 NSUM.exe       Key            0144
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Spooler\Performance
000004F0 NSUM.exe       Key            014c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TapiSrv\Performance
000004F0 NSUM.exe       Key            0154
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Performance
000004F0 NSUM.exe       Key            015c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Performance
000004F0 NSUM.exe       Key            0164
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W3SVC\Performance
000004F0 NSUM.exe       Key            016c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmiApRpl\Performance
000004F0 NSUM.exe       Key            0180
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
000004F0 NSUM.exe       Key            01c4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
000004F0 NSUM.exe       Key            01d0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
000004F0 NSUM.exe       Key            0228
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsunicast\Parameters\Virtual
Roots
000004F0 NSUM.exe       Key            022c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsunicast\Parameters
000004F0 NSUM.exe       Key            023c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\AccessLists\AllowUnicastClients
000004F0 NSUM.exe       Key            0240
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\AccessLists\DisallowUnicastClients
000004F0 NSUM.exe       Key            0248
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\AccessLists\AllowDistribution
000004F0 NSUM.exe       Key            0250
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\AccessLists\DisallowDistribution
000004F0 NSUM.exe       Key            02b8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\Servers\Default\Event
Notification\ACL Check
000004F0 NSUM.exe       Key            02cc
\REGISTRY\MACHINE\SOFTWARE\Classes
000004F0 NSUM.exe       Key            02d4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004F0 NSUM.exe       Key            02e0 \REGISTRY\USER
000004F0 NSUM.exe       Key            02e4
\REGISTRY\MACHINE\SOFTWARE\Classes
000004F0 NSUM.exe       Key            02f0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004F0 NSUM.exe       Key            02f8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004F0 NSUM.exe       Key            0300
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000004F0 NSUM.exe       Key            0308
\REGISTRY\MACHINE\SOFTWARE\Classes
000004F0 NSUM.exe       Key            0310
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004F0 NSUM.exe       Key            031c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004F0 NSUM.exe       Key            0324
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000004F0 NSUM.exe       Key            032c
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000004F0 NSUM.exe       Key            0338
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000_CLASSES
000004F0 NSUM.exe       Key            033c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\Servers\Default\Authentication\HTTP
BASIC-Membership
000004F0 NSUM.exe       Key            0340
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\Servers\Default\Authentication\HTTP
BASIC-NTLM
000004F0 NSUM.exe       Key            0344
\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetShow\Servers\Default\Authentication\NTLM-NTLM
00000548 nspm.exe       Key            0018 \REGISTRY\MACHINE
00000548 nspm.exe       Key            005c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
00000548 nspm.exe       Key            0068
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000\Control
Panel\International
00000548 nspm.exe       Key            00e8
\REGISTRY\MACHINE\SOFTWARE\Classes
00000548 nspm.exe       Key            00f0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000548 nspm.exe       Key            00fc \REGISTRY\USER
00000548 nspm.exe       Key            0100
\REGISTRY\MACHINE\SOFTWARE\Classes
00000548 nspm.exe       Key            010c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000548 nspm.exe       Key            0114
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000548 nspm.exe       Key            011c
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000548 nspm.exe       Key            0124
\REGISTRY\MACHINE\SOFTWARE\Classes
00000548 nspm.exe       Key            012c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000548 nspm.exe       Key            0138
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000548 nspm.exe       Key            0140
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000548 nspm.exe       Key            0148
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000548 nspm.exe       Key            0154
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000_CLASSES
00000548 nspm.exe       Key            0198
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1000
00000548 nspm.exe       Key            01a0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
00000548 nspm.exe       Key            01a8
\REGISTRY\MACHINE\SOFTWARE\ODBC\Temporary (volatile) Jet DSN for process
0x548 Thread 0x5d0 DBC 0x37684 Jet
00000548 nspm.exe       Key            01c0
\REGISTRY\MACHINE\SOFTWARE\ODBC\Temporary (volatile) Jet DSN for process
0x548 Thread 0x5d0 DBC 0x37684 Jet\Engines\Jet
000005C8 svchost.exe    Key            002c \REGISTRY\MACHINE
000005C8 svchost.exe    Key            00e4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W3SVC\Parameters
000005C8 svchost.exe    Key            0164
\REGISTRY\MACHINE\SOFTWARE\Classes
000005C8 svchost.exe    Key            016c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000005C8 svchost.exe    Key            0178 \REGISTRY\USER
000005C8 svchost.exe    Key            017c
\REGISTRY\MACHINE\SOFTWARE\Classes
000005C8 svchost.exe    Key            0188
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000005C8 svchost.exe    Key            0190
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000005C8 svchost.exe    Key            0198
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000005C8 svchost.exe    Key            01a0
\REGISTRY\MACHINE\SOFTWARE\Classes
000005C8 svchost.exe    Key            01a8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000005C8 svchost.exe    Key            01b4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000005C8 svchost.exe    Key            01bc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000005C8 svchost.exe    Key            01c4
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000005C8 svchost.exe    Key            01d0
\REGISTRY\MACHINE\SOFTWARE\Classes
000005C8 svchost.exe    Key            0228
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
000005C8 svchost.exe    Key            0230 \REGISTRY\USER\.DEFAULT
000000F8 explorer.exe   Key            0030 \REGISTRY\MACHINE
000000F8 explorer.exe   Key            0048
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
000000F8 explorer.exe   Key            0050
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010
000000F8 explorer.exe   Key            0058
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010_CLASSES
000000F8 explorer.exe   Key            0060
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer
000000F8 explorer.exe   Key            006c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\World
Full Access Shared Parameters
000000F8 explorer.exe   Key            0094
\REGISTRY\MACHINE\SOFTWARE\Classes
000000F8 explorer.exe   Key            009c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000000F8 explorer.exe   Key            00a8 \REGISTRY\USER
000000F8 explorer.exe   Key            00ac
\REGISTRY\MACHINE\SOFTWARE\Classes
000000F8 explorer.exe   Key            00b8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000000F8 explorer.exe   Key            00c0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000000F8 explorer.exe   Key            00c8
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000000F8 explorer.exe   Key            00d0
\REGISTRY\MACHINE\SOFTWARE\Classes
000000F8 explorer.exe   Key            00d8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000000F8 explorer.exe   Key            00e4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000000F8 explorer.exe   Key            00ec
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000000F8 explorer.exe   Key            00f4
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000000F8 explorer.exe   Key            0188
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
000000F8 explorer.exe   Key            0190
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer
000000F8 explorer.exe   Key            01c8
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Internet
Explorer\Security\P3Global
000000F8 explorer.exe   Key            01cc
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Internet
Explorer\Security\P3Sites
000000F8 explorer.exe   Key            01d8
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000000F8 explorer.exe   Key            01dc
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\Shell
000000F8 explorer.exe   Key            01e4
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\ShellNoRoam
000000F8 explorer.exe   Key            01e8
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\ShellNoRoam\MUICache
000000F8 explorer.exe   Key            0200
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start
Menu
000000F8 explorer.exe   Key            0210
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Internet
Explorer\Security\P3Global
000000F8 explorer.exe   Key            0224
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
000000F8 explorer.exe   Key            0230
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer
000000F8 explorer.exe   Key            023c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
000000F8 explorer.exe   Key            0250
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
000000F8 explorer.exe   Key            02a8
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start
Menu\Programs\Accessories
000000F8 explorer.exe   Key            02e8
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start
Menu\Programs\Accessories\Entertainment
000000F8 explorer.exe   Key            02f4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
000000F8 explorer.exe   Key            0300
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count
000000F8 explorer.exe   Key            0330
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#ISAPNP#CTL0070_DEV0000#FFFFFFFF#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#Wave\Device
Parameters\Mixer
000000F8 explorer.exe   Key            036c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
000000F8 explorer.exe   Key            038c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap
000000F8 explorer.exe   Key            03e0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
000000F8 explorer.exe   Key            03e4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
000000F8 explorer.exe   Key            03e8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
000000F8 explorer.exe   Key            03ec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
000000F8 explorer.exe   Key            0404
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Internet
Explorer\Security\P3Sites
000000F8 explorer.exe   Key            0414
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FindExtensions\Static\ShellSearch\1
000000F8 explorer.exe   Key            0424
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FindExtensions
000000F8 explorer.exe   Key            0434
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FindExtensions\Static\ShellSearch\2
000000F8 explorer.exe   Key            0438
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FindExtensions\Static\ShellSearch\1
000000F8 explorer.exe   Key            0444
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FindExtensions\Static\ShellSearch\2
000000F8 explorer.exe   Key            044c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start
Menu\Programs
000000F8 explorer.exe   Key            0454
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
000000F8 explorer.exe   Key            0460
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Internet
Explorer\TypedURLs
000000F8 explorer.exe   Key            046c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Internet
Settings
000000F8 explorer.exe   Key            0474
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\Shell
000000F8 explorer.exe   Key            04c4
\REGISTRY\MACHINE\SOFTWARE\Classes
00000720 idwlog.exe     Key            0038 \REGISTRY\MACHINE
00000720 idwlog.exe     Key            006c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
00000720 idwlog.exe     Key            00e0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\World
Full Access Shared Parameters
0000079C svchost.exe    Key            002c \REGISTRY\MACHINE
0000079C svchost.exe    Key            00c0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\tapisrv
0000079C svchost.exe    Key            0200
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\KMDDSP
0000079C svchost.exe    Key            02b4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\NDPTSP
0000079C svchost.exe    Key            036c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\conftsp
0000079C svchost.exe    Key            03a0
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
0000079C svchost.exe    Key            03a8
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
0000079C svchost.exe    Key            03b4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\H323TSP
0000079C svchost.exe    Key            03e8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
0000079C svchost.exe    Key            03fc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\hidphone
00000668 svchost.exe    Key            002c \REGISTRY\MACHINE
00000668 svchost.exe    Key            00c0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
00000668 svchost.exe    Key            00c8 \REGISTRY\USER\.DEFAULT
00000668 svchost.exe    Key            0134
\REGISTRY\MACHINE\SOFTWARE\Classes
00000668 svchost.exe    Key            013c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000668 svchost.exe    Key            0148 \REGISTRY\USER
00000668 svchost.exe    Key            014c
\REGISTRY\MACHINE\SOFTWARE\Classes
00000668 svchost.exe    Key            0158
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000668 svchost.exe    Key            0160
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000668 svchost.exe    Key            0168
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000668 svchost.exe    Key            0170
\REGISTRY\MACHINE\SOFTWARE\Classes
00000668 svchost.exe    Key            0178
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000668 svchost.exe    Key            0184
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000668 svchost.exe    Key            018c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000668 svchost.exe    Key            0194
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000668 svchost.exe    Key            01a0
\REGISTRY\MACHINE\SOFTWARE\Classes
00000870 wmiprvse.exe   Key            0038 \REGISTRY\MACHINE
00000870 wmiprvse.exe   Key            011c
\REGISTRY\MACHINE\SOFTWARE\Classes
00000870 wmiprvse.exe   Key            0124
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000870 wmiprvse.exe   Key            0130 \REGISTRY\USER
00000870 wmiprvse.exe   Key            0134
\REGISTRY\MACHINE\SOFTWARE\Classes
00000870 wmiprvse.exe   Key            0140
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000870 wmiprvse.exe   Key            0148
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000870 wmiprvse.exe   Key            0150
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000870 wmiprvse.exe   Key            0158
\REGISTRY\MACHINE\SOFTWARE\Classes
00000870 wmiprvse.exe   Key            0160
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000870 wmiprvse.exe   Key            016c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000870 wmiprvse.exe   Key            0174
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000870 wmiprvse.exe   Key            017c
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000870 wmiprvse.exe   Key            0188
\REGISTRY\MACHINE\SOFTWARE\Classes
0000076C wuauclt.exe    Key            003c \REGISTRY\MACHINE
0000076C wuauclt.exe    Key            0054
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
0000076C wuauclt.exe    Key            006c
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010_CLASSES
0000076C wuauclt.exe    Key            0070
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010
0000076C wuauclt.exe    Key            008c
\REGISTRY\MACHINE\SOFTWARE\Classes
0000076C wuauclt.exe    Key            0094
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000076C wuauclt.exe    Key            00a0 \REGISTRY\USER
0000076C wuauclt.exe    Key            00a4
\REGISTRY\MACHINE\SOFTWARE\Classes
0000076C wuauclt.exe    Key            00b0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000076C wuauclt.exe    Key            00b8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000076C wuauclt.exe    Key            00c0
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
0000076C wuauclt.exe    Key            00c8
\REGISTRY\MACHINE\SOFTWARE\Classes
0000076C wuauclt.exe    Key            00d0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000076C wuauclt.exe    Key            00dc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000076C wuauclt.exe    Key            00e4
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
0000076C wuauclt.exe    Key            00ec
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
0000076C wuauclt.exe    Key            0214
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
0000076C wuauclt.exe    Key            022c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
0000076C wuauclt.exe    Key            0234
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
0000076C wuauclt.exe    Key            0254
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001
0000076C wuauclt.exe    Key            0290
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage
0000076C wuauclt.exe    Key            0294
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
0000076C wuauclt.exe    Key            0298
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
0000076C wuauclt.exe    Key            029c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
00000838 cmd.exe        Key            0050 \REGISTRY\MACHINE
00000838 cmd.exe        Key            0054
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010
00000838 cmd.exe        Key            0058
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale
00000838 cmd.exe        Key            005c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
00000838 cmd.exe        Key            0060
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups
0000071C notepad.exe    Key            004c \REGISTRY\MACHINE
0000071C notepad.exe    Key            0054
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
0000071C notepad.exe    Key            0058
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010
0000071C notepad.exe    Key            0064
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010_CLASSES
0000071C notepad.exe    Key            0094 \REGISTRY\USER
0000071C notepad.exe    Key            00d0
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer
0000071C notepad.exe    Key            00d4
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
0000071C notepad.exe    Key            01f8
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\Shell
0000071C notepad.exe    Key            01fc
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\ShellNoRoam
0000071C notepad.exe    Key            0200
\REGISTRY\USER\S-1-5-21-484763869-113007714-839522115-1010\Software\Microsoft\Windows\ShellNoRoam\MUICache
000006F0 wmiadap.exe    Key            0038 \REGISTRY\MACHINE
000006F0 wmiadap.exe    Key            005c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
000006F0 wmiadap.exe    Key            0060
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale
000006F0 wmiadap.exe    Key            0064
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups
000006F0 wmiadap.exe    Key            00e0
\REGISTRY\MACHINE\SOFTWARE\Classes
000006F0 wmiadap.exe    Key            00e8
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000006F0 wmiadap.exe    Key            00f4 \REGISTRY\USER
000006F0 wmiadap.exe    Key            00f8
\REGISTRY\MACHINE\SOFTWARE\Classes
000006F0 wmiadap.exe    Key            0104
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000006F0 wmiadap.exe    Key            010c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000006F0 wmiadap.exe    Key            0114
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000006F0 wmiadap.exe    Key            011c
\REGISTRY\MACHINE\SOFTWARE\Classes
000006F0 wmiadap.exe    Key            0124
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000006F0 wmiadap.exe    Key            0130
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000006F0 wmiadap.exe    Key            0138
\REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
000006F0 wmiadap.exe    Key            0140
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
000006F0 wmiadap.exe    Key            014c
\REGISTRY\MACHINE\SOFTWARE\Classes
000006F0 wmiadap.exe    Key            018c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
000006F0 wmiadap.exe    Key            019c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
000006F0 wmiadap.exe    Key            01ac
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services
000006F0 wmiadap.exe    Key            01b4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ASP\Performance
000006F0 wmiadap.exe    Key            01bc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ContentFilter\Performance
000006F0 wmiadap.exe    Key            01c4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ContentIndex\Performance
000006F0 wmiadap.exe    Key            01cc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\InetInfo\Performance
000006F0 wmiadap.exe    Key            01d4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ISAPISearch\Performance
000006F0 wmiadap.exe    Key            01dc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC\Performance
000006F0 wmiadap.exe    Key            01e4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSFtpsvc\Performance
000006F0 wmiadap.exe    Key            01ec
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NntpSvc\Performance
000006F0 wmiadap.exe    Key            01f4
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsstation\Performance
000006F0 wmiadap.exe    Key            01fc
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nsunicast\Performance
000006F0 wmiadap.exe    Key            0204
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NTFSDRV\Performance
000006F0 wmiadap.exe    Key            020c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfDisk\Performance
000006F0 wmiadap.exe    Key            0214
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfNet\Performance
000006F0 wmiadap.exe    Key            021c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfOS\Performance
000006F0 wmiadap.exe    Key            0224
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PerfProc\Performance
000006F0 wmiadap.exe    Key            022c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess\Performance
000006F0 wmiadap.exe    Key            0234
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RSVP\Performance
000006F0 wmiadap.exe    Key            023c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMTPSVC\Performance
000006F0 wmiadap.exe    Key            0244
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Spooler\Performance
000006F0 wmiadap.exe    Key            024c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TapiSrv\Performance
000006F0 wmiadap.exe    Key            0254
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Performance
000006F0 wmiadap.exe    Key            025c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Performance
000006F0 wmiadap.exe    Key            0264
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W3SVC\Performance
000006F0 wmiadap.exe    Key            026c
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmiApRpl\Performance
00000758 oh.exe         Key            07d0 \REGISTRY\MACHINE

Example 4: List Handles for File Objects with Open Windows

To generate a list of file objects and send the output to the file C:\Output\Ohfile.txt, type the following at the command line:

oh /t file /o c:\output\ohfile.txt

Looking in Ohfile.txt, you then see output similar to the following:

00000004 System         File           0034
\WINDOWS\system32\config\software
00000004 System         File           0044 \WINDOWS\system32\config\SAM.LOG
00000004 System         File           007c
\WINDOWS\system32\config\SECURITY
00000004 System         File           0084
\WINDOWS\system32\config\default.LOG
00000004 System         File           0088 \WINDOWS\system32\config\SAM
00000004 System         File           0090 \WINDOWS\system32\config\default
00000004 System         File           00a0
\WINDOWS\system32\config\system.LOG
00000004 System         File           00b8
\WINDOWS\system32\config\software.LOG
00000004 System         File           00d8 \pagefile.sys
00000004 System         File           00f4
\WINDOWS\system32\config\SECURITY.LOG
00000004 System         File           01a4 \Documents and
Settings\LocalService.NT AUTHORITY\NTUSER.DAT
00000004 System         File           01b0 \Documents and
Settings\NetworkService.NT AUTHORITY\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG
00000004 System         File           01b4 \Documents and
Settings\LocalService.NT AUTHORITY\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
00000004 System         File           01bc \Documents and
Settings\NetworkService.NT AUTHORITY\NTUSER.DAT
00000004 System         File           01c0 \Documents and
Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG
00000004 System         File           01c8 \Documents and
Settings\NetworkService.NT AUTHORITY\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
00000004 System         File           01cc \Documents and
Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG
00000004 System         File           01d0 \Documents and
Settings\LocalService.NT AUTHORITY\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG
00000004 System         File           0238 \WINDOWS\system32\config\system
00000004 System         File           02fc
\WINDOWS\system32\MsDtc\Trace\dtctrace.log
00000004 System         File           0390 \Documents and
Settings\NetShowServices\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
00000004 System         File           03a0 \Documents and
Settings\NetShowServices\NTUSER.DAT
00000004 System         File           03a4 \Documents and
Settings\NetShowServices\ntuser.dat.LOG
00000004 System         File           03b4 \Documents and
Settings\NetShowServices\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG
00000004 System         File           03b8 \
00000004 System         File           0498 \WINDOWS\DfsSvcLogFile
00000004 System         File           04a8 \255
00000004 System         File           0c3c \Documents and
Settings\user.XP\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
00000004 System         File           0c44 \Documents and
Settings\user.XP\ntuser.dat.LOG
00000004 System         File           0c48 \Documents and
Settings\user.XP\NTUSER.DAT
00000004 System         File           0c4c \Documents and
Settings\user.XP\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG
00000004 System         File           0dcc
\WINDOWS\system32\LogFiles\W3SVC1\ex010522.log
00000004 System         File           0ddc \Topology
00000004 System         File           0dfc \47
000000C0 smss.exe       File           0010 \WINDOWS
000000C0 smss.exe       File           0024 \WINDOWS\system32
000000D8 csrss.exe      File           0014 \WINDOWS\system32
000000D8 csrss.exe      File           0728 \WINDOWS\system32\ega.cpi
000000E0 winlogon.exe   File           00b4
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000E0 winlogon.exe   File           01a4 \InitShutdown
000000E0 winlogon.exe   File           01a8 \InitShutdown
000000E0 winlogon.exe   File           0244 \WINDOWS\system32\dllcache
000000E0 winlogon.exe   File           0260 \WINDOWS\AppPatch
000000E0 winlogon.exe   File           0264 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\isapi\_vti_adm
000000E0 winlogon.exe   File           0270 \svcctl
000000E0 winlogon.exe   File           0274 \ntsvcs
000000E0 winlogon.exe   File           0280 \svcctl
000000E0 winlogon.exe   File           0284 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\_vti_bin\_vti_adm
000000E0 winlogon.exe   File           0288 \WINDOWS\system32
000000E0 winlogon.exe   File           028c \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\isapi\_vti_aut
000000E0 winlogon.exe   File           0290 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\_vti_bin\_vti_aut
000000E0 winlogon.exe   File           0294 \WINDOWS\system32\inetsrv
000000E0 winlogon.exe   File           0298 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\bin
000000E0 winlogon.exe   File           029c \WINDOWS\Fonts
000000E0 winlogon.exe   File           02a0 \WINDOWS\system32\drivers
000000E0 winlogon.exe   File           02a4 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\servsupp
000000E0 winlogon.exe   File           02a8 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\bots\vinavbar
000000E0 winlogon.exe   File           02ac \Program Files\Microsoft
FrontPage\version3.0\bin
000000E0 winlogon.exe   File           02b0 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\_vti_bin
000000E0 winlogon.exe   File           02b4 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\bin\1033
000000E0 winlogon.exe   File           02b8 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\isapi
000000E0 winlogon.exe   File           02bc \WINDOWS
000000E0 winlogon.exe   File           02c0 \Program Files\Common
Files\Microsoft Shared\DAO
000000E0 winlogon.exe   File           02c4 \Program Files\Windows Media
Player
000000E0 winlogon.exe   File           02c8 \Program Files\Common
Files\System\msadc
000000E0 winlogon.exe   File           02cc \Program Files\Common
Files\System\ado
000000E0 winlogon.exe   File           02d0 \Program Files\Common
Files\System\Ole DB
000000E0 winlogon.exe   File           02d4 \WINDOWS\inf
000000E0 winlogon.exe   File           02d8 \WINDOWS\system32\Setup
000000E0 winlogon.exe   File           02f8
\WINDOWS\system32\clients\tsclient\win16
000000E0 winlogon.exe   File           02fc
\WINDOWS\Microsoft.NET\Framework\v1.0.2706
000000E0 winlogon.exe   File           0300 \WINDOWS\Application
Compatibility Scripts
000000E0 winlogon.exe   File           0304
\WINDOWS\system32\clients\tsclient\win32\acme351
000000E0 winlogon.exe   File           0308 \WINDOWS\msagent
000000E0 winlogon.exe   File           030c \WINDOWS\msagent\intl
000000E0 winlogon.exe   File           0310 \WINDOWS\system32\netmon\parsers
000000E0 winlogon.exe   File           0314 \WINDOWS\system
000000E0 winlogon.exe   File           0318 \WINDOWS\system32\netmon
000000E0 winlogon.exe   File           031c \WINDOWS\Help
000000E0 winlogon.exe   File           0320
\WINDOWS\PCHEALTH\HELPCTR\Binaries
000000E0 winlogon.exe   File           0324 \Program Files\NetMeeting
000000E0 winlogon.exe   File           0328 \WINDOWS\system32\drivers\disdn
000000E0 winlogon.exe   File           032c \WINDOWS\ime\chtime\applets
000000E0 winlogon.exe   File           0330 \WINDOWS\system32\wbem
000000E0 winlogon.exe   File           0334 \WINDOWS\Cluster
000000E0 winlogon.exe   File           0338 \WINDOWS\system32\Com
000000E0 winlogon.exe   File           033c \WINDOWS\ime\imjp8_1
000000E0 winlogon.exe   File           0340 \Program Files\Common
Files\Microsoft Shared\Triedit
000000E0 winlogon.exe   File           0344 \Program Files\Windows NT
000000E0 winlogon.exe   File           0348 \Program Files\Common
Files\System
000000E0 winlogon.exe   File           034c \WINDOWS\system32\1033
000000E0 winlogon.exe   File           0350 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\admcgi\scripts
000000E0 winlogon.exe   File           0354 \Program Files\Common
Files\Microsoft Shared\Web Server Extensions\40\admisapi\scripts
000000E0 winlogon.exe   File           0358 \WINDOWS\ime\imkr6_1\dicts
000000E0 winlogon.exe   File           035c \WINDOWS\system32\mui\0009
000000E0 winlogon.exe   File           0360 \Program Files\Internet Explorer
000000E0 winlogon.exe   File           0364 \WINDOWS\ime\imjp8_1\applets
000000E0 winlogon.exe   File           0368 \WINDOWS\ime\imkr6_1\applets
000000E0 winlogon.exe   File           036c \Program Files\Internet
Explorer\Connection Wizard
000000E0 winlogon.exe   File           0370 \Program Files\Common
Files\Microsoft Shared\MSInfo
000000E0 winlogon.exe   File           0374 \Program Files\Common
Files\Microsoft Shared\Smart Tag
000000E0 winlogon.exe   File           0378 \WINDOWS\ime\imkr6_1
000000E0 winlogon.exe   File           037c \WINDOWS\ime\shared
000000E0 winlogon.exe   File           0380 \WINDOWS\system32\reminst
000000E0 winlogon.exe   File           0384 \WINDOWS\system32\ime\pintlgnt
000000E0 winlogon.exe   File           0388
\WINDOWS\system32\clients\tsclient\win32
000000E0 winlogon.exe   File           038c \Program Files\Common
Files\SpeechEngines\Microsoft\Lexicon\1033
000000E0 winlogon.exe   File           0390 \WINDOWS\Resources\Themes\Luna
000000E0 winlogon.exe   File           0394 \WINDOWS\ime
000000E0 winlogon.exe   File           0398 \Program Files\Outlook Express
000000E0 winlogon.exe   File           039c \Program Files\MSN\SmartTag
000000E0 winlogon.exe   File           03a0 \WINDOWS\system32\oobe
000000E0 winlogon.exe   File           03a4 \WINDOWS\mui
000000E0 winlogon.exe   File           03a8 \WINDOWS\system32\npp
000000E0 winlogon.exe   File           03ac \WINDOWS\ime\shared\res
000000E0 winlogon.exe   File           03b0 \WINDOWS\system32\rocket
000000E0 winlogon.exe   File           03b4 \WINDOWS\ime\chsime\applets
000000E0 winlogon.exe   File           03b8 \WINDOWS\system32\rpcproxy
000000E0 winlogon.exe   File           03bc \Program Files\Common
Files\SpeechEngines\Microsoft\TTS\1033
000000E0 winlogon.exe   File           03c0 \Program Files\Common
Files\Microsoft Shared\Speech
000000E0 winlogon.exe   File           03c4
\WINDOWS\system32\certsrv\certcontrol\ia64
000000E0 winlogon.exe   File           03c8
\WINDOWS\system32\certsrv\certcontrol\w2k
000000E0 winlogon.exe   File           03cc
\WINDOWS\system32\certsrv\certcontrol\x86
000000E0 winlogon.exe   File           03d0
\WINDOWS\system32\spool\prtprocs\w32x86
000000E0 winlogon.exe   File           03d4
\WINDOWS\Resources\Themes\Luna\Shell
000000E0 winlogon.exe   File           03d8 \WINDOWS\system32\wbem\snmp
000000E0 winlogon.exe   File           03dc \Program Files\Common
Files\SpeechEngines\Microsoft
000000E0 winlogon.exe   File           03e0 \Program Files\Common
Files\Microsoft Shared\Speech\1033
000000E0 winlogon.exe   File           03e4
\WINDOWS\system32\spool\drivers\color
000000E0 winlogon.exe   File           03e8 \WINDOWS\system32\ime\tintlgnt
000000E0 winlogon.exe   File           03ec \WINDOWS\Help\Tours
000000E0 winlogon.exe   File           03f0 \WINDOWS\system32\wbem\AdStatus
000000E0 winlogon.exe   File           03f4
\WINDOWS\PCHEALTH\UploadLB\Binaries
000000E0 winlogon.exe   File           03f8 \Program Files\Common
Files\Microsoft Shared\VGX
000000E0 winlogon.exe   File           0400
\WINDOWS\Microsoft.NET\Framework\v1.0.2706\1033
000000E0 winlogon.exe   File           0404 \WINDOWS\system32\wbem\xml
000000E0 winlogon.exe   File           0410 \Program Files\Windows
NT\Accessories
000000E0 winlogon.exe   File           0428 \WINDOWS\WinSxS
000000E0 winlogon.exe   File           05d0 \SfcApi
000000E0 winlogon.exe   File           05d4 \SfcApi
000000E0 winlogon.exe   File           0640
\{9B365890-165F-11D0-A195-0020AFD156E4}
000000E0 winlogon.exe   File           06b4 \ProfMapApi
000000E0 winlogon.exe   File           06b8 \ProfMapApi
000000E0 winlogon.exe   File           0758 \winlogonrpc
000000E0 winlogon.exe   File           075c \winlogonrpc
000000E0 winlogon.exe   File           0794
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000E0 winlogon.exe   File           0828 \AudioSrv
000000E0 winlogon.exe   File           0914 \WINDOWS\system32
00000110 services.exe   File           0014 \WINDOWS\system32
00000110 services.exe   File           0204 \ntsvcs
00000110 services.exe   File           0260 \ntsvcs
00000110 services.exe   File           0264 \ntsvcs
00000110 services.exe   File           02bc \scerpc
00000110 services.exe   File           02c0 \scerpc
00000110 services.exe   File           02c4 \ntsvcs
00000110 services.exe   File           02dc \lsarpc
00000110 services.exe   File           0314 \svcctl
00000110 services.exe   File           0320 \net\NtControlPipe1
00000110 services.exe   File           0328 \ntsvcs
00000110 services.exe   File           0330 \ntsvcs
00000110 services.exe   File           033c \net\NtControlPipe2
00000110 services.exe   File           0350 \ntsvcs
00000110 services.exe   File           0354 \net\NtControlPipe3
00000110 services.exe   File           0360 \net\NtControlPipe3
00000110 services.exe   File           0388
\WINDOWS\system32\config\AppEvent.Evt
00000110 services.exe   File           0398
\WINDOWS\system32\config\SecEvent.Evt
00000110 services.exe   File           03b0
\WINDOWS\system32\config\SysEvent.Evt
00000110 services.exe   File           03c8 \net\NtControlPipe4
00000110 services.exe   File           03e0 \ntsvcs
00000110 services.exe   File           0444 \net\NtControlPipe5
00000110 services.exe   File           044c \ntsvcs
00000110 services.exe   File           0460 \net\NtControlPipe6
00000110 services.exe   File           0468 \ntsvcs
00000110 services.exe   File           0470 \ntsvcs
00000110 services.exe   File           0494 \ntsvcs
00000110 services.exe   File           04a0 \net\NtControlPipe0
00000110 services.exe   File           04a4 \ntsvcs
00000110 services.exe   File           04b4 \net\NtControlPipe7
00000110 services.exe   File           04b8 \ntsvcs
00000110 services.exe   File           04cc \net\NtControlPipe8
00000110 services.exe   File           04d4 \ntsvcs
00000110 services.exe   File           04e4 \ntsvcs
00000110 services.exe   File           04f8 \ntsvcs
00000110 services.exe   File           0500 \ntsvcs
00000110 services.exe   File           0508 \net\NtControlPipe9
00000110 services.exe   File           050c \ntsvcs
00000110 services.exe   File           0528 \net\NtControlPipe10
00000110 services.exe   File           0550 \ntsvcs
00000110 services.exe   File           0564 \net\NtControlPipe11
00000110 services.exe   File           0568 \ntsvcs
00000110 services.exe   File           0588 \net\NtControlPipe12
00000110 services.exe   File           05b8 \ntsvcs
00000110 services.exe   File           05d0 \net\NtControlPipe13
00000110 services.exe   File           05d8 \ntsvcs
00000110 services.exe   File           05e0 \net\NtControlPipe14
00000110 services.exe   File           05ec \ntsvcs
00000110 services.exe   File           05f8 \ntsvcs
00000110 services.exe   File           0600 \net\NtControlPipe15
00000110 services.exe   File           060c \ntsvcs
00000110 services.exe   File           0620 \net\NtControlPipe16
00000110 services.exe   File           0628 \ntsvcs
00000110 services.exe   File           0630 \ntsvcs
00000110 services.exe   File           0648 \net\NtControlPipe18
00000110 services.exe   File           064c \net\NtControlPipe17
00000110 services.exe   File           0658 \ntsvcs
00000110 services.exe   File           0668 \ntsvcs
00000110 services.exe   File           0678 \ntsvcs
00000110 services.exe   File           0694 \ntsvcs
00000110 services.exe   File           06ac \ntsvcs
00000110 services.exe   File           06bc \ntsvcs
00000110 services.exe   File           06c0 \net\NtControlPipe21
00000110 services.exe   File           06dc \ntsvcs
00000110 services.exe   File           06e0 \net\NtControlPipe20
00000110 services.exe   File           06ec \ntsvcs
00000110 services.exe   File           06f4 \ntsvcs
00000110 services.exe   File           0708 \ntsvcs
00000110 services.exe   File           070c \ntsvcs
00000110 services.exe   File           072c \ntsvcs
00000110 services.exe   File           073c \PIPE_EVENTROOT\CIMV2SCM EVENT
PROVIDER
0000011C lsass.exe      File           0014 \WINDOWS\system32
0000011C lsass.exe      File           0078 \net\NtControlPipe0
0000011C lsass.exe      File           01c0 \WINDOWS\Debug\PASSWD.LOG
0000011C lsass.exe      File           0288 \lsass
0000011C lsass.exe      File           02e4 \protected_storage
0000011C lsass.exe      File           02e8 \protected_storage
0000011C lsass.exe      File           03e8
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
0000011C lsass.exe      File           0460 \lsass
0000011C lsass.exe      File           04f8 \Endpoint
0000011C lsass.exe      File           0508 \svcctl
0000011C lsass.exe      File           0510 \WINDOWS\Debug\oakley.log
0000011C lsass.exe      File           0544 \Endpoint
0000011C lsass.exe      File           0558 \Endpoint
0000011C lsass.exe      File           055c \255
0000011C lsass.exe      File           05a0 \ipsec
0000011C lsass.exe      File           05a4 \ipsec
0000011C lsass.exe      File           05b8 \lsass
0000011C lsass.exe      File           0608 \lsass
0000011C lsass.exe      File           0618 \lsass
000001A0 svchost.exe    File           0014 \WINDOWS\system32
000001A0 svchost.exe    File           0054 \net\NtControlPipe1
000001A0 svchost.exe    File           0154 \Endpoint
000001A0 svchost.exe    File           015c \Endpoint
000001A0 svchost.exe    File           0168
\Winsock2\CatalogChangeListener-1a0-0
000001A0 svchost.exe    File           0170 \Endpoint
000001A0 svchost.exe    File           0184 \Endpoint
000001A0 svchost.exe    File           01d4 \Endpoint
000001A0 svchost.exe    File           02bc \epmapper
000001A0 svchost.exe    File           02c0 \epmapper
000001A0 svchost.exe    File           0358 \Endpoint
000001A0 svchost.exe    File           0438 \svcctl
000001BC svchost.exe    File           0014 \WINDOWS\system32
000001BC svchost.exe    File           008c \net\NtControlPipe2
000001BC svchost.exe    File           00a0 \svcctl
000001BC svchost.exe    File           0154 \TermSrv_Licensing_Core
000001BC svchost.exe    File           0158 \TermSrv_Licensing_Core
000001BC svchost.exe    File           0230 \Ctx_WinStation_API_service
000001BC svchost.exe    File           0234 \Ctx_WinStation_API_service
00000200 svchost.exe    File           0014 \WINDOWS\system32
00000200 svchost.exe    File           008c \net\NtControlPipe4
00000200 svchost.exe    File           00a0 \svcctl
00000200 svchost.exe    File           00ac
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
00000200 svchost.exe    File           0164 \DhcpClient
00000200 svchost.exe    File           0260
\WINDOWS\Registration\R000000000013.clb
00000200 svchost.exe    File           028c \svcctl
00000200 svchost.exe    File           02d8 \ntsvcs
00000200 svchost.exe    File           02dc \WINDOWS\SchedLgU.Txt
00000200 svchost.exe    File           0354 \Endpoint
00000200 svchost.exe    File           0364
\Winsock2\CatalogChangeListener-200-0
00000200 svchost.exe    File           0394 \Endpoint
00000200 svchost.exe    File           0398 \atsvc
00000200 svchost.exe    File           039c \atsvc
00000200 svchost.exe    File           03c0 \WINDOWS\Tasks
00000200 svchost.exe    File           0460 \wkssvc
00000200 svchost.exe    File           04dc \AudioSrv
00000200 svchost.exe    File           04e0 \AudioSrv
00000200 svchost.exe    File           0518 \keysvc
00000200 svchost.exe    File           051c \keysvc
00000200 svchost.exe    File           057c \PCHHangRepExecPipe
00000200 svchost.exe    File           058c \PCHFaultRepExecPipe
00000200 svchost.exe    File           05e4 \srvsvc
00000200 svchost.exe    File           05f4 \AudioSrv
00000200 svchost.exe    File           0674 \SECLOGON
00000200 svchost.exe    File           0678 \SECLOGON
00000200 svchost.exe    File           06c8 \trkwks
00000200 svchost.exe    File           06cc \trkwks
00000200 svchost.exe    File           06ec \$Extend\$ObjId
00000200 svchost.exe    File           0714 \System Volume
Information\tracking.log
00000200 svchost.exe    File           0790 \W32TIME
00000200 svchost.exe    File           0794 \W32TIME
00000200 svchost.exe    File           07f4 \Endpoint
00000200 svchost.exe    File           0804 \Endpoint
00000200 svchost.exe    File           08c0 \wzcsvc
00000200 svchost.exe    File           08c4 \wzcsvc
00000200 svchost.exe    File           0910 \WMDMPMSPpipe
00000200 svchost.exe    File           09d0
\{9B365890-165F-11D0-A195-0020AFD156E4}
00000200 svchost.exe    File           09ec \wkssvc
00000200 svchost.exe    File           0a04 \srvsvc
00000200 svchost.exe    File           0a44 \browser
00000200 svchost.exe    File           0a48 \browser
00000200 svchost.exe    File           0af8
\Winsock2\CatalogChangeListener-200-1
00000200 svchost.exe    File           0b64 \svcctl
00000200 svchost.exe    File           0c08 \EVENTLOG
00000200 svchost.exe    File           0c98 \ROUTER
00000200 svchost.exe    File           0c9c \ROUTER
00000200 svchost.exe    File           0da8 \wkssvc
00000200 svchost.exe    File           0db0 \srvsvc
00000200 svchost.exe    File           0df8 \Documents and Settings\Default
User.WINDOWS\Local Settings\Temporary Internet Files\Content.IE5\index.dat
00000200 svchost.exe    File           0e0c \Documents and Settings\Default
User.WINDOWS\Cookies\index.dat
00000200 svchost.exe    File           0e10 \Documents and Settings\Default
User.WINDOWS\Local Settings\History\History.IE5\index.dat
00000200 svchost.exe    File           0e50 \ROUTER
00000230 csrss.exe      File           0014 \WINDOWS\system32
00000234 winlogon.exe   File           0014 \WINDOWS\system32
0000025C csrss.exe      File           0014 \WINDOWS\system32
00000260 winlogon.exe   File           0014 \WINDOWS\system32
00000294 svchost.exe    File           0014 \WINDOWS\system32
00000294 svchost.exe    File           0038 \net\NtControlPipe5
00000294 svchost.exe    File           0080 \svcctl
00000294 svchost.exe    File           00fc \WINDOWS\system32\drivers\etc
00000294 svchost.exe    File           0134 \DNSRSLVR
00000294 svchost.exe    File           0144 \DNSRSLVR
00000294 svchost.exe    File           0148 \svcctl
00000294 svchost.exe    File           0164 \DNSRSLVR
00000294 svchost.exe    File           0198 \DNSRSLVR
0000029C svchost.exe    File           0014 \WINDOWS\system32
0000029C svchost.exe    File           0038 \net\NtControlPipe6
0000029C svchost.exe    File           0080 \svcctl
0000029C svchost.exe    File           0110 \Alerter
0000029C svchost.exe    File           0128
\Winsock2\CatalogChangeListener-29c-0
0000029C svchost.exe    File           0168 \messngr
0000029C svchost.exe    File           0194 \msgsvc
0000029C svchost.exe    File           0198 \msgsvc
0000029C svchost.exe    File           01d0 \Endpoint
0000029C svchost.exe    File           01f8 \DAV RPC SERVICE
0000029C svchost.exe    File           0204 \ntsvcs
0000029C svchost.exe    File           0218
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
0000029C svchost.exe    File           022c \Documents and
Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet
Files\Content.IE5\index.dat
0000029C svchost.exe    File           023c \Documents and
Settings\LocalService.NT AUTHORITY\Cookies\index.dat
0000029C svchost.exe    File           0248 \Documents and
Settings\LocalService.NT AUTHORITY\Local
Settings\History\History.IE5\index.dat
0000029C svchost.exe    File           02ac \DAV RPC SERVICE
0000029C svchost.exe    File           02b0 \DAV RPC SERVICE
0000029C svchost.exe    File           02b4 \msgsvc
0000029C svchost.exe    File           02c0 \DNSRSLVR
0000029C svchost.exe    File           0358 \ROUTER
000002D8 spoolsv.exe    File           0014 \WINDOWS\system32
000002D8 spoolsv.exe    File           0048 \net\NtControlPipe7
000002D8 spoolsv.exe    File           0090 \svcctl
000002D8 spoolsv.exe    File           00cc \spoolss
000002D8 spoolsv.exe    File           00d0 \spoolss
000002D8 spoolsv.exe    File           0208 \ntsvcs
000002D8 spoolsv.exe    File           0330
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000002FC msdtc.exe      File           0014 \WINDOWS\system32
000002FC msdtc.exe      File           00c0 \net\NtControlPipe8
000002FC msdtc.exe      File           00d4 \svcctl
000002FC msdtc.exe      File           018c \Endpoint
000002FC msdtc.exe      File           01a8
\Winsock2\CatalogChangeListener-2fc-0
000002FC msdtc.exe      File           01ac \Endpoint
000002FC msdtc.exe      File           0284
\WINDOWS\system32\MsDtc\MSDTC.LOG
000003B8 inetinfo.exe   File           0014 \WINDOWS\system32
000003B8 inetinfo.exe   File           006c \net\NtControlPipe9
000003B8 inetinfo.exe   File           00b0 \svcctl
000003B8 inetinfo.exe   File           00c0 \svcctl
000003B8 inetinfo.exe   File           00d0
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000003B8 inetinfo.exe   File           01c0
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           01c8
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           01d0
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           01d8
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           01e0
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           01e8
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           01f0
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           01f8
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           0200
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           0208
\WINDOWS\system32\inetsrv\MBSchema.bin.00000000h
000003B8 inetinfo.exe   File           05ec \Endpoint
000003B8 inetinfo.exe   File           05fc
\Winsock2\CatalogChangeListener-3b8-0
000003B8 inetinfo.exe   File           0610 \Endpoint
000003B8 inetinfo.exe   File           0638 \INETINFO
000003B8 inetinfo.exe   File           063c \INETINFO
000003B8 inetinfo.exe   File           0668 \EVENTLOG
000003B8 inetinfo.exe   File           0698 \Endpoint
000003B8 inetinfo.exe   File           071c \Inetpub\ftproot
000003B8 inetinfo.exe   File           073c \Endpoint
000003B8 inetinfo.exe   File           0740 \Endpoint
000003B8 inetinfo.exe   File           0744 \Endpoint
000003B8 inetinfo.exe   File           0748 \Endpoint
000003B8 inetinfo.exe   File           074c \Endpoint
000003B8 inetinfo.exe   File           0750 \Endpoint
000003B8 inetinfo.exe   File           0754 \Endpoint
000003B8 inetinfo.exe   File           0758 \Endpoint
000003B8 inetinfo.exe   File           075c \Endpoint
000003B8 inetinfo.exe   File           0760 \Endpoint
000003B8 inetinfo.exe   File           0764 \Endpoint
000003B8 inetinfo.exe   File           076c \Endpoint
000003B8 inetinfo.exe   File           0824 \SMTPSVC
000003B8 inetinfo.exe   File           0828 \SMTPSVC
000003B8 inetinfo.exe   File           0874 \Endpoint
000003B8 inetinfo.exe   File           08ec \Endpoint
000003B8 inetinfo.exe   File           08f0 \Endpoint
000003B8 inetinfo.exe   File           08f4 \Endpoint
000003B8 inetinfo.exe   File           08f8 \Endpoint
000003B8 inetinfo.exe   File           08fc \Endpoint
000003B8 inetinfo.exe   File           0900 \Endpoint
000003B8 inetinfo.exe   File           0918 \Inetpub\mailroot\Pickup
000003B8 inetinfo.exe   File           093c \Endpoint
000003B8 inetinfo.exe   File           0944 \Endpoint
000003B8 inetinfo.exe   File           0948 \Endpoint
000003B8 inetinfo.exe   File           094c \Endpoint
000003B8 inetinfo.exe   File           0950 \Endpoint
000003B8 inetinfo.exe   File           0954 \Endpoint
000003B8 inetinfo.exe   File           0958 \Endpoint
000003B8 inetinfo.exe   File           095c \Endpoint
000003B8 inetinfo.exe   File           0960 \Endpoint
000003B8 inetinfo.exe   File           0964 \Endpoint
000003B8 inetinfo.exe   File           0968 \Endpoint
000003B8 inetinfo.exe   File           0994 \Inetpub\nntpfile\groupvar.lst
000003B8 inetinfo.exe   File           0998 \Inetpub\nntpfile\group.lst
000003B8 inetinfo.exe   File           099c \Inetpub\nntpfile\article.hsh
000003B8 inetinfo.exe   File           09a4 \Inetpub\nntpfile\history.hsh
000003B8 inetinfo.exe   File           09ac \Inetpub\nntpfile\xover.hsh
000003B8 inetinfo.exe   File           09e0
\Inetpub\nntpfile\root\control\group.vpp
000003B8 inetinfo.exe   File           09e4 \Inetpub\nntpfile\root\control
000003B8 inetinfo.exe   File           09f0 \Inetpub\nntpfile\pickup
000003B8 inetinfo.exe   File           09fc
\Inetpub\nntpfile\root\_slavegroup
000003B8 inetinfo.exe   File           0a00 \Inetpub\nntpfile\root
000003B8 inetinfo.exe   File           0a04 \Inetpub\nntpfile\root\control
000003B8 inetinfo.exe   File           0a10 \Endpoint
000003B8 inetinfo.exe   File           0a18 \Endpoint
000003B8 inetinfo.exe   File           0a1c \Endpoint
000003B8 inetinfo.exe   File           0a20 \Endpoint
000003B8 inetinfo.exe   File           0a24
\Inetpub\nntpfile\root\_slavegroup\group.vpp
000003B8 inetinfo.exe   File           0a28
\Inetpub\nntpfile\root\_slavegroup
000003B8 inetinfo.exe   File           0a30 \Inetpub\nntpfile\root\group.vpp
000003B8 inetinfo.exe   File           0a34 \Inetpub\nntpfile\root
000003B8 inetinfo.exe   File           0a3c \Endpoint
000003B8 inetinfo.exe   File           0a40 \Endpoint
000003B8 inetinfo.exe   File           0a44 \Endpoint
000003B8 inetinfo.exe   File           0a48 \Endpoint
000003B8 inetinfo.exe   File           0a4c \Endpoint
000003B8 inetinfo.exe   File           0a50 \Endpoint
000003B8 inetinfo.exe   File           0a54 \Endpoint
000003B8 inetinfo.exe   File           0a5c \Endpoint
000003B8 inetinfo.exe   File           0a64 \Endpoint
000003B8 inetinfo.exe   File           0a68 \Endpoint
000003B8 inetinfo.exe   File           0a6c \Endpoint
000003B8 inetinfo.exe   File           0a70 \Endpoint
000003B8 inetinfo.exe   File           0a74 \Endpoint
000003B8 inetinfo.exe   File           0a78 \Endpoint
000003B8 inetinfo.exe   File           0a7c \Endpoint
000003B8 inetinfo.exe   File           0a80 \Endpoint
000003B8 inetinfo.exe   File           0a84 \Endpoint
000003B8 inetinfo.exe   File           0a88 \Endpoint
000003B8 inetinfo.exe   File           0ae0 \NNTPSVC
000003B8 inetinfo.exe   File           0ae4 \NNTPSVC
000003B8 inetinfo.exe   File           0b60 \DefaultAppPool
000003B8 inetinfo.exe   File           0b88 \iisipm
000003B8 inetinfo.exe   File           0bcc \DNSRSLVR
000003B8 inetinfo.exe   File           0bdc \IISCgiStdOut952
000003B8 inetinfo.exe   File           0be4 \IISCgiStdIn952
000003B8 inetinfo.exe   File           0c10 \SSLFilterChannel
000003CC llssrv.exe     File           0014 \WINDOWS\system32
000003CC llssrv.exe     File           0068 \net\NtControlPipe10
000003CC llssrv.exe     File           00ac \svcctl
000003CC llssrv.exe     File           017c \llsrpc
000003CC llssrv.exe     File           0180 \llsrpc
000003A8 NSPMON.exe     File           0014 \WINDOWS\system32
000003A8 NSPMON.exe     File           0068 \net\NtControlPipe11
000003A8 NSPMON.exe     File           00ac \svcctl
000003A8 NSPMON.exe     File           00e8 \Endpoint
000003A8 NSPMON.exe     File           00f0 \Endpoint
0000041C NSCM.exe       File           0014 \WINDOWS\system32
0000041C NSCM.exe       File           0068
\DOCUME~1\NETSHO~1\LOCALS~1\Temp\Perflib_Perfdata_41c.dat
0000041C NSCM.exe       File           017c \net\NtControlPipe12
0000041C NSCM.exe       File           0190 \svcctl
0000041C NSCM.exe       File           0220 \Endpoint
0000041C NSCM.exe       File           0228 \Endpoint
0000046C svchost.exe    File           0014 \WINDOWS\system32
0000046C svchost.exe    File           0038 \net\NtControlPipe13
0000046C svchost.exe    File           0080 \svcctl
0000046C svchost.exe    File           00c0 \winreg
0000046C svchost.exe    File           00c4 \winreg
000004C0 svchost.exe    File           0014 \WINDOWS\system32
000004C0 svchost.exe    File           008c \net\NtControlPipe14
000004C0 svchost.exe    File           00a0 \svcctl
000004C0 svchost.exe    File           00d0 \WINDOWS\system32\wbem\mof
000004C0 svchost.exe    File           01a0 \lsarpc
000004C0 svchost.exe    File           025c
\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA
000004C0 svchost.exe    File           0260
\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR
000004C0 svchost.exe    File           050c \PIPE_EVENTROOT\CIMV2SCM EVENT
PROVIDER
000004C0 svchost.exe    File           0538 \PIPE_EVENTROOT\CIMV2SCM EVENT
PROVIDER
000003DC dfssvc.exe     File           0014 \WINDOWS\system32
000003DC dfssvc.exe     File           0070 \net\NtControlPipe15
000003DC dfssvc.exe     File           00b4 \svcctl
000003DC dfssvc.exe     File           00fc \netdfs
000003DC dfssvc.exe     File           0100 \netdfs
000004F0 NSUM.exe       File           0014 \WINDOWS\system32
000004F0 NSUM.exe       File           0068
\DOCUME~1\NETSHO~1\LOCALS~1\Temp\Perflib_Perfdata_4f0.dat
000004F0 NSUM.exe       File           0184 \net\NtControlPipe16
000004F0 NSUM.exe       File           019c \svcctl
000004F0 NSUM.exe       File           0278 \Endpoint
000004F0 NSUM.exe       File           0280 \Endpoint
000004F0 NSUM.exe       File           0284 \Endpoint
000004F0 NSUM.exe       File           028c \Endpoint
000004F0 NSUM.exe       File           0290 \Endpoint
00000548 nspm.exe       File           0014 \WINDOWS\system32
00000548 nspm.exe       File           00c0 \net\NtControlPipe17
00000548 nspm.exe       File           00c4 \svcctl
00000548 nspm.exe       File           019c
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
00000548 nspm.exe       File           01d8
\DOCUME~1\NETSHO~1\LOCALS~1\Temp\JETA66.tmp
00000548 nspm.exe       File           01f8
\DOCUME~1\NETSHO~1\LOCALS~1\Temp\JET1.tmp
00000548 nspm.exe       File           0218 \WINDOWS\system32\Windows
Media\Server\ASDB\mdsas.mdb
00000548 nspm.exe       File           021c \WINDOWS\system32\Windows
Media\Server\ASDB\mdsas.ldb
000005C8 svchost.exe    File           0014 \WINDOWS\system32
000005C8 svchost.exe    File           008c \net\NtControlPipe18
000005C8 svchost.exe    File           00a0 \svcctl
000005C8 svchost.exe    File           014c \SSLFilterChannel
000005C8 svchost.exe    File           022c
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000005C8 svchost.exe    File           0278 \DefaultAppPool
000005C8 svchost.exe    File           02bc \iisipm
000000F8 explorer.exe   File           0014 \Documents and
Settings\user.XP
000000F8 explorer.exe   File           004c
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   File           005c
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   File           0064
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   File           0068
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   File           0108
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   File           018c \Documents and Settings\All
Users.WINDOWS\Desktop
000000F8 explorer.exe   File           01a0 \Documents and
Settings\user.XP\Desktop
000000F8 explorer.exe   File           01f0 \Documents and Settings\All
Users.WINDOWS\Start Menu
000000F8 explorer.exe   File           0204 \Documents and
Settings\user.XP\Start Menu
000000F8 explorer.exe   File           0218 \Documents and
Settings\user.XP\Application Data\Microsoft\Internet Explorer\Quick
Launch
000000F8 explorer.exe   File           0258
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   File           02a4 \Documents and
Settings\user.XP\Cookies\index.dat
000000F8 explorer.exe   File           02e0
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   File           02e4
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   File           0320
\{9B365890-165F-11D0-A195-0020AFD156E4}
000000F8 explorer.exe   File           0364 \ntsvcs
000000F8 explorer.exe   File           0380 \AudioSrv
000000F8 explorer.exe   File           0388
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   File           03c8 \Documents and
Settings\user.XP\PrintHood
000000F8 explorer.exe   File           042c
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
000000F8 explorer.exe   File           0488 \Documents and
Settings\user.XP\Local Settings\History\History.IE5\index.dat
000000F8 explorer.exe   File           048c \Documents and
Settings\user.XP\Local Settings\Temporary Internet
Files\Content.IE5\index.dat
000000F8 explorer.exe   File           04a4 \Documents and
Settings\user.XP\Local
Settings\History\History.IE5\MSHist012001052220010523\index.dat
000000F8 explorer.exe   File           0508 \output
00000720 idwlog.exe     File           0014 \Documents and
Settings\user.XP
00000720 idwlog.exe     File           0078 \Idwlog.log
00000720 idwlog.exe     File           007c \WINDOWS\system32
00000720 idwlog.exe     File           0084 \WINDOWS\system32
00000720 idwlog.exe     File           00c4 \ntsvcs
00000720 idwlog.exe     File           00d0 \WINDOWS\system32
00000720 idwlog.exe     File           00f8 \DAV RPC SERVICE
0000079C svchost.exe    File           0014 \WINDOWS\system32
0000079C svchost.exe    File           0054 \net\NtControlPipe20
0000079C svchost.exe    File           0078 \svcctl
0000079C svchost.exe    File           010c \tapsrv
0000079C svchost.exe    File           0110 \tapsrv
0000079C svchost.exe    File           01c0 \53cb31a0\UnimodemNotifyTSP
0000079C svchost.exe    File           01dc \ntsvcs
0000079C svchost.exe    File           03ac \WINDOWS\system32\h323log.txt
00000668 svchost.exe    File           0014 \WINDOWS\system32
00000668 svchost.exe    File           0030 \net\NtControlPipe21
00000668 svchost.exe    File           0078 \svcctl
00000668 svchost.exe    File           00c4
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
00000668 svchost.exe    File           00fc \WINDOWS\Sti_Trace.log
00000668 svchost.exe    File           01a4 \WINDOWS\wiaservc.log
00000668 svchost.exe    File           01cc \ntsvcs
00000668 svchost.exe    File           0288 \WINDOWS\Sti_Trace.log
00000870 wmiprvse.exe   File           0014 \WINDOWS\system32
0000076C wuauclt.exe    File           0014 \WINDOWS\system32
0000076C wuauclt.exe    File           0018
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
0000076C wuauclt.exe    File           0058
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
0000076C wuauclt.exe    File           023c \ROUTER
00000838 cmd.exe        File           0014 \Documents and
Settings\user.XP
00000838 cmd.exe        File           0064 \output\ohfile.txt
0000071C notepad.exe    File           0018
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
0000071C notepad.exe    File           005c
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
0000071C notepad.exe    File           01e8
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a
0000071C notepad.exe    File           0250 \output
000007F0 oh.exe         File           0014 \Documents and
Settings\user.XP
000007F0 oh.exe         File           0064 \output\ohfile.txt

Example 5: List Handles for Event Objects with Open Windows

To generate a list of event objects and send the output to the file C:\Output\Ohevent.txt, type the following at the command line:

oh /t event /o c:\output\ohevent.txt

Looking in Ohevent.txt, you then see output similar to the following:

00000004 System         Event          002c \Security\TRKWKS_EVENT
00000004 System         Event          008c
\Device\DmControl\VxKernel2VoldEvent
00000004 System         Event          00d4 \LanmanServerAnnounceEvent
000000C0 smss.exe       Event          0038 \UniqueSessionIdEvent
000000D8 csrss.exe      Event          00dc
\BaseNamedObjects\WinSta0_DesktopSwitch
000000E0 winlogon.exe   Event          0050 \BaseNamedObjects\userenv:  User
Profile setup event
000000E0 winlogon.exe   Event          0058 \BaseNamedObjects\userenv:
Machine Group Policy has been applied
000000E0 winlogon.exe   Event          005c \BaseNamedObjects\userenv:
Machine Group Policy ForcedRefresh Needs Foreground Processing
000000E0 winlogon.exe   Event          0060 \BaseNamedObjects\userenv:
Machine Group Policy Processing is done
000000E0 winlogon.exe   Event          0064 \BaseNamedObjects\userenv:
Machine Policy Foreground Done Event
000000E0 winlogon.exe   Event          006c \BaseNamedObjects\userenv: User
Group Policy has been applied
000000E0 winlogon.exe   Event          0070 \BaseNamedObjects\userenv: User
Group Policy ForcedRefresh Needs Foreground Processing
000000E0 winlogon.exe   Event          0074 \BaseNamedObjects\userenv: User
Group Policy Processing is done
000000E0 winlogon.exe   Event          0078 \BaseNamedObjects\userenv: User
Policy Foreground Done Event
000000E0 winlogon.exe   Event          007c
\BaseNamedObjects\crypt32LogoffEvent
000000E0 winlogon.exe   Event          0088 \Security\NetworkProviderLoad
000000E0 winlogon.exe   Event          008c \BaseNamedObjects\TS-WPAAE
000000E0 winlogon.exe   Event          00a8 \BaseNamedObjects\ReconEvent
000000E0 winlogon.exe   Event          01ec \BaseNamedObjects\DINPUTWINMM
000000E0 winlogon.exe   Event          0218
\BaseNamedObjects\WinSta0_DesktopSwitch
000000E0 winlogon.exe   Event          0234
\BaseNamedObjects\WFP_IDLE_TRIGGER
000000E0 winlogon.exe   Event          025c \BaseNamedObjects\Microsoft
Smart Card Resource Manager Started
000000E0 winlogon.exe   Event          02dc
\BaseNamedObjects\ThemesStartEvent
000000E0 winlogon.exe   Event          02e4 \BaseNamedObjects\msgina:
ReturnToWelcome
000000E0 winlogon.exe   Event          05f4
\BaseNamedObjects\hardwaremixercallback
000000E0 winlogon.exe   Event          0604
\BaseNamedObjects\GuardEventmmGlobalPnpInfoGuard
000000E0 winlogon.exe   Event          0648 \BaseNamedObjects\mixercallback
000000E0 winlogon.exe   Event          06d0 \BaseNamedObjects\winlogon:
machine GPO Event 49931
000000E0 winlogon.exe   Event          06dc \BaseNamedObjects\userenv:
Machine Group Policy has been applied
000000E0 winlogon.exe   Event          06e4 \BaseNamedObjects\userenv:
machine policy refresh event
000000E0 winlogon.exe   Event          06e8 \BaseNamedObjects\userenv:
machine policy force refresh event
000000E0 winlogon.exe   Event          06ec \BaseNamedObjects\userenv:
Machine Group Policy has been applied
000000E0 winlogon.exe   Event          06f0 \BaseNamedObjects\userenv:
Machine Group Policy ForcedRefresh Needs Foreground Processing
000000E0 winlogon.exe   Event          06f4 \BaseNamedObjects\userenv:
Machine Group Policy Processing is done
000000E0 winlogon.exe   Event          0704
\BaseNamedObjects\jjCSCSharedEvent_UM_KM
000000E0 winlogon.exe   Event          070c
\BaseNamedObjects\jjCSCSharedFillEvent_UM_KM
000000E0 winlogon.exe   Event          0714
\BaseNamedObjects\WkssvcToAgentStartEvent
000000E0 winlogon.exe   Event          0718
\BaseNamedObjects\WkssvcToAgentStopEvent
000000E0 winlogon.exe   Event          071c
\BaseNamedObjects\AgentExistsEvent
000000E0 winlogon.exe   Event          0724
\BaseNamedObjects\AgentToWkssvcEvent
000000E0 winlogon.exe   Event          0760 \BaseNamedObjects\SENS Started
Event
000000E0 winlogon.exe   Event          07a4 \BaseNamedObjects\winlogon:
User GPO Event 73045
000000E0 winlogon.exe   Event          07b0 \BaseNamedObjects\userenv: User
Group Policy has been applied
000000E0 winlogon.exe   Event          07b8 \BaseNamedObjects\userenv: user
policy refresh event
000000E0 winlogon.exe   Event          07bc \BaseNamedObjects\userenv: user
policy force refresh event
000000E0 winlogon.exe   Event          07c0 \BaseNamedObjects\userenv: User
Group Policy has been applied
000000E0 winlogon.exe   Event          07c4 \BaseNamedObjects\userenv: User
Group Policy ForcedRefresh Needs Foreground Processing
000000E0 winlogon.exe   Event          07c8 \BaseNamedObjects\userenv: User
Group Policy Processing is done
00000110 services.exe   Event          0064 \BaseNamedObjects\userenv:  User
Profile setup event
00000110 services.exe   Event          018c
\BaseNamedObjects\SC_AutoStartComplete
00000110 services.exe   Event          01b4
\BaseNamedObjects\SvcctrlStartEvent_A3752DX
00000110 services.exe   Event          0218 \BaseNamedObjects\ScNetDrvMsg
00000110 services.exe   Event          02f0
\BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS
00000110 services.exe   Event          03d8
\BaseNamedObjects\PnP_No_Pending_Install_Events
0000011C lsass.exe      Event          00bc \SeLsaInitEvent
0000011C lsass.exe      Event          01e8
\BaseNamedObjects\crypt32LogoffEvent
0000011C lsass.exe      Event          01f8 \BaseNamedObjects\userenv:  User
Profile setup event
0000011C lsass.exe      Event          027c
\BaseNamedObjects\LSA_RPC_SERVER_ACTIVE
0000011C lsass.exe      Event          03cc \SAM_SERVICE_STARTED
0000011C lsass.exe      Event          04d0
\BaseNamedObjects\PS_SERVICE_STARTED
0000011C lsass.exe      Event          04dc
\BaseNamedObjects\IPSEC_POLICY_CHANGE_EVENT
0000011C lsass.exe      Event          04e8
\BaseNamedObjects\IPSEC_POLICY_CHANGE_NOTIFY
000001A0 svchost.exe    Event          00ac \BaseNamedObjects\userenv:  User
Profile setup event
000001A0 svchost.exe    Event          01d8
\BaseNamedObjects\ScmCreatedEvent
000001BC svchost.exe    Event          00bc
\BaseNamedObjects\crypt32LogoffEvent
000001BC svchost.exe    Event          00c0
\BaseNamedObjects\TermSrvReadyEvent
000001BC svchost.exe    Event          01dc
\BaseNamedObjects\WinMMConsoleAudioEvent
000001BC svchost.exe    Event          01f0 \BaseNamedObjects\ReconEvent
000001BC svchost.exe    Event          01f4 \BaseNamedObjects\TermSrv:
machine GP event
000001BC svchost.exe    Event          0238 \BaseNamedObjects\userenv:  User
Profile setup event
000001BC svchost.exe    Event          0244 \BaseNamedObjects\userenv:
Machine Group Policy has been applied
000001BC svchost.exe    Event          028c
\Sessions\1\BaseNamedObjects\CsrStartEvent
000001BC svchost.exe    Event          0290
\Sessions\1\BaseNamedObjects\ReconEvent
000001BC svchost.exe    Event          02c8
\Sessions\2\BaseNamedObjects\CsrStartEvent
000001BC svchost.exe    Event          02cc
\Sessions\2\BaseNamedObjects\ReconEvent
00000200 svchost.exe    Event          015c
\BaseNamedObjects\DHCPNEWIPADDRESS
00000200 svchost.exe    Event          0198
\BaseNamedObjects\AgentToWkssvcEvent
00000200 svchost.exe    Event          01d0
\BaseNamedObjects\WkssvcToAgentStartEvent
00000200 svchost.exe    Event          01d4
\BaseNamedObjects\ShellHWDetection'sEvent
00000200 svchost.exe    Event          01d8
\BaseNamedObjects\CGenericServiceManager__Init
00000200 svchost.exe    Event          026c
\BaseNamedObjects\ShellHWDetection'sEvent
00000200 svchost.exe    Event          02b4 \BaseNamedObjects\userenv:  User
Profile setup event
00000200 svchost.exe    Event          02e0
\BaseNamedObjects\ShellHWDetectionInitCompleted
00000200 svchost.exe    Event          03e0
\BaseNamedObjects\WkssvcToAgentStopEvent
00000200 svchost.exe    Event          046c \BaseNamedObjects\wkssvc:  MUP
finished initializing event
00000200 svchost.exe    Event          0490
\BaseNamedObjects\crypt32LogoffEvent
00000200 svchost.exe    Event          04e4 \BaseNamedObjects\DmServerStop
00000200 svchost.exe    Event          0540 \BaseNamedObjects\ReSyncKernel
00000200 svchost.exe    Event          0548
\Device\DmControl\VxKernel2VoldEvent
00000200 svchost.exe    Event          05f0 \LanmanServerAnnounceEvent
00000200 svchost.exe    Event          06a0 \Security\TRKWKS_EVENT
00000200 svchost.exe    Event          06f4 \BaseNamedObjects\SENS Started
Event
00000200 svchost.exe    Event          0724 \BaseNamedObjects\Sens Hidden
Window Cleanup Event
00000230 csrss.exe      Event          00c4
\Sessions\1\BaseNamedObjects\ScNetDrvMsg
00000234 winlogon.exe   Event          0050 \BaseNamedObjects\userenv:  User
Profile setup event
00000234 winlogon.exe   Event          0058 \BaseNamedObjects\userenv:
Machine Group Policy has been applied
00000234 winlogon.exe   Event          005c \BaseNamedObjects\userenv:
Machine Group Policy ForcedRefresh Needs Foreground Processing
00000234 winlogon.exe   Event          0060 \BaseNamedObjects\userenv:
Machine Group Policy Processing is done
00000234 winlogon.exe   Event          0064 \BaseNamedObjects\userenv:
Machine Policy Foreground Done Event
00000234 winlogon.exe   Event          006c
\Sessions\1\BaseNamedObjects\userenv: User Group Policy has been applied
00000234 winlogon.exe   Event          0070
\Sessions\1\BaseNamedObjects\userenv: User Group Policy ForcedRefresh Needs
Foreground Processing
00000234 winlogon.exe   Event          0074
\Sessions\1\BaseNamedObjects\userenv: User Group Policy Processing is done
00000234 winlogon.exe   Event          0078
\Sessions\1\BaseNamedObjects\userenv: User Policy Foreground Done Event
00000234 winlogon.exe   Event          007c
\BaseNamedObjects\crypt32LogoffEvent
0000025C csrss.exe      Event          00c4
\Sessions\2\BaseNamedObjects\ScNetDrvMsg
00000260 winlogon.exe   Event          0050 \BaseNamedObjects\userenv:  User
Profile setup event
00000260 winlogon.exe   Event          0058 \BaseNamedObjects\userenv:
Machine Group Policy has been applied
00000260 winlogon.exe   Event          005c \BaseNamedObjects\userenv:
Machine Group Policy ForcedRefresh Needs Foreground Processing
00000260 winlogon.exe   Event          0060 \BaseNamedObjects\userenv:
Machine Group Policy Processing is done
00000260 winlogon.exe   Event          0064 \BaseNamedObjects\userenv:
Machine Policy Foreground Done Event
00000260 winlogon.exe   Event          006c
\Sessions\2\BaseNamedObjects\userenv: User Group Policy has been applied
00000260 winlogon.exe   Event          0070
\Sessions\2\BaseNamedObjects\userenv: User Group Policy ForcedRefresh Needs
Foreground Processing
00000260 winlogon.exe   Event          0074
\Sessions\2\BaseNamedObjects\userenv: User Group Policy Processing is done
00000260 winlogon.exe   Event          0078
\Sessions\2\BaseNamedObjects\userenv: User Policy Foreground Done Event
00000260 winlogon.exe   Event          007c
\BaseNamedObjects\crypt32LogoffEvent
0000029C svchost.exe    Event          01f4
\BaseNamedObjects\crypt32LogoffEvent
000002D8 spoolsv.exe    Event          00a0
\BaseNamedObjects\RouterPreInitEvent
000002D8 spoolsv.exe    Event          0120
\BaseNamedObjects\crypt32LogoffEvent
000002D8 spoolsv.exe    Event          0350 \BaseNamedObjects\userenv:  User
Profile setup event
000002FC msdtc.exe      Event          00f8
\BaseNamedObjects\EVENT_MSDTC_STARTING
000002FC msdtc.exe      Event          02d8
\BaseNamedObjects\MSDTC_NAMED_EVENT
000003B8 inetinfo.exe   Event          0064
\BaseNamedObjects\W3SVCStartW3WP-aae415e7-4598-4294-a382-0a435d5b32c5
000003B8 inetinfo.exe   Event          0284 \BaseNamedObjects\userenv:  User
Profile setup event
000003B8 inetinfo.exe   Event          0288
\BaseNamedObjects\crypt32LogoffEvent
000003B8 inetinfo.exe   Event          072c
\BaseNamedObjects\MicrosoftInternetNewsServerVersion2BootCheckEvent
0000041C NSCM.exe       Event          00b0
\BaseNamedObjects\McmServPerf_RegChangeEvent
0000046C svchost.exe    Event          00d0
\BaseNamedObjects\Microsoft.RPC_Registry_Server
000004C0 svchost.exe    Event          00cc
\BaseNamedObjects\WINMGMT_COREDLL_CANSHUTDOWN
000004C0 svchost.exe    Event          00d4
\BaseNamedObjects\WINMGMT_PROVIDER_CANSHUTDOWN
000004C0 svchost.exe    Event          00d8
\BaseNamedObjects\WINMGMT_COREDLL_UNLOADED
000004C0 svchost.exe    Event          00dc
\BaseNamedObjects\WINMGMT_COREDLL_LOADED
000004C0 svchost.exe    Event          00e0
\BaseNamedObjects\WINMGMT_MARSHALLING_SERVER_TERMINATE
000004C0 svchost.exe    Event          00e8
\BaseNamedObjects\WINMGMT_NEED_REGISTRATION
000004C0 svchost.exe    Event          00ec
\BaseNamedObjects\WINMGMT_REGISTRATION_DONE
000004C0 svchost.exe    Event          00f4
\BaseNamedObjects\WMI_SysEvent_LodCtr
000004C0 svchost.exe    Event          00f8
\BaseNamedObjects\WMI_SysEvent_UnLodCtr
000004C0 svchost.exe    Event          029c
\BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS
000004C0 svchost.exe    Event          02b4
\BaseNamedObjects\WINMGMT_PROVIDER_CANSHUTDOWN
000004C0 svchost.exe    Event          02e4
\BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS
000004C0 svchost.exe    Event          02ec
\BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS
000004C0 svchost.exe    Event          04e0
\BaseNamedObjects\WBEM_ESS_OPEN_FOR_BUSINESS
000004C0 svchost.exe    Event          0500
\BaseNamedObjects\EVENT_READYROOT/CIMV2SCM EVENT PROVIDER
000004C0 svchost.exe    Event          0518
\BaseNamedObjects\EVENT_READYROOT/CIMV2PROVIDERSUBSYSTEM
000004C0 svchost.exe    Event          0524
\BaseNamedObjects\EVENT_READYROOT/CIMV2WMI SELF-INSTRUMENTATION EVENT
PROVIDER
000004C0 svchost.exe    Event          0530
\BaseNamedObjects\EVENT_READYROOT/CIMV2STANDARD NON-COM EVENT PROVIDER
000003DC dfssvc.exe     Event          0064 \BaseNamedObjects\userenv:  User
Profile setup event
000004F0 NSUM.exe       Event          00b0
\BaseNamedObjects\AsfServPerf_RegChangeEvent
000005C8 svchost.exe    Event          00b8
\BaseNamedObjects\crypt32LogoffEvent
000005C8 svchost.exe    Event          00e0 \BaseNamedObjects\userenv:  User
Profile setup event
000005C8 svchost.exe    Event          0220
\BaseNamedObjects\W3SVCStartW3WP-aae415e7-4598-4294-a382-0a435d5b32c5
000005C8 svchost.exe    Event          02b0
\BaseNamedObjects\WASPerfCount-c40da922-9c0a-4def-8aba-cd0bb5f093e1
000000F8 explorer.exe   Event          01c4 \BaseNamedObjects\userenv:  User
Profile setup event
000000F8 explorer.exe   Event          02dc
\BaseNamedObjects\ShellReadyEvent
000000F8 explorer.exe   Event          0308
\BaseNamedObjects\GuardEventmmGlobalPnpInfoGuard
000000F8 explorer.exe   Event          032c \BaseNamedObjects\mixercallback
000000F8 explorer.exe   Event          0334
\BaseNamedObjects\hardwaremixercallback
000000F8 explorer.exe   Event          0350
\BaseNamedObjects\HPlugEjectEvent
000000F8 explorer.exe   Event          0450
\BaseNamedObjects\crypt32LogoffEvent
0000079C svchost.exe    Event          00dc
\BaseNamedObjects\SC_AutoStartComplete
0000079C svchost.exe    Event          01c4
\BaseNamedObjects\--.-mailslot-53cb31a0-UnimodemNotifyTSP
0000079C svchost.exe    Event          03ec \BaseNamedObjects\DINPUTWINMM
00000668 svchost.exe    Event          00b8 \BaseNamedObjects\userenv:  User
Profile setup event
0000076C wuauclt.exe    Event          026c \BaseNamedObjects\userenv:  User
Profile setup event
0000071C notepad.exe    Event          01e0 \BaseNamedObjects\userenv:  User
Profile setup event
00000848 hh.exe         Event          008c
\BaseNamedObjects\crypt32LogoffEvent
00000848 hh.exe         Event          02a8
\BaseNamedObjects\GuardEventmmGlobalPnpInfoGuard
00000848 hh.exe         Event          02dc \BaseNamedObjects\mixercallback
00000848 hh.exe         Event          02e8
\BaseNamedObjects\hardwaremixercallback

Example 6: List Handles for WinLogon Open Windows

To generate a list of open windows that contain WinLogon and send the output to the file C:\Output\Ohwinlogon.txt, type the following at the command line:

oh winlogon /o c:\output\ohwinlogon.txt

Looking in Ohwinlogon.txt, you then see output similar to the following:

000000E0 winlogon.exe   Desktop        0094 \Winlogon
000000E0 winlogon.exe   Mutant         00bc \BaseNamedObjects\winlogon:
Logon UserProfileMapping Mutex
000000E0 winlogon.exe   Key            00dc
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\crypt32chain
000000E0 winlogon.exe   Key            00e0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\cryptnet
000000E0 winlogon.exe   Key            00f0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\sclgntfy
000000E0 winlogon.exe   Key            01d0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
000000E0 winlogon.exe   Key            020c
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
000000E0 winlogon.exe   Key            02e0
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Credentials
000000E0 winlogon.exe   Event          06d0 \BaseNamedObjects\winlogon:
machine GPO Event 49931
000000E0 winlogon.exe   File           0758 \winlogonrpc
000000E0 winlogon.exe   File           075c \winlogonrpc
000000E0 winlogon.exe   Key            0774
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\ScCertProp
000000E0 winlogon.exe   Event          07a4 \BaseNamedObjects\winlogon:
User GPO Event 73045
000000E0 winlogon.exe   Key            0838
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Example 7: List Handles for Mutant Objects with Open Windows

To generate a list of mutant objects as well as unnamed open windows and send the output to the file C:\Output\Ohmutant.txt, type the following at the command line:

oh /t mutant /a /o c:\output\ohmutant.txt

Looking in Ohmutant.txt, you then see output similar to the following:

000000D8 csrss.exe      Mutant         0044 \NlsCacheMutant
000000D8 csrss.exe      Mutant         004c \NlsCacheMutant
000000E0 winlogon.exe   Mutant         0024 \NlsCacheMutant
000000E0 winlogon.exe   Mutant         0054 \BaseNamedObjects\userenv:
machine policy mutex
000000E0 winlogon.exe   Mutant         0068 \BaseNamedObjects\userenv: user
policy mutex
000000E0 winlogon.exe   Mutant         00a4 \BaseNamedObjects\SingleSesMutex
000000E0 winlogon.exe   Mutant         00bc \BaseNamedObjects\winlogon:
Logon UserProfileMapping Mutex
000000E0 winlogon.exe   Mutant         00c8
000000E0 winlogon.exe   Mutant         00d0
000000E0 winlogon.exe   Mutant         01c4
\BaseNamedObjects\ShimCacheMutex[S-1-5-18]
000000E0 winlogon.exe   Mutant         01fc
000000E0 winlogon.exe   Mutant         0204
000000E0 winlogon.exe   Mutant         05ec \BaseNamedObjects\mxrapi
000000E0 winlogon.exe   Mutant         0600
\BaseNamedObjects\GuardMutexmmGlobalPnpInfoGuard
000000E0 winlogon.exe   Mutant         0624
000000E0 winlogon.exe   Mutant         0658
\BaseNamedObjects\MidiMapper_Configure
000000E0 winlogon.exe   Mutant         065c
000000E0 winlogon.exe   Mutant         0660
\BaseNamedObjects\MidiMapper_modLongMessage_RefCnt
000000E0 winlogon.exe   Mutant         0668
\BaseNamedObjects\WPA_LICSTORE_MUTEX
000000E0 winlogon.exe   Mutant         066c \BaseNamedObjects\WPA_LT_MUTEX
000000E0 winlogon.exe   Mutant         0674 \BaseNamedObjects\WPA_LT_MUTEX
000000E0 winlogon.exe   Mutant         0678 \BaseNamedObjects\WPA_RT_MUTEX
000000E0 winlogon.exe   Mutant         0680 \BaseNamedObjects\WPA_LT_MUTEX
000000E0 winlogon.exe   Mutant         0684 \BaseNamedObjects\WPA_PR_MUTEX
000000E0 winlogon.exe   Mutant         0688 \BaseNamedObjects\WPA_RT_MUTEX
000000E0 winlogon.exe   Mutant         068c \BaseNamedObjects\WPA_LT_MUTEX
000000E0 winlogon.exe   Mutant         06bc
000000E0 winlogon.exe   Mutant         07e4
\BaseNamedObjects\WPA_LICSTORE_MUTEX
000000E0 winlogon.exe   Mutant         0834 \BaseNamedObjects\WPA_LT_MUTEX
000000E0 winlogon.exe   Mutant         083c \BaseNamedObjects\WPA_RT_MUTEX
000000E0 winlogon.exe   Mutant         0840 \BaseNamedObjects\WPA_LT_MUTEX
000000E0 winlogon.exe   Mutant         0844 \BaseNamedObjects\WPA_PR_MUTEX
000000E0 winlogon.exe   Mutant         0848 \BaseNamedObjects\WPA_RT_MUTEX
000000E0 winlogon.exe   Mutant         084c \BaseNamedObjects\WPA_LT_MUTEX
00000110 services.exe   Mutant         0030 \NlsCacheMutant
00000110 services.exe   Mutant         008c
00000110 services.exe   Mutant         0094
00000110 services.exe   Mutant         009c
00000110 services.exe   Mutant         00a4
00000110 services.exe   Mutant         00ac
00000110 services.exe   Mutant         00b4
00000110 services.exe   Mutant         00bc
00000110 services.exe   Mutant         00c4
00000110 services.exe   Mutant         00cc
00000110 services.exe   Mutant         00d4
00000110 services.exe   Mutant         00dc
00000110 services.exe   Mutant         00e4
00000110 services.exe   Mutant         00ec
00000110 services.exe   Mutant         00f4
00000110 services.exe   Mutant         00fc
00000110 services.exe   Mutant         0104
00000110 services.exe   Mutant         010c
00000110 services.exe   Mutant         0114
00000110 services.exe   Mutant         011c
00000110 services.exe   Mutant         0124
00000110 services.exe   Mutant         012c
00000110 services.exe   Mutant         0134
00000110 services.exe   Mutant         013c
00000110 services.exe   Mutant         0144
00000110 services.exe   Mutant         014c
00000110 services.exe   Mutant         0154
00000110 services.exe   Mutant         015c
00000110 services.exe   Mutant         0164
00000110 services.exe   Mutant         016c
00000110 services.exe   Mutant         0174
00000110 services.exe   Mutant         017c
00000110 services.exe   Mutant         0184
00000110 services.exe   Mutant         01bc
00000110 services.exe   Mutant         0400 \BaseNamedObjects\PnP_Init_Mutex
00000110 services.exe   Mutant         043c
\BaseNamedObjects\ShimCacheMutex[S-1-5-20]
0000011C lsass.exe      Mutant         0030 \NlsCacheMutant
0000011C lsass.exe      Mutant         0344
0000011C lsass.exe      Mutant         034c
000001A0 svchost.exe    Mutant         0024 \NlsCacheMutant
000001A0 svchost.exe    Mutant         04c0
\BaseNamedObjects\ShimCacheMutex[S-1-5-18]
000001BC svchost.exe    Mutant         0024 \NlsCacheMutant
000001BC svchost.exe    Mutant         00cc
\BaseNamedObjects\746bbf3569adEncrypt
000001BC svchost.exe    Mutant         00f4
000001BC svchost.exe    Mutant         01a8
000001BC svchost.exe    Mutant         024c
000001BC svchost.exe    Mutant         0258
000001BC svchost.exe    Mutant         025c
00000200 svchost.exe    Mutant         0024 \NlsCacheMutant
00000200 svchost.exe    Mutant         02c0
00000200 svchost.exe    Mutant         02c8
00000200 svchost.exe    Mutant         02f0
00000200 svchost.exe    Mutant         03a8
00000200 svchost.exe    Mutant         0494
00000200 svchost.exe    Mutant         049c
00000200 svchost.exe    Mutant         054c
\BaseNamedObjects\ShimCacheMutex[S-1-5-18]
00000200 svchost.exe    Mutant         0564
\BaseNamedObjects\0CADFD67AF62496dB34264F000F5624A
00000200 svchost.exe    Mutant         0568
\BaseNamedObjects\4FCC0DEFE22C4f138FB9D5AF25FD9398
00000200 svchost.exe    Mutant         0938
00000200 svchost.exe    Mutant         0974
00000200 svchost.exe    Mutant         0a68
00000200 svchost.exe    Mutant         0a70 \BaseNamedObjects\RasPbFile
00000200 svchost.exe    Mutant         0c24
00000200 svchost.exe    Mutant         0c68 \BaseNamedObjects\RAS_MO_02
00000200 svchost.exe    Mutant         0c6c \BaseNamedObjects\RAS_MO_01
00000200 svchost.exe    Mutant         0d74
00000200 svchost.exe    Mutant         0df4
\BaseNamedObjects\_!MSFTHISTORY!_
00000200 svchost.exe    Mutant         0dfc \BaseNamedObjects\c:!documents
and settings!default user.windows!local settings!temporary internet
files!content.ie5!
00000200 svchost.exe    Mutant         0e04 \BaseNamedObjects\c:!documents
and settings!default user.windows!cookies!
00000200 svchost.exe    Mutant         0e08 \BaseNamedObjects\c:!documents
and settings!default user.windows!local settings!history!history.ie5!
00000200 svchost.exe    Mutant         0e1c
\BaseNamedObjects\WininetStartupMutex
00000200 svchost.exe    Mutant         0e24
00000200 svchost.exe    Mutant         0e28
00000200 svchost.exe    Mutant         0e2c
\BaseNamedObjects\WininetProxyRegistryMutex
00000230 csrss.exe      Mutant         0050 \Sessions\1\NlsCacheMutant
00000230 csrss.exe      Mutant         0058 \Sessions\1\NlsCacheMutant
00000234 winlogon.exe   Mutant         0024 \Sessions\1\NlsCacheMutant
00000234 winlogon.exe   Mutant         0054 \BaseNamedObjects\userenv:
machine policy mutex
00000234 winlogon.exe   Mutant         0068
\Sessions\1\BaseNamedObjects\userenv: user policy mutex
0000025C csrss.exe      Mutant         0050 \Sessions\2\NlsCacheMutant
0000025C csrss.exe      Mutant         0058 \Sessions\2\NlsCacheMutant
00000260 winlogon.exe   Mutant         0024 \Sessions\2\NlsCacheMutant
00000260 winlogon.exe   Mutant         0054 \BaseNamedObjects\userenv:
machine policy mutex
00000260 winlogon.exe   Mutant         0068
\Sessions\2\BaseNamedObjects\userenv: user policy mutex
00000294 svchost.exe    Mutant         0030 \NlsCacheMutant
0000029C svchost.exe    Mutant         0030 \NlsCacheMutant
0000029C svchost.exe    Mutant         0228
\BaseNamedObjects\_!MSFTHISTORY!_
0000029C svchost.exe    Mutant         0230 \BaseNamedObjects\c:!documents
and settings!localservice.nt authority!local settings!temporary internet
files!content.ie5!
0000029C svchost.exe    Mutant         0238 \BaseNamedObjects\c:!documents
and settings!localservice.nt authority!cookies!
0000029C svchost.exe    Mutant         0244 \BaseNamedObjects\c:!documents
and settings!localservice.nt authority!local settings!history!history.ie5!
0000029C svchost.exe    Mutant         0254
\BaseNamedObjects\WininetStartupMutex
0000029C svchost.exe    Mutant         0258
0000029C svchost.exe    Mutant         025c
0000029C svchost.exe    Mutant         0260
\BaseNamedObjects\WininetProxyRegistryMutex
0000029C svchost.exe    Mutant         02cc
0000029C svchost.exe    Mutant         02d0 \BaseNamedObjects\RasPbFile
000002D8 spoolsv.exe    Mutant         0024 \NlsCacheMutant
000002D8 spoolsv.exe    Mutant         0168
000002D8 spoolsv.exe    Mutant         0170
000002FC msdtc.exe      Mutant         0030 \NlsCacheMutant
000003B8 inetinfo.exe   Mutant         0024 \NlsCacheMutant
000003B8 inetinfo.exe   Mutant         02c0
000003B8 inetinfo.exe   Mutant         051c \BaseNamedObjects\DBWinMutex
000003B8 inetinfo.exe   Mutant         0580
000003B8 inetinfo.exe   Mutant         0588
000003CC llssrv.exe     Mutant         0030 \NlsCacheMutant
000003A8 NSPMON.exe     Mutant         0030 \NlsCacheMutant
0000041C NSCM.exe       Mutant         0030 \NlsCacheMutant
0000041C NSCM.exe       Mutant         0054
\BaseNamedObjects\McmServPERF_REGISTRY_MUTEX
0000041C NSCM.exe       Mutant         0060
0000041C NSCM.exe       Mutant         00b8
\BaseNamedObjects\ASP_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         00c0
\BaseNamedObjects\ContentFilter_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         00c8
\BaseNamedObjects\ContentIndex_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         00d0
\BaseNamedObjects\InetInfo_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         00d8
\BaseNamedObjects\ISAPISearch_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         00e0
\BaseNamedObjects\MSDTC_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         00e8
\BaseNamedObjects\MSFtpsvc_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         00f0
\BaseNamedObjects\NntpSvc_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         00f8
\BaseNamedObjects\nsstation_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0100
\BaseNamedObjects\nsunicast_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0108
\BaseNamedObjects\NTFSDRV_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0110
\BaseNamedObjects\PerfDisk_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0118
\BaseNamedObjects\PerfNet_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0120
\BaseNamedObjects\PerfOS_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0128
\BaseNamedObjects\PerfProc_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0130
\BaseNamedObjects\RemoteAccess_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0138
\BaseNamedObjects\RSVP_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0140
\BaseNamedObjects\SMTPSVC_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0148
\BaseNamedObjects\Spooler_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0150
\BaseNamedObjects\TapiSrv_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0158
\BaseNamedObjects\Tcpip_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0160
\BaseNamedObjects\TermService_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0168
\BaseNamedObjects\W3SVC_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0170
\BaseNamedObjects\WmiApRpl_Perf_Library_Lock_PID_41c
0000041C NSCM.exe       Mutant         0174
\BaseNamedObjects\McmServPERF_INFO_MUTEX
0000041C NSCM.exe       Mutant         01f4 \BaseNamedObjects\Shared Mutex
for McmServ Data Collection_0
0000046C svchost.exe    Mutant         0030 \NlsCacheMutant
000004C0 svchost.exe    Mutant         0024 \NlsCacheMutant
000004C0 svchost.exe    Mutant         00b4
000004C0 svchost.exe    Mutant         00bc
000004C0 svchost.exe    Mutant         00e4
\BaseNamedObjects\WINMGMT_MARSHALLING_SERVER
000004C0 svchost.exe    Mutant         00f0
\BaseNamedObjects\WINMGMT_KEEP_NEW_CLIENTS_AT_BAY
000004C0 svchost.exe    Mutant         0198
000004C0 svchost.exe    Mutant         0238 \BaseNamedObjects\WINMGMT_ACTIVE
000004C0 svchost.exe    Mutant         0248
000004C0 svchost.exe    Mutant         024c
\BaseNamedObjects\ShimCacheMutex[S-1-5-18]
000003DC dfssvc.exe     Mutant         0024 \NlsCacheMutant
000004F0 NSUM.exe       Mutant         0030 \NlsCacheMutant
000004F0 NSUM.exe       Mutant         0054
\BaseNamedObjects\AsfServPERF_REGISTRY_MUTEX
000004F0 NSUM.exe       Mutant         0060
000004F0 NSUM.exe       Mutant         00b8
\BaseNamedObjects\ASP_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         00c0
\BaseNamedObjects\ContentFilter_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         00c8
\BaseNamedObjects\ContentIndex_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         00d0
\BaseNamedObjects\InetInfo_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         00d8
\BaseNamedObjects\ISAPISearch_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         00e0
\BaseNamedObjects\MSDTC_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         00e8
\BaseNamedObjects\MSFtpsvc_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         00f0
\BaseNamedObjects\NntpSvc_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         00f8
\BaseNamedObjects\nsstation_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0100
\BaseNamedObjects\nsunicast_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0108
\BaseNamedObjects\NTFSDRV_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0110
\BaseNamedObjects\PerfDisk_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0118
\BaseNamedObjects\PerfNet_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0120
\BaseNamedObjects\PerfOS_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0128
\BaseNamedObjects\PerfProc_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0130
\BaseNamedObjects\RemoteAccess_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0138
\BaseNamedObjects\RSVP_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0140
\BaseNamedObjects\SMTPSVC_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0148
\BaseNamedObjects\Spooler_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0150
\BaseNamedObjects\TapiSrv_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0158
\BaseNamedObjects\Tcpip_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0160
\BaseNamedObjects\TermService_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0168
\BaseNamedObjects\W3SVC_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0170
\BaseNamedObjects\WmiApRpl_Perf_Library_Lock_PID_4f0
000004F0 NSUM.exe       Mutant         0174
\BaseNamedObjects\AsfServPERF_INFO_MUTEX
000004F0 NSUM.exe       Mutant         01dc \BaseNamedObjects\Shared Mutex
for AsfServ Data Collection_0
00000548 nspm.exe       Mutant         0030 \NlsCacheMutant
000005C8 svchost.exe    Mutant         0024 \NlsCacheMutant
000000F8 explorer.exe   Mutant         0024 \NlsCacheMutant
000000F8 explorer.exe   Mutant         0070
\BaseNamedObjects\ExplorerIsShellMutex
000000F8 explorer.exe   Mutant         0100
000000F8 explorer.exe   Mutant         0178
\BaseNamedObjects\WininetStartupMutex
000000F8 explorer.exe   Mutant         01e0
\BaseNamedObjects\ZonesCounterMutex
000000F8 explorer.exe   Mutant         025c
\BaseNamedObjects\_!MSFTHISTORY!_
000000F8 explorer.exe   Mutant         0278
000000F8 explorer.exe   Mutant         02b0 \BaseNamedObjects\_SHuassist.mtx
000000F8 explorer.exe   Mutant         02b4
000000F8 explorer.exe   Mutant         02bc \BaseNamedObjects\c:!documents
and settings!user.xp!local
settings!history!history.ie5!mshist012001052220010523!
000000F8 explorer.exe   Mutant         02f0
\BaseNamedObjects\ShimCacheMutex[S-1-5-21-484763869-113007714-839522115-1010]
000000F8 explorer.exe   Mutant         02fc
000000F8 explorer.exe   Mutant         0304
\BaseNamedObjects\GuardMutexmmGlobalPnpInfoGuard
000000F8 explorer.exe   Mutant         0328 \BaseNamedObjects\mxrapi
000000F8 explorer.exe   Mutant         0344
000000F8 explorer.exe   Mutant         0368
000000F8 explorer.exe   Mutant         0398
000000F8 explorer.exe   Mutant         041c
\BaseNamedObjects\WininetProxyRegistryMutex
000000F8 explorer.exe   Mutant         0448 \BaseNamedObjects\c:!documents
and settings!user.xp!cookies!
000000F8 explorer.exe   Mutant         0458
\BaseNamedObjects\ZonesCacheCounterMutex
000000F8 explorer.exe   Mutant         0470 \BaseNamedObjects\c:!documents
and settings!user.xp!local settings!temporary internet files!content.ie5!
000000F8 explorer.exe   Mutant         0480
\BaseNamedObjects\WininetConnectionMutex
000000F8 explorer.exe   Mutant         0494
000000F8 explorer.exe   Mutant         0498 \BaseNamedObjects\c:!documents
and settings!user.xp!local settings!history!history.ie5!
000000F8 explorer.exe   Mutant         04a0
\BaseNamedObjects\_!SHMSFTHISTORY!_
000000F8 explorer.exe   Mutant         04cc
000000F8 explorer.exe   Mutant         04f4
000000F8 explorer.exe   Mutant         0558
0000079C svchost.exe    Mutant         0024 \NlsCacheMutant
0000079C svchost.exe    Mutant         0170
0000079C svchost.exe    Mutant         0178
0000079C svchost.exe    Mutant         01c8
0000079C svchost.exe    Mutant         01e4
0000079C svchost.exe    Mutant         029c
0000079C svchost.exe    Mutant         02a4
0000079C svchost.exe    Mutant         02a8
0000079C svchost.exe    Mutant         0350
0000079C svchost.exe    Mutant         0358
0000079C svchost.exe    Mutant         035c
0000079C svchost.exe    Mutant         0374
0000079C svchost.exe    Mutant         037c
0000079C svchost.exe    Mutant         03d4
0000079C svchost.exe    Mutant         03dc
0000079C svchost.exe    Mutant         040c
00000668 svchost.exe    Mutant         0024 \NlsCacheMutant
00000668 svchost.exe    Mutant         009c
00000668 svchost.exe    Mutant         00a4
00000668 svchost.exe    Mutant         0100
\BaseNamedObjects\StiTraceMutexSti_Trace.log
00000668 svchost.exe    Mutant         01b8
00000668 svchost.exe    Mutant         01d0
00000668 svchost.exe    Mutant         01f0
00000668 svchost.exe    Mutant         01fc
00000668 svchost.exe    Mutant         0238
00000668 svchost.exe    Mutant         028c
\BaseNamedObjects\StiTraceMutexSti_Trace.log
0000076C wuauclt.exe    Mutant         0034 \NlsCacheMutant
0000076C wuauclt.exe    Mutant         0064
\BaseNamedObjects\ZonesCounterMutex
0000076C wuauclt.exe    Mutant         0068
\BaseNamedObjects\ZonesCacheCounterMutex
0000076C wuauclt.exe    Mutant         0078
\BaseNamedObjects\AutoUpdateSingleInstance
0000076C wuauclt.exe    Mutant         01e4
0000076C wuauclt.exe    Mutant         01ec \BaseNamedObjects\RasPbFile
0000076C wuauclt.exe    Mutant         02b8
0000076C wuauclt.exe    Mutant         02c0
00000838 cmd.exe        Mutant         0030 \NlsCacheMutant
00000848 hh.exe         Mutant         0030 \NlsCacheMutant
00000848 hh.exe         Mutant         0070
\BaseNamedObjects\ZonesCounterMutex
00000848 hh.exe         Mutant         0074
\BaseNamedObjects\ZonesCacheCounterMutex
00000848 hh.exe         Mutant         015c
\BaseNamedObjects\_!MSFTHISTORY!_
00000848 hh.exe         Mutant         0164 \BaseNamedObjects\c:!documents
and settings!user.xp!local settings!temporary internet files!content.ie5!
00000848 hh.exe         Mutant         016c \BaseNamedObjects\c:!documents
and settings!user.xp!cookies!
00000848 hh.exe         Mutant         0174 \BaseNamedObjects\c:!documents
and settings!user.xp!local settings!history!history.ie5!
00000848 hh.exe         Mutant         0184
\BaseNamedObjects\WininetStartupMutex
00000848 hh.exe         Mutant         018c
\BaseNamedObjects\WininetConnectionMutex
00000848 hh.exe         Mutant         0190
00000848 hh.exe         Mutant         0194
\BaseNamedObjects\WininetProxyRegistryMutex
00000848 hh.exe         Mutant         01e0
\BaseNamedObjects\MSUIM.GlobalLangBarEventSink.Mutex
00000848 hh.exe         Mutant         01e8
\BaseNamedObjects\MSUIM.GlobalCompartment.Mutex
00000848 hh.exe         Mutant         01ec
\BaseNamedObjects\MSUIM.Assembly.Mutex
00000848 hh.exe         Mutant         01f0
\BaseNamedObjects\MSUIM.Layouts.Mutex
00000848 hh.exe         Mutant         01f4
\BaseNamedObjects\MSUIM.MarshalInterfaceMutex.TMD
00000848 hh.exe         Mutant         02b0
\BaseNamedObjects\GuardMutexmmGlobalPnpInfoGuard
00000848 hh.exe         Mutant         02d8 \BaseNamedObjects\mxrapi
00000848 hh.exe         Mutant         02f0
000002AC oh.exe         Mutant         07d4 \NlsCacheMutant

Example 8: List Handles for File Objects Containing "Explore" with Open Windows

To generate a list of key objects and send the output to the file C:\Output\Ohexplore.txt, type the following at the command line:

oh /t file explore /o c:\output\ohexplore.txt

Looking in Ohexplore.txt, you then see output similar to the following:

000000E0 winlogon.exe   File           0360 \Program Files\Internet Explorer
000000E0 winlogon.exe   File           036c \Program Files\Internet
Explorer\Connection Wizard
000000F8 explorer.exe   File           0218 \Documents and
Settings\user.XP\Application Data\Microsoft\Internet Explorer\Quick
Launch


Poolmon.exe: Pool Byte Monitor
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool monitors memory tags, including total paged and non-paged pool bytes. PoolMon is often used to help detect memory leaks.

Note

  • Unlike most command-line tools, help for PoolMon is available after running the tool by typing "h" or "?".

Corresponding UI

There is no corresponding user interface for PoolMon.

Concepts

Memory leaks occur when programs allocate memory but neglect to free it when the memory is no longer being used. For more information about memory management and memory leaks, search the Microsoft Developers' Network (http://www.microsoft.com/).

System Requirements

The following are the system requirements for PoolMon:

  • Windows XP Professional

Files required

  • Poolmon.exe
  • msdis110.dll
  • msvcp60.dll


PoolMon Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Before Using PoolMon

Before running PoolMon, you must enable pool tagging on your computer. The easiest way to do this is to use Gflags.exe to edit the registry entry for you.

To enable pool tagging using the GUI method:

  1. Run the Global Flags Editor.
  2. Click Enable Pool Tagging.
  3. Click Apply, and then click OK.
  4. Restart the computer. You are now ready to run PoolMon.

To enable pool tagging using the command-line method:

  1. Type the following at the command line:
    gflags -r +ptg
  2. Restart the computer. You are now ready to run PoolMon.

Using PoolMon

PoolMon displays pool tag information within a command window. Use the arrow keys, or PAGE UP and PAGE DOWN keys, to display all tag information returned by the tool.

Once you have started PoolMon, use the following keys to change how the information is displayed:

General functions | Action
p | Sorts tag list by paged, non-paged, or both. Press the key again to cycle through each option.
l | Toggles highlighting of changed lines on and off.
e | Toggles pool totals at the bottom of the data on and off.
h or ? | Displays PoolMon help. To exit help, press the ESC key.
q or ESC | Quits PoolMon.
Sorting functions | Action
t | Sorts tags alphabetically by tag name.
a | Sorts tags by allocation size.
f | Sorts tags by "frees".
d | Sorts tags by difference between allocs and frees.
b | Sorts tags by maximum byte usage.
m | Sorts tags by maximum byte allocation.

Note

  • Sorting options can also be used as command-line flags when starting PoolMon.

PoolMon Output

The columns displayed by PoolMon in the command window show usage for each tag name. By monitoring periodically which tag's bytes are increasing in allocation without being freed up, you may be able to identify a possible leakage.

Column name | Description
Tag | The 4-byte tag given to the pool allocation.
Type | Paged or non-paged bytes.
Allocs | A count of all allocations.
( ) | The difference in Allocs column from last update.
Frees | A count of all frees.
( ) | The difference in Frees column from last update.
Diff | The difference between Allocs and Frees.
Bytes | The total bytes consumed in pool.
( ) | The difference in Bytes column from last update.
Per Alloc | The Bytes value divided by the Diff value.

The following shows an excerpt of PoolMon output:

Memory: 16224K Avail: 4564K PageFlts: 31 InRam Krnl: 684K P: 680K
 Commit: 24140K Limit: 24952K Peak: 24932K  Pool N: 744K P: 2180K

 Tag  Type    Allocs          Frees         Diff   Bytes      Per Alloc
-----------------------------------------------------------------------

 CM   Paged    1283 (   0)    1002 (   0)    281 1377312 (     0) 4901
Strg  Paged   10385 (  10)    6658 (   4)   3727  317952 (   512)   85
 Fat  Paged    6662 (   8)    4971 (   6)   1691  174560 (   128)  103
MmSt  Paged     614 (   0)     441 (   0)    173   83456 (     0)  482


PoolMon Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

PoolMon uses the following syntax:

One Step poolmon [/i Tag] [/x Tag] [/t|/p|/a|/f|/d|/b|/m] [/e] [/l]

Parameters

/i Tag
List only matching pool tag names; a tag name can include * and ?. Tag values are case-sensitive.
/x Tag
List everything except matching pool tag names; a tag name can include * and ?. Tag values are case-sensitive.
/t
Sorts tags alphabetically by tag name.
/p
Sorts tag list by non-paged. Once PoolMon starts, use p again to cycle through other options.
/a
Sorts tags by allocation size.
/f
Sorts tags by "frees" size.
/d
Sorts tags by size difference between allocations and frees.
/b
Sorts tags by maximum byte usage.
/m
Sorts tags by maximum byte allocation.
/e
Displays pool totals at the bottom of the data.
/l
Disables highlighting of changed lines.

Note

  • You can start PoolMon with or without options. All command-line sorting parameters are available after starting PoolMon.
  • Unlike most command-line tools, help for PoolMon is available after running the tool by typing "h" or "?".
  • Due to command window limitations, PoolMon may not show all memory tags at all times.


PoolMon Examples
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Detect Memory Leakage

In this scenario, a memory leak is caused by an application or by a process that allocates memory for use, but does not free it when finished. The result is that available memory is completely used over time, often causing the system to stop functioning properly.

It will probably take a few hours of generating data before you can make a determination about what is causing the problem. Starting your test will cause the counters to jump. It may take a while for the memory pools to reach a steady state.

  1. Run PoolMon.
  2. Press P until PoolMon comes up with the second column "Type" showing the value "Paged".
  3. Press B. This will sort the tag usage bytes from largest to smallest.
  4. Start your test, and leave it running.
  5. Save the information generated by PoolMon, either as a screenshot, or by copying it out of the command window and pasting it into Notepad.
  6. Press P until only "Non-paged" tags are displayed.
  7. Press B. This will sort the tag usage bytes from largest to smallest.
  8. Save the information generated by PoolMon, either as a screenshot, or by copying it out of the command window and pasting it into Notepad.
  9. Repeat these steps approximately every half-hour, for at least two hours.

At the end of this time, you can analyze the tags to see which ones are continuing to increase in size. Stop your test and wait a few hours. See how many of the tag(s) you found that were increasing in size have freed their allocations. The ones that have not been freed, or have continued to increase in size are likely culprits.

Example 2: Analyze Pool Memory Leak Using the Drsd Tag

The Drsd tag is attached to all allocations made by the Drvalloc() function in the Rasdd.dll and Hprasdd.dll files. All print drivers use this tag for allocating Graphical Device Interface (GDI) objects and memory. If a print driver has an object leak, it can cause the Drsd tag to also leak.

Note

  • Before proceeding with the steps in this example, you must ensure that your server is not being used. If more than one user is printing to the server at one time, the results of these troubleshooting steps can be invalid.

We will use the following steps to identify which driver is triggering the memory leak.

  1. Run GFlags.
  2. Click Enable Pool Tagging.
  3. Click Apply and then click OK.
  4. Restart the computer so that the pool tagging changes can take effect.
  5. Use the /i parameter to have PoolMon display information only for a specified tag. Remember that pool tags are case sensitive so you must type Drsd (not drsd or DRSD) if that is the tag for which you want to see information. Type the following at the command line:

    poolmon /iDrsd

  6. Record the diff number for the Drsd tag. The diff number for the following PoolMon sample is 21 and the number of bytes is 17472.

    The output will look similar to the following:

    Memory:  130480K Avail:   91856K  PageFlts:  1220   InRam Krnl: 2484K P: 7988K
 Commit:  30104K Limit: 248432K Peak:  34028K            Pool N: 2224K P: 8004K
 Tag  Type     Allocs            Frees            Diff   Bytes      Per Alloc

 Drsd Paged       560 ( 177)       539 ( 171)       21   17472 (  4992)    832
  7. Print a job to a single printer, wait about one minute for the computer system to return to normal, and then record the diff number after you performed the print job.

    The output will look similar to the following:

    Memory:  130480K Avail:   91808K  PageFlts:  1240   InRam Krnl: 2488K P: 7996K
 Commit:  30152K Limit: 248432K Peak:  34052K            Pool N: 2224K P: 8012K
 Tag  Type     Allocs            Frees            Diff   Bytes      Per Alloc

 Drsd Paged       737 (   0)       710 (   0)       27   22464 (     0)    832

In this example, the diff number is 27, and the number of bytes is now 22464. The difference between the initial and subsequent output means that six Drsd blocks, with a total of 4992 bytes, leaked during the print job. If the diff number had returned to its original value of 21 after the print job, you could interpret such an output to indicate that the driver did not leak.

If Drsd was not the leaking driver, you could perform these steps for each print driver on your computer system, until you identify the driver that was leaking memory.

For more information

When you identify the leaking driver, go to the Product Support Services (http://go.microsoft.com/fwlink/?LinkId=1679) Web site and search the Knowledge Base for relevant articles.


Pstat.exe: Process and Thread Status
Overview | Syntax | Examples | Related Tools Run Tool

This command-line tool lists all running processes and threads and displays their status. This tool is similar to Quick Slice, but uses a command-line rather than a GUI interface.

The current version of PStat takes a system snapshot and shows old PStat-style and PMon data, along with Drivers output, in a single output stream. This output can be useful for troubleshooting.

Note

  • Quick Slice and Drivers are tools that ship with the Windows 2000 Resource Kit.

Corresponding UI

There is no corresponding user interface for PStat.

Concepts

For more information on performance, see Introduction to Performance in Help and Support Center.

System Requirements

The following are the system requirements for PStat:

  • Windows XP Professional

File required

  • Pstat.exe


PStat Syntax
Overview | Syntax | Examples | Related Tools Run Tool

PStat uses the following syntax:

One Step pstat

Parameters

PStat has no parameters.


PStat Examples
Overview | Syntax | Examples | Related Tools Run Tool

Example 1: Output Process and Thread Status to a Log File

In this example, you want to output process and thread status information to a logfile called mystatus_log.txt. Type the following at the command prompt:

pstat > mystatus_log.txt

PStat will output all running processes, threads, and their status to the mystatus_log.txt file. The logfile will look similar to the following:

Pstat version 0.3:  memory: 130528 kb  uptime:  0  4:28:15.709

PageFile: \??\C:\pagefile.sys
    Current Size: 196608 kb  Total Used:  56464 kb   Peak Used  56472 kb

 Memory: 130528K Avail:  46352K  TotalWs:  84956K InRam Kernel: 2012K P:11416K
 Commit: 126696K/  90060K Limit: 315320K Peak: 155972K  Pool N: 6472K P:14312K

    User Time   Kernel Time    Ws   Faults  Commit Pri Hnd Thd Pid Name
                            27444   281990                         File Cache
  0:00:00.000   4:24:06.606    20        1       0  0    0   1   0 Idle Process
  0:00:00.000   0:00:22.953   216     3294      36  8  252  41   4 System
  0:00:00.070   0:00:00.080   420      752     172 11   22   3 428 smss.exe
  0:00:01.842   0:00:11.716  2296    20494    1664 13  384  12 492 csrss.exe
  0:00:12.407   0:00:15.822  3856    10159    5860 13  536  18 524 winlogon.exe
  0:00:13.799   0:00:18.536  2040     3009    4140  9  294  15 568 services.exe
  0:00:01.151   0:00:01.241  2712    16134    4504  9  340  20 580 lsass.exe
  0:00:00.280   0:00:00.270  1772     1345    1192  8  281  10 768 svchost.exe
  0:00:22.101   0:00:18.156  7292    16859   10420  8 1217  69 820 svchost.exe
  0:00:00.110   0:00:00.210  1132     2173     680  8   71   5 996 svchost.exe
  0:00:00.150   0:00:00.270  1964     2540    2308  8  288  18 1096 svchost.exe
  0:00:00.140   0:00:01.862   936     4325    2468  8  133   9 1140 spoolsv.exe
  0:00:05.047   0:00:06.269  3260     2257    4508  8  101  21 1272 inojobsv.exe
  0:00:01.071   0:00:01.532   180     4822    1700  8  117   5 1364 clisvcl.exe
  0:00:00.030   0:00:00.160   796     1546     808  8   82   4 1396 mdm.exe
  0:00:00.460   0:00:01.522   232     3673    1412  8  163   5 1976 SMSAPM32.exe
  0:00:02.163   0:00:08.081  7672     9232    7208  8  315  11 360 explorer.exe
  0:00:00.160   0:00:00.350   336     2940    1224  8   81   2 400 launch32.exe
  0:00:00.060   0:00:00.120  1452     2176    1072  8  106   2 456 msmsgs.exe
  0:00:00.230   0:00:00.470  1848     2736     540  8  135   1 276 ctfmon.exe
  0:00:00.030   0:00:00.090   792     1000    1160  8   46   2 244 realmon.exe
  0:00:00.140   0:00:00.240   156    12256    1088  8  106   4 1800 SMSMon32.exe
  0:00:04.566   0:00:05.668  5868    13318    8720  8  501  12 1912 OUTLOOK.EXE
  0:00:16.223   0:00:12.127  4996    10896   10060  8  257   3 1768 WINWORD.EXE
  0:00:00.741   0:00:01.241  1004     2519    1444  8   72   3 1888 SSEXP.EXE
  0:00:04.416   0:00:05.968  1420     9512   13964  8  288   8 1092 WINPROJ.EXE
  0:00:00.010   0:00:00.040  1748      455    1416  8   23   1 1896 cmd.exe
  0:00:00.010   0:00:00.010  1096      272     292  8   14   1 1600 pstat.exe


Setx.exe: Set Environment Variables
Overview | Notes | Syntax | Related Tools Open Command Prompt

This command-line tool offers administrators a batch method for setting environment variables in the user or system environment and requires no programming or scripting. In addition to taking an environment variable and its associated value from the command line, it can also get the values of registry keys and write them to text files.

You can use SetX to set values for user and system environment variables from one of three sources: Command Line Mode, Registry Mode, or File Mode.

Notes

  • SetX is similar to the UNIX utility SETENV.
  • SetX writes variables to the master environment in the registry.
  • Variables set by using SetX are available only in future command windows and not in the current command window.

Corresponding UI

SetX provides the only command-line or programmatic way to directly set system environment values for Microsoft Windows XP. System environment variables can be manually configured by using Control Panel or by using a registry editor (Regedit). The Set command (which is part of the Windows operating system) only uses environment variables for the current console window.

Concepts

For more information on environment variables, see Setting environment variables or Using environment variables to manage workstations in the Help and Support Center.

System Requirements

The following are the system requirements for SetX:

  • Windows XP Professional

File Required

  • Setx.exe


SetX Notes
Overview | Notes | Syntax | Related Tools Open Command Prompt

Known SetX Limitations

The following list contains known limitations for SetX:

  • SetX writes variables to the master environment in the registry. Variables set with SetX variables are available only in future command windows, not in the current command window. This is a limitation of Windows XP.
  • When gaining access to REG_MULTI_SZ values in the registry, only the first item is extracted and used.
  • The only supported hives are HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE.
  • Values added to the user or system environments cannot be removed with SetX. A corresponding value can be removed from the local environment by using SET with a variable name and no value.
  • Registry values of type REG_DWORD are extracted and used in hexadecimal mode.
  • File Mode supports the parsing of CR-LF text files only.


SetX Syntax
Overview | Notes | Syntax | Related Tools Open Command Prompt

SetX uses the following general syntax:

One Step setx [Parameters]

Command-Line Mode

One Step setx Variable Value [/m]

Parameters

Variable
Specifies the name of the environment variable to set.
Value
Specifies the value to which the environment variable will be set.
/m
Specifies that the value being set is in the system environment. The default is the user environment.

Sample Usage

setx machine compaq
setx machine "COMPAQ COMPUTER" /m
setx mypath %path%
setx mypath ~PATH~

File Mode

One Step setx Variable /f FileName {/a XCoordinate , YCoordinate|/r XCoordinate , YCoordinate " String "} [/d {Delimiter] [/x] [/m]

Parameters

/f FileName
Specifies the name of the file to use.
/a XCoordinate , YCoordinate
Specifies absolute coordinates and offset as search parameters.
/r XCoordinate , YCoordinate " String "
Specifies relative coordinates and offset from String as search parameters.
/d Delimiter
Specifies additional delimiters (d) such as "," or "\".

The built-in delimiters are space, tab, carriage return, and line feed. Any ASCII character can be used as an additional delimiter. The maximum number of delimiters, including the four that are built in, is 15.

/x
Displays file coordinates. The /a, /r, and /d parameters are ignored when /x is specified.
/m
Specifies that the value being set is in the system environment. The default is the user environment.

Sample Usage

setx var /f ipconfig.out -x
setx ipaddr /f ipconfig.out /a 5,11
setx octet1 /f ipconfig.out /a 5,3 /d .
setx ipgateway /f ipconfig.out /r 0,7 "Gateway"

Registry Mode

One Step setx Variable /k Hive\Key\...\Value [/m]

Parameters

Variable
Specifies the name of the environment variable to set.
/k
Specifies that the variable is set based on information from a registry key.
Hive\Key\...\Value
Specifies the registry path to the value for the environment variable (for example: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInformation\StandardName).
/m
Specifies that the value being set is in the system environment. The default is the user environment.

Sample Usage

setx tzone /k HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInform ation\StandardName
setx build /k "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumber"

Note

  • Quotes must be used in the last example because of the embedded space in "Windows NT."


Spcheck.exe: Service Pack Checker

Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool is used by administrators to determine which service pack is installed on a Windows XP, Windows 2000, or Windows NT 4.0 system. SPCheck checks which executable files, dynamic-link libraries, and drivers are installed on the target system. This helps to identify when service packs or hot fixes should be reinstalled and ensures that all installed services are at the appropriate service pack level.

Notes

  • You must run SPCheck from the command window.
  • SPCheck must run under a security context equivalent to the local administrator account.
  • To obtain .ini files for SPCheck, search the Microsoft (http://go.microsoft.com/fwlink/?LinkId=1681) Web site and/or contact Microsoft Product Support Services.

Corresponding UI

There is no corresponding user interface for SPCheck.

Concepts

A service pack is a consolidated release of updates for a specific piece of software.

You can find service packs to download at the Windows Update (http://go.microsoft.com/fwlink/?LinkId=1682) Web site.

System Requirements

The following are the system requirements for SPCheck:

  • Windows XP Professional
  • Windows 2000 Professional and Server
  • Windows NT 4.0

Files Required

  • Spcheck.exe
  • Dbghelp.dll (located in the \Windir\System32 folder)
  • Spcheck.ini


SPCheck Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Understanding SPCheck

SPCheck examines target components one file at a time. This means that SPCheck must run under a security context equivalent to the local administrator account. If the tool is not run under this security context, files may be reported as missing even though they are installed on the system. The tool compares the size and date of each file to those listed in Spcheck.ini. SPCheck's search algorithm uses system environment variables in combination with other methods to find and report on target files located on the target system.

Interpreting the Results

SPCheck creates a report detailing the results of its scan in the same directory from which SPCheck was run. It has the following format:

  [WINS]
  C:\WINNT\System32\Jet500.dll SP0-3
  C:\WINNT\System32\Jet.dll SP0-6a
  C:\WINNT\System32\Wins.exe Missing
  C:\WINNT\System32\Winsadmin.exe Unknown
  C:\WINNT\System32\Winsctrl.dll SP5

"Missing" indicates that the file was not found on the target system, and "Unknown" indicates that the file was found on the target system but did not match any of the files recorded in the .ini file.

Not all files are updated for each service pack release. For example, in the report excerpted here SP0-3 means that Jet500.dll did not change in any of the first three service packs.


SPCheck Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

SPCheck uses the following syntax:

One Step spcheck [/i INIFileName] [/r RepFileName]

Parameters

/i INIFileName
Specifies the name of the .ini file to be used. If this parameter is omitted, Spcheck.ini is used.
/r RepFileName
Specifies the name of the report file that is generated when the tool is run. If this parameter is omitted, the default report name Spcheck.rpt is used.

Examples

See Example: Verify that the RRAS Services are at the Required Service Pack Level.


SPCheck Examples
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Example: Verify that the RRAS Services Are at the Required Service Pack Level

Your organization has purchased some new RRAS management software made by another company. After it is installed, the RRAS services no longer function properly. You are concerned that the software might have replaced some of the critical RRAS files with previous versions. After searching on the Microsoft web site, you find a Rras.ini file for use with SPCheck. To verify that the RRAS files are current, you execute the following command:

spcheck.exe /i rras.ini /r rras.txt

In this example, SPCheck used a .ini file named Rras.ini and created a report named Rras.txt. The following output is an excerpt from Rras.txt:

  [RRAS]
  C:\WINNT\System32\Rascfg.dll SP0-3
  C:\WINNT\System32\Rasfil32.dll SP0-2
  C:\WINNT\System32\Rasadmin.exe SP0-3
  C:\WINNT\System32\Rassapi.dll SP0-1
  C:\WINNT\System32\Rasphone.exe SP0-2

You can see by this report that if the target system has Service Pack 1 (SP1) installed on it, each file is within the necessary range for the service pack: The target system contains RRAS-related files that are consistent with SP1. This indicates that the issue is not file related, but probably a configuration problem. You can find more tips on interpreting the report's format at the end of each report.


Xcacls.exe
Overview | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool sets all file-system security options that are accessible in Windows Explorer. XcAcls does this by displaying and modifying the access control lists (ACLs) of files.

XcAcls is especially useful in unattended installations of Microsoft Windows XP. Using this tool, you can set the initial access rights for folders in which the operating system resides. When you distribute software to servers or workstations, XcAcls also offers one-step protection against deletion of directories or files by users.

Corresponding UI

File-system security options can be set manually from Windows Explorer.

To set file-security options from Windows Explorer:

  1. Right-click the file or folder for which you want to set security.
  2. Select Sharing or Properties.
  3. Select the Security tab.
  4. Click Advanced.

Concepts

For more information on ACLs, see Access Control concepts or Understanding Access Control in Help and Support Services.

System Requirements

The following are the system requirements for XcAcls:

  • Windows XP Professional

File required

  • Xcacls.exe


XcAcls Syntax
Overview | Syntax | Examples | Related Tools Open Command Prompt

XcAcls uses the following syntax:

One Step xcacls FileName [/t] [/e] [/c] [/g User:Permissions;Spec] [/r User] [/p User:Permissions;Spec] [...]] [/d User [...]] [/y] [/?|/h]

Parameters

FileName
Indicates the name of the file or directory to which the access control list (ACL) or access control entry (ACE) is typically applied. All standard wildcard characters can be used.
/t
Recursively walks through the current directory and all of its subdirectories, applying the chosen access rights to the matching files or directories.
/e
Edits the ACL instead of replacing it.
/c
Causes XcAcls to continue if an "access denied" error occurs. If /c is omitted, XcAcls stops on this error.
/g User:Permissions;Spec
Grants User access to the matching file or directory. Permissions apply the specified access right to files. Spec can be the same as Permissions and only applies to a directory. In this case, Permissions is used for file inheritance in this directory. Permissions and Spec accept the following values:
Value | Description
R | Read
C | Change (write)
F | Full Control
P | Change Permissions (special access)
O | Take Ownership (special access)
X | Execute (special access)
E | Read (Special access)
W | Write (Special access)
D | Delete (Special access)
T | Used only by Spec. ACE not specified. Sets an ACE for the directory itself without specifying an ACE that is applied to new files created in that directory. At least one access right must follow. Spec entries that precede T (in other words, those between the semicolon and the T) are ignored. (Special value)

Notes

  • The access options for files (special file and directory access options for directories) are identical. For detailed explanations of these options, see Permissions for files and folders or Shared resource permissions in Help and Support Services.
  • All other options, which can also be set in Windows Explorer, are subsets of all possible combinations of the basic access rights. Therefore, there are no special options for directory access rights, such as LIST or READ.
/r User
Revokes all access rights for the specified user.
/p User:Permissions;Spec
Replaces access rights for User. Permissions apply the specified access right to files. Spec can be the same as Permissions and only applies to a directory. In this case, Permissions is used for file inheritance in this directory. Permissions and Spec accept the following values:
Value | Description
R | Read
C | Change (write)
F | Full Control
P | Change Permissions (special access)
O | Take Ownership (special access)
X | Execute (special access)
E | Read (Special access)
W | Write (Special access)
D | Delete (Special access)
T | Used only by Spec. ACE not specified. Sets an ACE for the directory itself without specifying an ACE that is applied to new files created in that directory. At least one access right must follow. Spec entries that precede T (in other words, those between the semicolon and the T) are ignored. (Special value)

Notes

  • The access options for files (special file and directory access options for directories) are identical. For detailed explanations of these options, see Permissions for files and folders or Shared resource permissions in Help and Support Services.
  • All other options, which can also be set in Windows Explorer, are subsets of all possible combinations of the basic access rights. Therefore, there are no special options for directory access rights, such as LIST or READ.
/d User
Denies the specified user access to the file or directory.
/y
Disables the confirmation when replacing user access rights. By default, XcAcls asks for confirmation. Because of this feature, when XcAcls is used in a batch routine, the routine stops responding until the right answer is entered. Use the /y parameter when you use XcAcls in batch mode.


XcAcls Examples
Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Replace ACLs of All Files and Directories in the Current Directory

You want to replace the existing ACLs of all files and directories in the current directory with read and write access for the administrator, suppressing confirmation. Type the following at the command line:

xcacls *.* /g administrator:rw /y

Notice that you are not asked to confirm the change. You see output similar to the following:

processed file:  C:\data\compressed.txt
processed file:  C:\data\deptdata.txt
processed file:  C:\data\dirafter.txt
processed file:  C:\data\temp.txt
processed file:  C:\data\uncompressed.txt
processed file:  C:\data\userdata.txt

You can check to see that the command was executed by typing the following at the command line:

xcacls *.*

You see output similar to the following, confirming that the access rights have been set for the administrator:

C:\data\compressed.txt MYCOMPUTER\Administrator:(special access:)

                                           READ_CONTROL
                                           SYNCHRONIZE
                                           FILE_GENERIC_READ
                                           FILE_GENERIC_WRITE
                                           FILE_GENERIC_EXECUTE
                                           FILE_READ_DATA
                                           FILE_WRITE_DATA
                                           FILE_APPEND_DATA
                                           FILE_READ_EA
                                           FILE_WRITE_EA
                                           FILE_EXECUTE
                                           FILE_READ_ATTRIBUTES
                                           FILE_WRITE_ATTRIBUTES

C:\data\deptdata.txt MYCOMPUTER\Administrator:(special access:)

                                         READ_CONTROL
                                         SYNCHRONIZE
                                         FILE_GENERIC_READ
                                         FILE_GENERIC_WRITE
                                         FILE_GENERIC_EXECUTE
                                         FILE_READ_DATA
                                         FILE_WRITE_DATA
                                         FILE_APPEND_DATA
                                         FILE_READ_EA
                                         FILE_WRITE_EA
                                         FILE_EXECUTE
                                         FILE_READ_ATTRIBUTES
                                         FILE_WRITE_ATTRIBUTES

C:\data\dirafter.txt MYCOMPUTER\Administrator:(special access:)

                                         READ_CONTROL
                                         SYNCHRONIZE
                                         FILE_GENERIC_READ
                                         FILE_GENERIC_WRITE
                                         FILE_GENERIC_EXECUTE
                                         FILE_READ_DATA
                                         FILE_WRITE_DATA
                                         FILE_APPEND_DATA
                                         FILE_READ_EA
                                         FILE_WRITE_EA
                                         FILE_EXECUTE
                                         FILE_READ_ATTRIBUTES
                                         FILE_WRITE_ATTRIBUTES

C:\data\temp.txt MYCOMPUTER\Administrator:(special access:)

                                     READ_CONTROL
                                     SYNCHRONIZE
                                     FILE_GENERIC_READ
                                     FILE_GENERIC_WRITE
                                     FILE_GENERIC_EXECUTE
                                     FILE_READ_DATA
                                     FILE_WRITE_DATA
                                     FILE_APPEND_DATA
                                     FILE_READ_EA
                                     FILE_WRITE_EA
                                     FILE_EXECUTE
                                     FILE_READ_ATTRIBUTES
                                     FILE_WRITE_ATTRIBUTES

C:\data\uncompressed.txt MYCOMPUTER\Administrator:(special access:)

                                             READ_CONTROL
                                             SYNCHRONIZE
                                             FILE_GENERIC_READ
                                             FILE_GENERIC_WRITE
                                             FILE_GENERIC_EXECUTE
                                             FILE_READ_DATA
                                             FILE_WRITE_DATA
                                             FILE_APPEND_DATA
                                             FILE_READ_EA
                                             FILE_WRITE_EA
                                             FILE_EXECUTE
                                             FILE_READ_ATTRIBUTES
                                             FILE_WRITE_ATTRIBUTES

C:\data\userdata.txt MYCOMPUTER\Administrator:(special access:)

                                         READ_CONTROL
                                         SYNCHRONIZE
                                         FILE_GENERIC_READ
                                         FILE_GENERIC_WRITE
                                         FILE_GENERIC_EXECUTE
                                         FILE_READ_DATA
                                         FILE_WRITE_DATA
                                         FILE_APPEND_DATA
                                         FILE_READ_EA
                                         FILE_WRITE_EA
                                         FILE_EXECUTE
                                         FILE_READ_ATTRIBUTES
                                         FILE_WRITE_ATTRIBUTES

Example 2: Edit the ACLs of the Current Directory

You want to give TestUser read, write, run, and delete rights on all new files created in this directory, but only read and write permissions on the directory itself. Type the following at the command line:

xcacls *.* /g TestUser:rwed;rw /e

You see output similar to the following:

processed file:  C:\test\compressed.txt
processed file:  C:\test\deptdata.txt
processed file:  C:\test\dirafter.txt
processed file:  C:\test\temp.txt
processed file:  C:\test\uncompressed.txt
processed file:  C:\test\userdata.txt

C:\data\compressed.txt Everyone:(special access:)
                                READ_CONTROL
                                SYNCHRONIZE
                                FILE_GENERIC_READ
                                FILE_GENERIC_WRITE
                                FILE_GENERIC_EXECUTE
                                FILE_READ_DATA
                                FILE_WRITE_DATA
                                FILE_APPEND_DATA
                                FILE_READ_EA
                                FILE_WRITE_EA
                                FILE_EXECUTE
                                FILE_READ_ATTRIBUTES
                                FILE_WRITE_ATTRIBUTES

                       MYCOMPUTER\TestUser:C

C:\data\deptdata.txt Everyone:(special access:)
                              READ_CONTROL
                              SYNCHRONIZE
                              FILE_GENERIC_READ
                              FILE_GENERIC_WRITE
                              FILE_GENERIC_EXECUTE
                              FILE_READ_DATA
                              FILE_WRITE_DATA
                              FILE_APPEND_DATA
                              FILE_READ_EA
                              FILE_WRITE_EA
                              FILE_EXECUTE
                              FILE_READ_ATTRIBUTES
                              FILE_WRITE_ATTRIBUTES

                     MYCOMPUTER\TestUser:C

C:\data\dirafter.txt Everyone:(special access:)
                              READ_CONTROL
                              SYNCHRONIZE
                              FILE_GENERIC_READ
                              FILE_GENERIC_WRITE
                              FILE_GENERIC_EXECUTE
                              FILE_READ_DATA
                              FILE_WRITE_DATA
                              FILE_APPEND_DATA
                              FILE_READ_EA
                              FILE_WRITE_EA
                              FILE_EXECUTE
                              FILE_READ_ATTRIBUTES
                              FILE_WRITE_ATTRIBUTES

                     MYCOMPUTER\TestUser:C

C:\data\temp.txt Everyone:(special access:)
                          READ_CONTROL
                          SYNCHRONIZE
                          FILE_GENERIC_READ
                          FILE_GENERIC_WRITE
                          FILE_GENERIC_EXECUTE
                          FILE_READ_DATA
                          FILE_WRITE_DATA
                          FILE_APPEND_DATA
                          FILE_READ_EA
                          FILE_WRITE_EA
                          FILE_EXECUTE
                          FILE_READ_ATTRIBUTES
                          FILE_WRITE_ATTRIBUTES

                 MYCOMPUTER\TestUser:C

C:\data\uncompressed.txt Everyone:(special access:)
                                  READ_CONTROL
                                  SYNCHRONIZE
                                  FILE_GENERIC_READ
                                  FILE_GENERIC_WRITE
                                  FILE_GENERIC_EXECUTE
                                  FILE_READ_DATA
                                  FILE_WRITE_DATA
                                  FILE_APPEND_DATA
                                  FILE_READ_EA
                                  FILE_WRITE_EA
                                  FILE_EXECUTE
                                  FILE_READ_ATTRIBUTES
                                  FILE_WRITE_ATTRIBUTES

                         MYCOMPUTER\TestUser:C

C:\data\userdata.txt Everyone:(special access:)
                              READ_CONTROL
                              SYNCHRONIZE
                              FILE_GENERIC_READ
                              FILE_GENERIC_WRITE
                              FILE_GENERIC_EXECUTE
                              FILE_READ_DATA
                              FILE_WRITE_DATA
                              FILE_APPEND_DATA
                              FILE_READ_EA
                              FILE_WRITE_EA
                              FILE_EXECUTE
                              FILE_READ_ATTRIBUTES
                              FILE_WRITE_ATTRIBUTES

                     MYCOMPUTER\TestUser:C

The command edited the ACL of a file or a directory, but its effect on a directory was different. The ACE added to the directory is also an inherit ACE for new files created in this directory.

Example 3: Edit Permissions on a Directory Without Creating an Inherit for New Files

You want to grant read and write permissions on a directory for TestUser. You do not want to create an inherit entry for new files, but grant only read access to existing files. Type the following at the command line:

xcacls *.* /g TestUser:r;trw /e

You see output similar to the following:

C:\data\compressed.txt Everyone:(special access:)
                                READ_CONTROL
                                SYNCHRONIZE
                                FILE_GENERIC_READ
                                FILE_GENERIC_WRITE
                                FILE_GENERIC_EXECUTE
                                FILE_READ_DATA
                                FILE_WRITE_DATA
                                FILE_APPEND_DATA
                                FILE_READ_EA
                                FILE_WRITE_EA
                                FILE_EXECUTE
                                FILE_READ_ATTRIBUTES
                                FILE_WRITE_ATTRIBUTES

                       MYCOMPUTER\TestUser:C

C:\data\deptdata.txt Everyone:(special access:)
                              READ_CONTROL
                              SYNCHRONIZE
                              FILE_GENERIC_READ
                              FILE_GENERIC_WRITE
                              FILE_GENERIC_EXECUTE
                              FILE_READ_DATA
                              FILE_WRITE_DATA
                              FILE_APPEND_DATA
                              FILE_READ_EA
                              FILE_WRITE_EA
                              FILE_EXECUTE
                              FILE_READ_ATTRIBUTES
                              FILE_WRITE_ATTRIBUTES

                     MYCOMPUTER\TestUser:C

C:\data\dirafter.txt Everyone:(special access:)
                              READ_CONTROL
                              SYNCHRONIZE
                              FILE_GENERIC_READ
                              FILE_GENERIC_WRITE
                              FILE_GENERIC_EXECUTE
                              FILE_READ_DATA
                              FILE_WRITE_DATA
                              FILE_APPEND_DATA
                              FILE_READ_EA
                              FILE_WRITE_EA
                              FILE_EXECUTE
                              FILE_READ_ATTRIBUTES
                              FILE_WRITE_ATTRIBUTES

                     MYCOMPUTER\TestUser:C

C:\data\temp.txt Everyone:(special access:)
                          READ_CONTROL
                          SYNCHRONIZE
                          FILE_GENERIC_READ
                          FILE_GENERIC_WRITE
                          FILE_GENERIC_EXECUTE
                          FILE_READ_DATA
                          FILE_WRITE_DATA
                          FILE_APPEND_DATA
                          FILE_READ_EA
                          FILE_WRITE_EA
                          FILE_EXECUTE
                          FILE_READ_ATTRIBUTES
                          FILE_WRITE_ATTRIBUTES

                 MYCOMPUTER\TestUser:C

C:\data\uncompressed.txt Everyone:(special access:)
                                  READ_CONTROL
                                  SYNCHRONIZE
                                  FILE_GENERIC_READ
                                  FILE_GENERIC_WRITE
                                  FILE_GENERIC_EXECUTE
                                  FILE_READ_DATA
                                  FILE_WRITE_DATA
                                  FILE_APPEND_DATA
                                  FILE_READ_EA
                                  FILE_WRITE_EA
                                  FILE_EXECUTE
                                  FILE_READ_ATTRIBUTES
                                  FILE_WRITE_ATTRIBUTES

                         MYCOMPUTER\TestUser:C

C:\data\userdata.txt Everyone:(special access:)
                              READ_CONTROL
                              SYNCHRONIZE
                              FILE_GENERIC_READ
                              FILE_GENERIC_WRITE
                              FILE_GENERIC_EXECUTE
                              FILE_READ_DATA
                              FILE_WRITE_DATA
                              FILE_APPEND_DATA
                              FILE_READ_EA
                              FILE_WRITE_EA
                              FILE_EXECUTE
                              FILE_READ_ATTRIBUTES
                              FILE_WRITE_ATTRIBUTES

                     MYCOMPUTER\TestUser:C


Addiag.exe: Application Deployment Diagnosis
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool provides information on the current state of software either installed or available for installation on a computer managed by IntelliMirror Software Installation and Maintenance.

AdDiag provides the following information about software on a computer:
  • The current user, including their logon credentials and SID, and the platform (processor, locale) that could affect the managed software.
  • Whether or not Terminal Server is running on the computer.
  • Installed or advertised information about software derived from the registry.
  • Advertised information about available software stored in Active Directory directory service.
  • Windows Installer information.

Corresponding UI

There is no corresponding user interface for AdDiag.

Concepts

IntelliMirror is a set of features that enable desktop change and configuration management technology. These features include: user data management, software installation and maintenance, user settings management, and remote installation services. For more information, see IntelliMirror Concepts in Help and Support Center.

System Requirements

The following are the system requirements for AdDiag:

  • Windows XP Professional

File Required

  • Addiag.exe


AdDiag Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Understanding AdDiag Report Output

AdDiag can generate a report containing the following sections of information.

General Info

Provides user configuration details.

TS Info

Provides information about whether or not Microsoft Terminal Server is running.

Managed Apps (Local List)

Lists all applications with information stored in the registry. The applications are listed by GUID. The GUID is set from the Software Installation snap-in, so in a case where the friendly name does not appear correct, the GUID is the information of most use in troubleshooting.

Assign count is the count of full advertisements executed for the application. This should make a difference only in Roaming User Profile (RUP) cases, the only cases when additional full advertisements are made for the same user.

UI Levels

Level | Description
0x0 | UI level is unchanged.
0x1 | Default UI.
0x2 | Completely silent installation.
0x3 | Progress bars and error handling.
0x4 | Authored UI (wizard dialog boxes suppressed).
0x5 | Authored UI (wizards, progress bars, and error handling).
0x40 | Display only progress bars.
0x80 | Display success or failure dialog box on completion.

Application States

State | Description
0x1 | Assigned
0x2 | Published
0x4 | Remove unmanaged version before assignment.
0x8 | Leave application unmanaged when Group Policy no longer applies.
0x10 | Remove application when Group Policy no longer applies.
0x20 | Leave application unmanaged.
0x40 | Remove application.
0x18 | Assigned and Leave application unmanaged when Group Policy no longer applies.

Deployed Apps (Server)

Deployed Apps (Server) is a full list of applications from the Group Policy objects applied to the given user (or computer). In the case of upgrade relationships the base application is still listed, even if there is an upgrade for it. This feature has not yet been implemented.

MSI Apps

MSI Apps lists all applications for which there is Windows Installer information. Managed applications came from Software Installation and Maintenance, unmanaged applications came from alternative distribution, such as Microsoft Systems Management Server.


AdDiag Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

AdDiag uses the following syntax:

One Step addiag [/verbose:{TRUE|FALSE}] [/user:{TRUE|FALSE}] [/trace: String] [/test: StringList] [/debug: Ulong] [/?:{TRUE|FALSE}]

Parameters

/verbose {TRUE|FALSE}
Specifies the level of detail returned.
Value | Description
TRUE | Runs diagnostics in verbose mode.
FALSE | Runs diagnostics in concise mode. This is the default.
/user {TRUE|FALSE}
Specifies which diagnostics to run.
Value | Description
TRUE | Runs diagnostics for the user. This is the default.
FALSE | Runs diagnostics for the computer.
/trace: String
Specifies in a string what system tracing should be turned on or off. The string must be between 1 and 260 characters in length.
Value | Description
AppMgmtOn | Turns on verbose logging for AppMgmt. The log file is generated at %WINDIR%\debug\usermode\appmgmt.log.
AppMgmtOff | Turns off verbose logging for AppMgmt.
MSIOn | Turns on verbose logging for Windows Installer. The log file is generated either at %WINDIR%\temp\msi*.log or %temp%\msi*.log.
MSIOff | Turns off verbose logging for Windows Installer.
UserEnvOff | Turns on verbose logging for the policy engine. The log file is generated at %WINDIR%\debug\usermode\userenv.log.
UserEnvOn | Turns off verbose logging for the policy engine.
/test: StringList
Specifies the list of diagnostics to be run. The string must be between 1 and 260 characters, and multiple diagnostics must be separated by comma (,) or semicolon (;). The default StringList is "Info,TS,LocalApps,ServerApps,MSIApps,ADHistory,EventDump,All".
Value | Description
Info | Dumps general information.
TS | Dumps Terminal Server information.
LocalApps | Dump Local Managed Applications List.
ServerApps | Dumps Server Deployed Applications List.
MSIApps | Dumps Local MSI Applications List.
GPOList | Dumps Local Group Policy Object List.
ScriptList | Dumps Local Script Application List.
ADHistory | Dumps Local Active Directory policy history.
MSIFeatures | Dumps Local MSI Features List.
MSILinks | Dump MSI shortcuts in the profile.
EventDump | Dumps Application log related events.
Check | Performs Active Directory Integrity check.
all | Performs all tests.
/debug: Ulong
Specifies a debug level of Ulong where Ulong is an unsigned long (debug only).
/?:{TRUE|FALSE}
Specifies whether command-line help is displayed.
Value | Description
TRUE | Displays command-line usage.
FALSE | Does not display command-line usage. This is the default.

Examples

See Example 1: Display Diagnostic Information for the Local Computer.


AdDiag Examples
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Display Diagnostic Information for the Local Computer

If you want to display diagnotic information for the local computer, type the following at the command line:

addiag

Your results will look similar to the following output:

Microsoft (R) Software Distribution Diagnostics. Version 2.00
Copyright (C) Microsoft Corp 1998-2001. All rights reserved.

Collecting info...

Initializing Remote DS Data...
Initializing Local AppMgmt Registry Data...
Initializing Local AppMgmt File Data...
Initializing Local Windows Installer Data...
Initializing Local Shell Data...
Initializing Local Event Data...

========================= General Info =========================

User -- NameSamCompatible: TEST\vtwuster
User -- NameFullyQualifiedDN: CN=Vee T Wuster,
CN=Users,DC=test,DC=corp,DC=mstest,DC=com
User -- Logon Server: \\RED-DC-24
User -- SID: S-1-5-21-2127521184-1604012920-1887927527-340073
User -- Profile Type: LOCAL
User -- Locale: 1033
Processor Architecture: x86
System Locale: 1033

========================= TS Info =========================

Running Remote Admin TS

========================= Managed Apps (Local List) =========================

No Managed applications were found.

========================= Managed Applications (Server) =========================

User dump for test.corp.mstest.com
Dumping GPO list (3 items)...
    GPO GUID: {12A7A27A-31AE-4DDC-AAC1-5744AB20EC41}
    Name: EU-Office-MachinesDeployment-DuongN
    GPO GUID: {6E810346-A86F-43CB-B6C6-BFA45220367A}
    Name: EU-MngDskRecep-ITGIntel
        cardkey
            Object GUID: {31DEF562-37F4-4388-8DBC-77C0321F606D}
            Package Flags:
                PostBeta3
                UserInstall
                OnDemandInstall
                Assigned
                OrphanOnPolicyRemoval
                MinimalInstallUI
                FullInstallUI
            ProductCode: {00AC0A39-F2C0-4605-93E7-B8FA37EB3C1D}
            UI Level: Basic
        Guest99
            Object GUID: {0B294F89-AAD0-4AF2-BFF8-AF0A9891663D}
            Package Flags:
                PostBeta3
                UserInstall
                OnDemandInstall
                Assigned
                OrphanOnPolicyRemoval
                MinimalInstallUI
                FullInstallUI
            ProductCode: {96F41056-72F2-4633-97FC-066C74570A70}
            UI Level: Basic
        Multi-Calendar Viewer
            Object GUID: {818A3226-C828-4A1F-971F-4912D9007688}
            Package Flags:
                PostBeta3
                UserInstall
                OnDemandInstall
                Assigned
                OrphanOnPolicyRemoval
                MinimalInstallUI
                FullInstallUI
            ProductCode: {057EA138-1893-49CC-B0DE-A39B9C6AAE5B}
            UI Level: Basic
        NT-PTouch
            Object GUID: {B28338C5-9EFB-4F06-B94B-099C902B5AAB}
            Package Flags:
                PostBeta3
                UserInstall
                OnDemandInstall
                Assigned
                OrphanOnPolicyRemoval
                MinimalInstallUI
                FullInstallUI
            ProductCode: {8B76F0D0-4DDD-4010-8A58-20F97DA1396B}
            UI Level: Basic
    GPO GUID: {C52B5368-2A6F-11D3-BB3C-00805FC792AD}
    Name: EU-PublicApplicationPublishing -ITGINTEL
    No Apps were found.

========================= Windows Installer Apps =========================

Found 3 MSI application(s)
WebFldrs
Windows 2000 Support Tools
Unkown Product

========================= Local GPO List =========================

Found 1 GPO(s)
    {C52B5368-2A6F-11D3-BB3C-00805FC792AD}
Found 1 LDAP GPO path(s)
    LDAP://CN=ClassStore,CN=User,CN={C52B5368-2A6F-11D3-BB3C-00805FC792AD},CN=Policies,CN=System,DC=redmond,DC=corp,DC=mstest,DC=com

========================= Local script list =========================

No scripts were found.

========================= Local AD History =========================

Found 1 Applied GPO(s) in the history
EU-PublicApplicationPublishing -ITGINTEL
    GPO GUID: {C52B5368-2A6F-11D3-BB3C-00805FC792AD}
    Version: 0x8530853

========================= Local MSI Features =========================

Found 340 Component(s)
{72E6B800-9F98-41DA-BA77-2422BBDF7C20}
{D3D3AA10-5724-4452-A145-722E9A8A641E}
{F806B220-8624-4536-8FB5-E30AA3BA60E5}
{1987D340-49FF-4662-A030-B0B2EC218390}
{0498F050-4147-4D26-B060-7439CFA89A8F}
{4BF89850-1076-46A8-B1D9-868B48936900}
{4C628B60-32D1-4A1F-BE89-8A3D45972856}
{DC6FE870-F9BF-4ACB-B556-C31BE47F8111}
{3884E680-7F23-4C41-AEE2-4EF6B8BE53EA}
{2E2A8A80-A8B3-4B6F-B584-12303DC0338E}
{4C631E80-2C47-469A-BD6E-E536BC45BD6E}
{FA72DD90-8D2C-43B2-9D34-B24F69167CC2}
{713DC0A0-1FD8-4997-AD46-F00A51D4DD12}
{7A2AE1B0-C105-4104-B1FD-E00F177C6026}
{A20821D0-DBCC-4BF1-8C8E-B87AC1A5F77B}
{31DE2AD0-EF89-4384-AEE5-68C42112E842}
{B1F3F1E0-7C3E-4E7D-B277-68FF27E587FA}
{9A775CF0-A8CC-42CB-84DC-2AA630CF7C90}
{3A22F401-CCAD-4C56-8E39-BAFBAD767E88}
{9272CD01-F9F3-49B2-967D-6A5A987DC130}
{CF2C1711-621C-4178-88E3-E6F1D5DD4B69}
{184D3A11-6EAF-49DD-B6A0-E3C6161368C9}
{360A2321-32E9-4500-8931-2922A93E9416}
{0D472051-D355-4396-964C-8680C19CDCEC}
{46C48451-D488-11D1-825C-00A0C9056598}
{E3C05A71-7190-4C15-9FFC-67B9B02EFA40}
{346EDF71-BB1D-436A-ADE8-7312F16992E9}
{E1B4C781-9795-4D53-9DC4-C101038C0A93}
{74AE9A91-630D-43CF-B2F6-E55EC3C978FB}
{712E65A1-4D0A-4E4D-8091-5C8040EAA7BF}
{BA8AF7A1-A934-4DBC-AD54-212D055956C0}
{10B1A0B1-BD14-4174-BA2B-A83FDF95AD53}
{6D9584B1-A9F2-4CEF-8D86-64FB12CC4958}
{75A5C2C1-F1ED-4407-9364-8873C77F47F6}
{82D57FC1-AE20-4052-B6E7-1E18B05C19C7}
{8EC173D1-28D8-4A82-9955-DADC3A822E64}
{471019D1-8080-40CE-ACA1-7E68AD2528A9}
{F0F94AE1-A0CE-483F-BF9E-55706E3C370A}
{9114AEE1-35FA-11D2-AA89-00A0C90F57B0}
{FA5D46F1-904A-4FF6-ACB0-D532667AAA91}
{0C8FB9F1-5A98-408F-9E46-46FBA5208F7F}
{6FC80602-4D83-4EF0-9169-A6E839705AFF}
{23A31322-CDB0-40EB-8A87-BECBDD4B0AAB}
{24C80252-E892-4BDE-A1CE-10CF7CCBA983}
{F3514452-ADCC-408E-B787-8C2ABC21916E}
{E9BF2062-9DA7-4978-AD3F-A657422F2996}
{C28B2462-CF89-4733-AB67-5A49EF20CDF3}
{95144762-C2B8-11D1-998F-00A0C90A43B3}
{6A688D62-9CCC-4CE3-8327-5AD19A38C89D}
{AC248182-4629-4926-B1B5-83D3F9399D63}
{3FEC8482-CB99-4851-95F7-C956AACCA1D0}
{7EA3A482-87A3-48BF-8F83-977EE0C5A7A9}
{8B6AC782-C4CB-429D-8882-C20E47864CDA}
{5D871C92-7C90-4A64-96AA-329F08BA7664}
{E6E308A2-6C1D-41C3-A550-47ED6D83C6D3}
{CD7A2AE2-9A72-42B4-B3DC-3E4040039691}
{651C6013-AC86-4766-857B-7513F0D161F7}
{404D6423-5263-4344-8E1F-EC308A3E4E5A}
{1BC9CE23-D092-424a-9AC4-1D8E0C805FAD}
{FABD3633-4A5D-4BE0-9BC6-FCE695E8A154}
{F08F8E33-249A-4354-B545-AB1575F466C8}
{1A36D663-3D41-4FB7-B607-E958BABF6270}
{10FA5B63-BCB7-47fc-A528-12C6C5B4F2CE}
{95CFE083-EC87-43AB-B565-69042E50225D}
{BD036593-4F01-43B6-9484-FE5D472199AA}
{169BC993-212B-47FD-ABD7-93BA9783DFDA}
{A842C1B3-6B02-4DD9-8B2E-43675F4952F2}
{BD704BB3-4825-44BC-9528-2851AF45BFF1}
{98BBCDB3-E716-4EF1-8ED4-B1560943E13A}
{15B557D3-E69D-47F4-A635-E1489B672A58}
{89A01AD3-0024-4d10-B4F9-DE0118F0B7BF}
{51C3FFD3-056C-475F-92E7-F4F2FFFB0039}
{5DEAADE3-8ADD-4C32-A744-7CFF136E82F6}
{FC0675F3-40D3-4DA2-8EFC-8BADC80F9D54}
{71C6C8F3-0C32-439F-8D6A-08DA2080FEFE}
{6BD06DF3-30D4-4AE2-B76F-81B8506A891C}
{E091A004-FB86-4B76-87E6-B025AB4C0D0A}
{1EDF1324-66BE-495E-92E6-AC5FE0E75210}
{2A5CD034-623D-4EF3-AC31-E2550603ABAA}
{17856334-1F20-4698-9807-3BB947834DA5}
{74BA4744-69FC-4A11-A875-C1BDE850356B}
{54BB3944-D72D-4761-B393-D3EE0B22E4AA}
{22889D54-D591-46C8-87C3-6B82F9AF137E}
{5B23D074-05FE-4109-A6DE-6CBBFC532DBB}
{E274C084-3DCD-407B-BEFC-E359BD510738}
{1F9F2684-E80A-4F8A-87C9-5BB828BAA6E3}
{24BC3D84-F636-4335-AB13-73F6409B5582}
{E8152194-5020-4FC4-BBFC-CD8E999B628D}
{BE74C294-69B9-438A-9828-C48821348127}
{6E4CCBA4-270E-4A64-BAC8-0CCF47CD8B57}
{B6C009B4-66C9-4D1D-BBB7-F0936447EECE}
{930314C4-4CC2-431D-B14A-E81CFB69B13E}
{4BD778C4-80A6-4AA4-891E-D34867D3CED0}
{B1E881E4-615E-4A8A-B50A-69B4D524D3E4}
{27E29DE4-7EF0-48A7-ADE3-3FC856767FF8}
{5ACF21F4-2DE4-4F29-9A88-8A9425DDCE02}
{CE609FF4-5D85-402E-A850-ECC8E0582427}
{030CCA25-3E6D-41C6-B03D-6B33EB99545B}
{74321545-DA27-4D49-87EE-2F6EE362E9F7}
{3DAA2F45-86F4-4230-9CAB-D4CD5CE00DF1}
{EA2BA555-6C5B-4CC7-BAE4-80BD53B19E67}
{2425AB55-E917-4EA6-8E75-097012A82A9C}
{07463865-6A74-43D6-B877-CEECAC94B4E4}
{3E440985-B7A9-4BFE-BAD6-5E3A4DA6AD69}
{BE8F3B85-7B71-4C01-B528-6D2D0CB137B4}
{5CB1EE85-0D14-445E-A0E7-A96E7407D28D}
{26E90895-A003-466D-9C7F-8249D1397026}
{1F1E0B95-0267-494C-87FF-818C21924169}
{33A08F95-84AD-4AD9-9A87-CE7198B512AC}
{FB5D81A5-F73C-4A0A-9ED9-4231B5BA7E24}
{1A5459C5-8FAF-11D2-829D-00A0C9056598}
{E9CFEBC5-0288-433A-BBB7-743671008D51}
{CD1567E5-91CC-49AD-850A-4922105C1832}
{9E706BE5-3DFA-494A-88CE-837A42CF5B4B}
{A3129DE5-904C-4CEC-A2CD-0432A75069E2}
{F8EAF3F5-8509-43CC-BF9B-DEE445AB0A1E}
{B07BB5F5-5745-42E2-9AB3-BE784671FCD7}
{5B6E9FF5-80CC-43BC-B57E-13179681A27D}
{BE434906-5FE4-4951-834B-6F821F91E9FC}
{8BBF5A06-7325-4609-BC13-F85073BE84B8}
{01437F16-0EF8-4C81-9C3C-7B891BB02531}
{6F401036-34EB-4386-8E63-2FD33EA780C9}
{6ED00436-20C0-4AEE-851D-F82E39ECC3F1}
{284CEB36-F58C-4416-8649-455CDAC30A49}
{92713E36-B9B8-4113-ABB8-A17B8FE5C53A}
{E0384656-4B1C-448A-AC99-E0D9FBC30D59}
{035B4B56-D2BB-494B-969D-B90569E112D7}
{18863E76-7BE2-432B-A0C7-032478EFC06D}
{B842C486-AB4D-448B-8721-1212A47384BC}
{FE181F86-9B82-42B4-9303-AA6D26CDF83C}
{1B845896-EE51-4385-B8AE-05461C9B7869}
{B3213B96-D0B2-48E7-9F17-CC340389E8E7}
{308E3E96-711C-411D-BE17-7DF130C775E4}
{771992A6-DC57-4EA9-A607-A0727071E943}
{CBA468B6-4246-48E9-8684-B86AFEE1C8D2}
{35FC98B6-5591-4E75-91AF-739DADB46940}
{102834C6-CC7D-413A-A234-0AD5DC2D6176}
{502925D6-95DB-4E67-A564-D7BE7EC9BC0C}
{05C78DD6-825C-4BEA-A5BE-E8E79E59FEDD}
{3687B7E6-BAB8-40D7-A4A5-E2F12EEACE00}
{52A368E6-7168-4D76-A880-C733AB375EA7}
{79CBD0F6-6646-41EB-886D-FFA000F87351}
{406BA307-E1D6-43AE-A9B1-8895085C7BBD}
{957CD707-DDFA-4709-B022-D9928F852781}
{4C541F07-895C-4C20-A17A-F106175E0889}
{CC9CD617-7BF0-49B4-92B5-A0668E2F4C1D}
{0B504737-C5AD-4BB3-863C-DA065AF006A8}
{122E5B37-F6FB-474E-97D9-73054698B2DA}
{C25E2047-80BA-497B-8894-7DB2D49A9EA8}
{4B08E247-C041-46CA-AF0A-4B42B7636269}
{DFB89957-9903-41FD-8800-681B58A932F9}
{11342067-5685-41F3-9E76-AC9ED2EF8E11}
{D8DCC477-EDA4-434B-A186-9D3A2F61F1F7}
{7F98BA77-204E-45AE-812A-5CC79AA99F01}
{5B941587-24D1-478D-949B-31787DCD910D}
{2B11D297-40F4-4EDA-BD49-C7F3DD9B2FC1}
{01B44897-9AC9-4054-8485-6650AF6D5528}
{F71152A7-F2ED-47F9-AC82-C274B5E86617}
{6A78CFA7-B53F-40E0-B6F6-D8A36EE0824A}
{114C79B7-FF9F-4BB6-A70E-38DA0659C36A}
{F823DAB7-A6D5-44B8-898E-21610586B657}
{C1873EB7-5294-404E-9F62-6B46CF18117C}
{8478CEB7-85A1-4F27-8584-56B795DBCB32}
{185370C7-5F91-4E48-BB7C-40F65C4CF976}
{0A7443C7-6E9A-11D2-AAA2-00A0C90F57B0}
{ECB9ABC7-AF3F-4C55-936C-9EEC2F1330EE}
{5888ECC7-706A-4E54-B9B3-A113616BB479}
{B93B20D7-5936-447E-B004-4597505A2E82}
{D58182D7-8347-462F-8A5F-083C5292E7B7}
{E50863D7-51CA-47F9-ACA2-1743318B3A77}
{94301CD7-82BF-404B-BBE3-4353EF37648D}
{D50CA1E7-6E6B-458B-8326-157DA6EBCC61}
{1980C2E7-BF6B-4B0A-892C-98DA35E4ABD1}
{74B422F7-98FA-4F94-B274-FD10BCD1106F}
{86398EF7-6409-4E85-9B1C-F5F63C395081}
{1581CFF7-E8C7-4C67-B929-27451328C232}
{E960DE08-80D0-4FEF-8F3C-77A32DBADB7C}
{6B383418-CE9C-4708-8422-1D870C20DAF8}
{897CE818-7E34-4FB5-8F2A-B64901D9AA92}
{B0B6BC28-DE3E-485D-A655-B3E7DF087236}
{782D1038-EF7E-4608-91D0-A3A9E7D5760C}
{C78D7438-A0EC-4143-8BFF-DB858497D7C9}
{03C6D938-F8FC-450E-9A70-321617135A9A}
{4373BA38-08EF-4B30-B1CB-7D0F1CA9A4D4}
{E77E8848-3B66-4276-A412-887C510CBC0D}
{BC417A68-FDCF-4BC6-A777-D4FF7E60746A}
{E54DFF68-AC2B-4EAE-9948-0881F6E36B77}
{52C39188-F40A-43BA-B452-B8EAD2B4CCD2}
{64CAD688-3B52-4DBC-A082-B2B2DA2B8465}
{8E126B98-48E2-4614-956D-EF3FF0876828}
{8125BC98-17F1-42D4-98E0-DA14FBB2C1E0}
{163EC9A8-2904-4014-8CCF-51B94F9D9884}
{C9345EA8-A3DE-4414-9F0F-8C2AECD34D75}
{FA532FB8-A80A-4F9E-82F1-24F6A49F82D0}
{E0917FB8-5112-4347-A393-ADC78287B2F2}
{2A3EEBC8-5006-48C3-85A5-B97D72F65C1F}
{E1F122D8-004C-4D60-87CB-5D06FE96DD12}
{B13E84E8-374D-4291-B74E-92CDD7E1F24F}
{D63721F8-60DF-4074-A32B-90E023EDD96D}
{FBB37FF8-6953-4E69-989E-05B7EFF938A7}
{D691D719-0419-4FAF-B7E2-4108BF135B0B}
{7B524139-EC13-4D18-8DE3-BDD249A837F6}
{4E063539-580B-4586-A5A2-A34909B9ABE1}
{D13A7F39-2C18-48DF-A918-3D23C4A01CF7}
{A0CB8659-733B-4493-B7D6-0CFE15B27F67}
{8EAC9369-6387-4D07-8BC7-F4EA41430ACE}
{17ADF869-F24A-4C06-9684-7E7A6783E3C5}
{5911D979-E2B6-42B9-832F-9850A4F8B7DA}
{2867F979-F7AA-4B58-A6D4-54696BCC92BC}
{BD967C89-589C-4BBF-939F-643C95791F3E}
{2E047899-40C1-41DC-A0F9-080318FBCBDC}
{761C52A9-38A1-4ADE-AC32-B99D529F5356}
{22DA28A9-904D-4FB8-81F5-86D1E91A1E5D}
{27D471B9-6CB9-476C-9291-6AFC8E4D7D3B}
{0A7443C9-6E9A-11D2-AAA2-00A0C90F57B0}
{EBF07AC9-492C-479B-BDF7-F40F1DBEA6FE}
{CAF4DDD9-5F1F-4A8D-A352-59047B04FB7D}
{F1E95DE9-51EC-4647-B512-77A236207A57}
{32488DE9-DC7B-47CC-B919-3696CFE2107B}
{2D2ADA1A-E007-496E-9D33-E83B8957EFB6}
{4083532A-7E43-45C4-85A7-44986F983879}
{CAE1A82A-3CCC-4835-AC7F-8A097356FC8F}
{42D3475A-5646-49DD-B66E-47F8A51A89AC}
{8D8EA85A-45BD-475D-B1D0-FCC63723CB30}
{AC80795A-2F81-4D99-AE1E-EFCEE333677F}
{64B3086A-DBDD-43D7-A87D-62FD77029CFB}
{47F24F6A-1CC4-4696-A562-208A940E3DB6}
{437267AA-5501-4C7F-95F3-6FAD197BDC93}
{E20B84CA-838A-4CCB-8694-801B099EE47C}
{1C50B9CA-9DA1-4f89-B349-C6E7529D2B7D}
{6A1513DA-F97E-4F5C-B07B-D8622836EB6B}
{5F1629DA-6DB0-4CC6-852D-A5E984C102E6}
{6FB091FA-F69C-4936-8761-89ADC45C00BA}
{D42364FA-0ADA-49F1-8EF1-BEDC5D400525}
{EAEFDEFA-1BF5-4C2F-AB79-30024340A330}
{973E2E0B-06BB-4494-A6FC-5D6C43B1A471}
{4DBA7F0B-BD14-4116-91E1-2F37707BB289}
{0BF3C91B-AEC9-49D2-B82F-C7DD32DE7CA6}
{CBBA222B-297F-4B64-9EB7-D4957637F2CD}
{A1A9962B-3DBC-4FB8-BB2F-9AAFD29DD2E8}
{C0B30C2B-FB0C-4C8A-8B25-270E350A8E74}
{6053B13B-16EB-495B-81CB-5BE84F9BA6EA}
{9A72D63B-CFC8-4B4E-8BE9-AA775F0C4157}
{A3B3A93B-EC56-4500-AC14-2B65BCD5AB32}
{571E314B-4FDB-42B7-B9B4-56A51773E6B9}
{4302F55B-D821-484C-8210-4A4C44F783F8}
{CC29EA5B-7BC2-11D1-A921-00A0C91E2AA2}
{BB0A2A6B-D6C0-4543-9444-C796D5298D31}
{87372D6B-9102-473E-ADE0-64B2C71F7806}
{4F6B228B-735E-4DD9-882A-DCD4066FDDB6}
{AEFB398B-7387-4591-ACAF-169C1372A97E}
{738F7D9B-DBE1-43FB-A13F-EE4DD579866D}
{C9FB9E9B-7C03-4B16-955B-25FB900EF175}
{8BAC97BB-7E6F-41D8-92CE-411BA78DADD3}
{629E6DBB-863B-4083-9BA8-7EE69552F881}
{83106FBB-A17A-4E4C-8D26-C9BD609D4CC9}
{F4FD59CB-BB61-4C74-B4CE-0EE1F3A1BC40}
{B50830EB-3225-432e-8522-B634646CA7A4}
{89AAD3EB-B4DC-45DD-BDC1-F42F274388FE}
{7AE8D9EB-1A80-4E81-957F-4F435ED69637}
{9DB393FB-ACD8-4241-B29D-57C09B3244CF}
{7922340C-35CE-4894-9C98-F80FD34C0ADA}
{9E20F71C-4391-4496-B8C3-10A968B10D9B}
{6D73902C-5DF6-4993-A1E8-6099FD61A79C}
{34B2783C-FC60-4A7D-9691-E7E1F0D4465A}
{324A9D5C-603C-4724-9E93-4A7090F46659}
{E52A036C-2C42-44E6-A066-AD61977929D8}
{AAD1266C-4458-41A7-BD0A-D6954DEA7CE3}
{61D14E6C-49AA-49E3-989C-CDBC094C07F2}
{11BA698C-A95C-47A3-9D61-A08B390BDFF0}
{4486DB8C-A07A-4657-B442-1D159D68320D}
{8598FB8C-887C-4200-8FE6-690410E1C0F3}
{EF377F8C-A278-4F14-B099-994B3E2286BC}
{A42635BC-D3A4-4595-99C5-234E39DD8AE3}
{07BA08BC-A57D-49EA-ADBC-206C2DB7DF5B}
{3A2422CC-0A87-4EF8-8CF3-348EE6C4D52A}
{8F2419CC-A782-4BE6-9C63-CDFBCA5B5009}
{9D8B72DC-9435-4B8F-8179-B3A283857F55}
{0CCB94DC-230C-4F7E-B23D-D7E033E19EF0}
{77EFFADC-8D9F-42A2-9F05-13EC3A54687F}
{01FD82EC-1D8F-4138-9222-5FB566141D6D}
{F2960CEC-4082-4D6E-BE59-FAB36D9C1F5A}
{E1DBEBFC-6D48-4246-8401-9F2DF633F058}
{EA7ECF0D-840B-47BD-BD98-9A76959C3859}
{FCA5D11D-A8B7-4148-9090-31BA09783621}
{48D57A1D-70F4-4648-8B57-9938D6E1C30F}
{A6A2305D-E507-4960-8DFF-7293EA55B842}
{E214C19D-F60F-4F57-B530-B6B302F91CBC}
{D134139D-F7FC-4D17-A756-239310D42372}
{5E16639D-876D-437A-8FF0-CBCEAAA40341}
{0A525DCD-8395-4C95-99AB-32A2B65C9BCD}
{737FD0FD-99ED-4ACB-AC0C-55835ED57F07}
{D33D9DFD-BBB6-4131-9F71-3746AA98F31D}
{99EE222E-9D4F-4B13-B3E7-B13173E7F3E4}
{6599A45E-2A0F-4BED-A749-71C3A71923A3}
{BE25E95E-0FF9-4DDC-BB63-3445A0DB0CD4}
{61985B5E-B5BB-42D9-A54B-52F7D50CFEAB}
{31AC8E6E-7DE7-41BC-8420-C25B346AB8F7}
{BAA0FF6E-627A-4053-B447-886277AE7065}
{59A5B37E-B467-4016-990D-15CAA3925AF0}
{EF6B339E-7B24-4B92-9EC2-717A2E3D90F7}
{9638249E-88CF-445E-9C81-5A5E9D7A2019}
{9A4B469E-6774-4E51-81CC-060AF3E16E41}
{B9E7BC9E-18BF-4A4A-B9F0-73ED5259D3B0}
{D7793F9E-BF88-42D9-B6B8-55941C6A3AB2}
{3D2623AE-0E58-4DFC-9C23-3594EA94E4F3}
{DF7535AE-2F1B-43B7-8334-70F9A8F5976E}
{050C37AE-681F-46FA-8E3D-8D1CC27946C7}
{6CF858BE-92FE-4316-B0D0-2B9A950BE66A}
{108F2FBE-98E4-46F6-B3ED-F98E7D34489D}
{A460BECE-653E-4576-987A-47AF3643A8B8}
{FC94F9DE-1746-47CD-A641-D714B5CA40B5}
{161F5BDE-C122-4CE3-A3A8-3518D91C298B}
{9F7C23EE-1F13-42EF-9B59-A2B0F31CC4C1}
{B7E2EFFE-60B8-4532-BABD-DEE4EB6B4BCF}
{E705E00F-FA0A-4C27-9A7F-79255E45E7A1}
{AB9DF31F-E1C9-4F91-95D5-77013C5EA649}
{3989D12F-8BE9-4045-8B6F-5A21A3AA648B}
{423E5D3F-2CC2-4CB6-ACDD-43538CA73A98}
{5CEE7A4F-B606-4E5A-999F-0E1D671029F7}
{E490E65F-8F7B-4424-8EB3-1246974680BD}
{56DA575F-51D1-4E93-868B-B2743CCEBD23}
{CC29E95F-7BC2-11D1-A921-00A0C91E2AA2}
{37533E5F-F873-427C-AA7B-F4B25FDE4DCF}
{3950916F-CA46-4447-A7D6-8864F5F4D4B0}
{A3B53D6F-8EA0-41A2-925D-9E0A452E5E1D}
{BD67287F-FF6C-453F-A78E-31F29F839199}
{5F64EB7F-CF97-4D85-AA99-D748DA4F1431}
{BCDE229F-9364-431A-B21B-34AF07F2F10B}
{45DF439F-7E93-40F0-83E4-56461B8E647D}
{2D1633AF-12E6-4FE5-B526-5797DADA99AD}
{2ADFC8AF-FB0E-4C04-9242-F22E54D76633}
{87B70FAF-1116-415D-A7BD-2659AA7E9301}
{13A049BF-9FF9-44E5-84D4-9A06B02ACE55}
{EC366DBF-7A35-4E37-BDD4-90D3CE67D297}
{DC8587CF-DEF3-46EB-B3C8-BF35ED27D847}
{920BADCF-2C91-4E68-8514-B44BD3BF23A0}
{CA113DDF-6D42-4368-8A12-6A6F4BD7DE2E}
{BFF929EF-A1B3-4ECD-A286-CCC3CA826E75}
{1E2A9BFF-8E55-46A3-BAE0-F7561E1554F3}

========================= Application log events =========================

EventID: 11925
Type: ERROR
Date: 12:25:44.0000 - 02/06/2001
User: N/A
Computer: RK-TEST-01
Source: MsiInstaller
Description: Product: Windows 2000 Support Tools -- Error 1925. You do not have sufficient privileges to complete this installation for all users of the machine.  Log on as administrator and then retry this installation.
Data:

EventID: 11925
Type: ERROR
Date: 12:20:44.0000 - 02/06/2001
User: N/A
Computer: RK-TEST-01
Source: MsiInstaller
Description: Product: Windows 2000 Support Tools -- Error 1925. You do not have sufficient privileges to complete this installation for all users of the machine.  Log on as administrator and then retry this installation.
Data:

========================= MSI Shortcuts in the profile =========================

No shortcuts were found.

========================= AD Integrity Checks =========================

Running "Compare GPO Names with LDAP Path"...
Check "Compare GPO Names with LDAP Path" succeeded.

Running "Check Darwin In Progress"...
Check "Check Darwin In Progress" succeeded.

Running "Compare Darwin Components vs Products"...
Check "Compare Darwin Components vs Products" succeeded.

Running "Check Darwin vs AppMgmt"...
Check "Check Darwin vs AppMgmt" succeeded.

Running "Check Darwin vs Shell"...
Check "Check Darwin vs Shell" succeeded.

Running "Compare Local Data vs Server Data"...

*********************************************************************
This check compares the local App Management data with the data found
on the domain controller.
Please note that inconsistency between them is common when the policy
has not been recently applied.
To ensure good results please reapply the policy before this test.
Last refresh: 9:34:55 on 3/13/2001.
*********************************************************************

Check "Compare Local Data vs Server Data" succeeded.


Compatadmin.exe: Compatibility Administration Tool
Overview | Notes | UI | Examples | Related Tools

This GUI tool provides an interface for browsing and editing the Windows XP Professional compatibility fix database as well as creating custom .sdb fixes that can be deployed to other users. CompatAdmin also provides a search capability that will locate fixed applications on a system or networked drives.

Each phase of changing access control can take a day or longer to complete and verify, and requires significant amounts of system resources and administrator time.

You can use CompatAdmin to test and apply one or more of the 139 fixes available in the operating system, although QFixApp offers a superior interface for testing and applying fixes.

Corresponding UI

CompatAdmin provides its own user interface. For more information, see CompatAdmin UI.

Concepts

Applications that worked on earlier versions of Windows may fail to function properly on Windows XP Professional. There are several reasons that this may happen:

  • The application refuses to run when Windows reports new, higher operating system version numbers. Often the application will work well on the new version of Windows if the user can get past this block in the application.
  • The application calls older versions of Win32 API functions that return unexpected values on computers with large amounts of resources, such as disk free space.
  • The application expects older formats of Windows data.
  • The application expects user information, such as personal and temporary folders, to be in specific locations or specific formats.

System Requirements

The following are the system requirements for CompatAdmin:

  • Windows XP Professional

Files Required

  • Compatadmin.exe
  • Shimdbc.exe


CompatAdmin Notes
Overview | Notes | UI | Examples | Related Tools

Working with the System Database

The main CompatAdmin interface provides a control for viewing and browsing applications with compatibility fixes in the Windows XP Professional system database. This view is always displayed in the upper left pane (System Database pane) of the CompatAdmin window.

The system compatibility database is an integral part of the Windows XP Professional operating system, ensuring out-of-box compatibility for hundreds of Windows applications. This database and the corresponding application entries are protected by the operating system.

Microsoft may update the system database in future Service Pack releases or Windows Update packages.

Limiting the Entries Displayed in the Database Window

There are hundreds of applications in the system database, each using one of several possible compatibility technologies. The number of entries and information can make it difficult to browse and work with the system database control.

Use the View menu options to limit the system entries that are displayed.

Disabling System Fixes

The fixes listed in the system database cannot be deleted because they are part of the protected database on every Windows XP Professional system; however, the entries in the system database can be disabled for the local system. Disabling an entry ensures that corresponding system fixes are not applied when the application is run. This option is useful when testing an application that is already in the system fix database, or when specifying alternate fixes for the application.

To disable an entry:

  • Select the application from the System Database pane, or from the Custom Database pane of the CompatAdmin window.
  • The Details pane displays information on each of the compatibility solutions applied to this application.
  • Right-click the specific application fix in the Details pane, and select Disable from the menu.
  • The entry should now have a red exclamation mark, verifying that it has been disabled.
  • Disabling and enabling entries is immediate, and there is no need to save this type of change. Once the selection has been changed, the operating system will behave accordingly when running the application.

Notes

  • Use caution when disabling application entries in the system database. Depending on the application, as well as the fixes that were applied, running without these fixes may cause the application to exhibit new problems or to fail.
  • You cannot deploy disabled entries to other computers. Entries are disabled only on the local computer for testing purposes.

Enabling Disabled System Fixes

To enable an entry:

  • Select the application from the System Database pane, or from the Custom Database pane of the CompatAdmin window.
  • The Details pane on the right side of the CompatAdmin window displays information on each of the compatibility solutions applied to this application.
  • Right-click the specific application fix in the Details pane, and select Enable from the menu.
  • The entry should no longer have a red exclamation mark.
  • Disabling and enabling entries is immediate, and there is no need to save this type of change. Once the selection has been changed, the operating system will behave accordingly when running the application.

Searching for Applications

CompatAdmin provides a tool that searches local and connected computer drives for applications that use compatibility fixes. This includes applications with entries in the system database, as well as other custom databases that may be installed.

To search for applications that use compatibility fixes:

  1. Select Search for Fixes from the View menu.
  2. In the Search list dialog box, check the drives to profile.
  3. Click Start to begin the search.
  4. Click Cancel at any time to end the search.

CompatAdmin displays your search results. This lists all applications found in the search path with their corresponding compatibility entries. If you want to get more information about the specific fixes applied to an application in the list, look in the system database.

To view specific fixes applied to an application:

  • Select Database Viewer from the View menu. This returns you to the main CompatAdmin window.
  • Select the application for which you want fix information in the System pane.
  • Browse the fix information in the Details pane.

Creating and Maintaining Custom Databases

One of the most useful aspects of CompatAdmin is the support it provides for creating and maintaining custom compatibility databases. The current custom database is displayed in the lower left pane of the Main Database view (Custom Database pane). When CompatAdmin starts, the custom database area is opened with a new, empty database.

Use the Database menu options to add or remove fixes from the custom database. The menu options may only be enabled if you have already selected the custom database window and/or a valid entry.

Creating a Custom Fix Database

Once you have identified and tested fixes for your target applications, you can use CompatAdmin to create a custom fix database. You can create a custom fix database that contains applications fixed with compatability modes, as well as applications fixed with specific compatibility fixes.

Creating a New Custom Fix Database

To create a new custom fix database:

  1. If you have a custom fix database open, select File|New .
  2. Select Database|Change Database name . Once you have changed the database name, it will be displayed at the top of the Custom Database pane. If Change Database name is disabled, click the Custom Database pane of the window.
  3. Select File|Save and name your .sdb file. You are now ready to add fixes to your custom database.

Adding a Compatibility Mode to a Custom Fix Database

To create a custom fix database with compatibility modes:

  1. Select Database|Create Application Fix . The Create an application fix dialog box is displayed.
  2. Select Apply Compatibility Mode, and click Next.
  3. Enter the name of the application for which you will specify a compatibility mode and click Next.
  4. Enter the name of the file to which the compatibility mode will be applied. You can type the name of the file, or use Browse to locate it.
  5. Select the compatibility mode to apply from the drop down list and click Next.
  6. Click Add file to select files that will help to identify the specified file on target computers. Choose files that are associated with your application that will be installed in the same related location. For example, choose an .hlp file that resides in the same directory as the .exe file. Try to uniquely identify your file without choosing an unnecessarily high number of matching files.

    Notes

    • Do not choose files in the \System32 folder to act as matching files for your application. Microsoft system files are protected and cannot be used for file matching.
    • Using Auto Generate will also create matching file information, but may generate much more information than you need. If you use this option, use Remove to delete any matching files that are not necessary to uniquely identify your .exe file on the target computer.
  7. Click Next when you have selected all necessary matching files.
  8. If you want to test the fix, click Test Run. Otherwise, click Finish.

Adding Specific Compatibility Fixes to a Custom Fix Database

Once you have used QFixApp to determine what application fixes you need to include in your .sdb file, you are ready to create your custom fix database. Repeat the following steps for each application that the .sdb will fix.

To create a custom fix database with specific compatibility fixes:

  1. Select Database|Create Application Fix . The Create an application fix dialog box is displayed.
  2. Select Apply specific compatibility fix, and click Next.
  3. Enter the name of the application for which you will specify fixes, and click Next.
  4. Enter the name of the file to which the fixes will be applied. You can type the name of the file, or use Browse to locate it.
  5. Click Next.
  6. Check the boxes for the fixes that need to be applied to the selected executable. If you need additional information on a fix, select it and read the description in the View Description textbox. If you need to start over after you have already started checking fixes, click Clear all to remove all checks.
  7. When you have checked all necessary fixes for the specified file, click Next.
  8. Click Add file to select files that will help to identify the specified file on target computers. Choose files that are associated with your application that will be installed in the same related location. For example, choose an .hlp file that resides in the same directory as the .exe file. Try to uniquely identify your file without choosing an unnecessarily high number of matching files.

    Notes

    • Do not choose files in the \System32 folder to act as matching files for your application. Microsoft system files are protected and cannot be used for file matching.
    • Using Auto Generate will also create matching file information, but may generate much more information than you need. If you use this option, use Remove to delete any matching files that are not necessary to uniquely identify your .exe file on the target computer.
  9. Click Next when you have selected all necessary matching files.
  10. If you want to test the fix, click Test Run. Otherwise, click Finish.

Maintaining a Custom Fix Database

Once you have created a custom fix database, you can add, edit matching file information, delete, and test the fixes it contains. For information on adding fixes to a custom database, see Adding a Compatibility Mode to a Custom Fix Database or Adding Specific Compatibility Fixes to a Custom Fix Database.

To edit matching file information for an application in a custom database:

  1. Select the application in the Custom Database pane.
  2. Right-click the file for which you want to add matching file information in the Details pane and select Add Matching Information.
  3. Click Add file to select files that will help to identify the specified file on target computers. Choose files that are associated with your application that will be installed in the same related location. For example, choose an .hlp file that resides in the same directory as the .exe file. Try to uniquely identify your file without choosing an unnecessarily high number of matching files.

    Notes

    • Do not choose files in the \System32 folder to act as matching files for your application. Microsoft system files are protected and cannot be used for file matching.
    • Using Auto Generate will also create matching file information, but may generate much more information than you need. If you use this option, use Remove to delete any matching files that are not necessary to uniquely identify your .exe file on the target computer.
  4. Click OK when you have finished editing matching file information.

To remove an application fix from a custom database:

  1. Select the application in the Custom Database pane.
  2. Select Database|Remove Application Fix . The application fix is deleted from the .sdb file.

To test an application fix in a custom database:

  1. Select the application in the Custom Database pane.
  2. Right-click the fix in the Details pane, and select Test Run.

Custom Databases and GUIDs

Each custom database has a unique GUID assigned to it. Renaming an exsiting custom database does not change the database's GUID. In order to generate a unique GUID, you must create a new custom database.

If you want to create a new version of an existing custom database, open that custom database and use Database|Change Database name to change the name. For example, your original custom database was called "ABC Co Fix V 1" and you change the name to "ABC Co Fix V 1.1." In this case, when you deploy the fix, other computers will correctly apply the updated fixes because the GUID for both of these files is identical.

However, if you create a "template" file that contains custom compatibility modes that you commonly use and just rename it to create new .sdb files, this will not produce reliable .sdb files for deployment to others in your company.

For example, your "template" custom database is called "Template" and you want to create two new custom databases based on it: "AcctApps" and "OperationsApps." For the most part, these two new files will be sent to different groups, but there is some overlap between those groups. If you create these files by opening "Template" and renaming it, both "AcctApps" and "OperationsApps" will have the same GUID. For those people who use only one .sdb file, this is not a large issue; however, for those people who need to apply both .sdb files, a conflict occurs. When one of the people from the latter group runs the first .sdb file, all the fixes are applied to his or her computer. When the second file is run, however, since it has the same GUID as the first file, fixes from the first file will be removed and replaced by fixes from the second file. Only if both "AcctApps" and "OperationsApps" have unique GUIDs will both .sdb files be properly applied without interfering with each other.

Deploying Custom Fix Databases

Once you establish which fixes are necessary for an application to work well on Windows XP Professional, use CompatAdmin to help deploy those fixes to other machines.

To deploy fixes using CompatAdmin:

  • Identify and test fixes for the target applications. It is recommended that you use QFixApp to determine what fixes are necessary for an application.
  • Create a custom database file(s) with the intended fixes (*.sdb).
  • Deliver the .sdb file to the destination Windows XP Professional machine(s).
  • Run the .sdb file on the machine(s). It will automatically install and add the fix information to the registry of the destination machine(s).

Create Custom Database (.sdb) Files for Targets

CompatAdmin creates a custom compatibility fix database in which multiple application and fixes can be specified. Once a database has been built with the fixes to deploy, simply save the custom database. This creates the database .sdb file, which can be installed on any Windows XP Professional system.

Deliver Files to the Destination Machines

Deploy a copy of the .Ssdb file to each machine that requires the fixes. There are a number of ways to accomplish this:

  • Copy the .sdb file to appropriate machines.
  • Make the .sdb file available on network share points.
  • Include the .sdb file in an installation program.

Add Fix Information to the Destination Machines

Installation of the custom database file is as simple as running the .sdb file on the Windows XP Professional target machine. The operating system performs all of the necessary actions to register the new fix database as well as creating an entry in add/remove programs.

Note

  • A path with spaces will fail to install correctly on the target Windows XP Professional machine. This is a problem in the Windows XP Professional Beta 2 release and will be fixed in the final version. The workaround is to run sdbinst.exe from the directory where the .sdb file is located.

    For example, an .sdb file named myfix.sdb is saved to the desktop. Using the following command in the Run dialog will fail:

    sdbinst myfix.sdb

    In order for this command to run successfully, open a console window, change directories to the desktop, and then type the following at the command line:

    sdbinst myfix.sdb


CompatAdmin UI
Overview | Notes | UI | Examples | Related Tools

Main CompatAdmin Window

The main CompatAdmin window is made up of three panes: the System Database pane in the upper left corner, the Custom Database pane in the lower left corner, and the Details pane on the right side of the window.

System Database Pane

This pane allows you to view and browse applications with compatibility fixes in the Windows XP Professional system database.

Custom Database Pane

This pane allows you to create, edit, and rename custom database files (.sdb).

Details Pane

This pane allows you to view, enable, and disable existing fixes in the system database. You can also use this pane to view, enable, disable, and add matching file info, and to test run existing fixes in custom databases.

CompatAdmin Search Results Window (Search View)

This window is displayed when you search for fixes. The following details are listed for each application that has an application fix applied to it:

Heading | Description
Affected File | The name of the file to which the fix was applied.
Application | The name of the application to which the fix was applied.
Action | A general description of the fix that has been applied to the file.
Database | The name of the database where the fix lives (either the system database or a custom database).
Global Setting | The global status of the fix for any computer using the specified database. A fix from a custom database can be enabled or disabled at the global level. Fixes from the system database cannot be disabled on a global level.
Local Setting | The local status of the fix for any computer using the specified database. Fixes from both custom databases and the system database can be enabled or disabled at the local level.


CompatAdmin Examples
Overview | Notes | UI | Examples | Related Tools

Example 1: Create a Custom Fix Database

The following example uses CompatAdmin to create a custom .sdb containing the fixes for Demoapp.exe. It takes the fix information determined in Example 1: Fix a Windows 95 Application from QFixApp and adds it to a new custom fix database.

Select Database|Change Database name . Name the database "MyCustomDatabase." The database name is now displayed at the top of the Custom Database pane.

Select File|Save and name your .sdb file Mydb.sdb. Click Save.

You are ready to add the fixes for DemoApp to the custom .sdb file. Select Database|Create Application Fix . The Create an application fix dialog is displayed.

Type DemoApp as the name of the application, and then click Next.

Click Browse and locate Demoapp.exe on your computer. Select Demoapp.exe and click OK.

You determined what fixes you want to apply to Demoapp.exe by using QFixApp. Select the following fixes that were determined necessary to Demoapp.exe: CorrectFilePaths, EmulateCreateProcess, EmulateGetCommandLine, EmulateGetDiskFreeSpace, IgnoreLoadLibrary, MapMemoryB0000, and Win95VersionLie.

Click Next.

Click Add file, and select Demoapp.hlp that is in the same directory as Demoapp.exe. Click OK.

We already tested the fixes with DemoApp using QFixApp, so click Finish.

Select File|Save to save the addition to your custom fix database.

Example 2: Deploy a Custom Fix Database

The following example uses the Mydb.sdb file that you created in Example 1: Create a Custom Fix Database. Now that you are ready to deploy the fixes to other users, copy Mydb.sdb to a shared volume in your company.

Create an email message notifying users that the fix is available. Include a link to the file in the email message. When a user clicks on the link, the .sdb file will automatically update the target computer with the fixes contained in Mydb.sdb.


Pageheap.exe: Page Heap
Overview | Notes | Syntax | Examples | Related Tools

This command line tool sets page heap flags that help to find heap-related bugs and corruption. It can also help detect leaks in applications that are running on Windows 2000 Professional SP2 and Windows XP Professional systems.

PageHeap introduces a software validation layer (Page Heap manager) between the application and the system that verifies all dynamic memory operations (allocations, frees, and other heap operations). When Page Heap manager is enabled, the application being tested is then launched under a debugger. If a bug is encountered, it will cause a debugger break.

Important

  • PageHeap does not find bugs. It enables a verification layer that already exists in the ntdll.dll system libraries in Windows 2000 Professional SP2 and Windows XP Professional. PageHeap will not work on previous versions of Microsoft Windows.
  • If the application being tested is not launched under a debugger and a bug is encountered, it will just crash without any feedback.

Corresponding UI

There is no corresponding user interface for PageHeap.

Concepts

A common problem in application development is heap corruption. This typically occurs when an application allocates a block of heap memory of a given size and then writes to memory addresses beyond the requested size of the heap block. Heap corruption can also occur when an application writes to block of memory that has already been freed.

Two concepts are central to understanding the commands related to PageHeap and the way to use it:

  • Corruptions in heap blocks are discovered by either placing a non-accessible page at the end of the allocation, or by checking fill patterns when the block is freed.
  • There are two heaps (full-page heap and normal page heap) for each heap created within a process that has page heap enabled.

Full-page heap reveals corruptions in heap blocks by placing a non-accessible page at the end of the allocation. The advantage of this approach is that you achieve "sudden death," meaning that the process will access violate (AV) exactly at the point of failure. This behavior makes failures easy to debug. The disadvantage is that every allocation uses at least one page of committed memory. For a memory-intensive process, system resources can be quickly exhausted.

Normal page heap can be used in situations where memory limitations render full-page heap unusable. It checks fill patterns when a heap block is freed. The advantage of this method is that it drastically reduces memory consumption. The disadvantage is that corruptions will only be detected when the block is freed. This makes failures harder to debug.

System Requirements

The following are the system requirements for PageHeap:

  • Windows 2000 Professional SP2 or Windows XP Professional

File Required

  • Pageheap.exe


PageHeap Notes
Overview | Notes | Syntax | Examples | Related Tools

Choosing a Method to Investigate Heap Block Corruptions

Most of the corruptions in heap blocks can be discovered in one of two ways:

  1. Full-page heap: Placing a non-accessible page at the end of the allocation.
  2. Normal page heap: Checking fill patterns when the block gets freed.

Full-Page Heap

Full-page heap should be enabled for individual processes, or under limited parameters for large processes, because of its high memory requirements. It cannot be enabled system-wide, because it is difficult to evaluate the required page file size. Using a page file that is too small with system-wide full-page heap renders the system unbootable.

The advantage of full-page heap is that it causes a process to access violate (AV) exactly at the point of failure. This makes the failure easy to debug. In order to be able to pinpoint failures, first use normal page heap to determine the range where a process is failing, and then use full-page heap on individual large-scale processes for that restricted class of allocations (that is, a specific size range or a specific library).

Normal Page Heap

Normal page heap can be used for the testing of large-scale processes without the high memory consumption that full-page heap requires. However, normal page heap delays detection until blocks are freed, thus making failures more difficult to debug.

In general, use normal page heap for initial large-scale processes testing. Then, if problems are detected, enable full-page heap for a restricted class of allocations in those processes.

Normal page heap can be safely enabled system-wide for all processes. This is very useful on test benches that perform general system validation, rather than component focused testing. Normal page heap can also be enabled for a single process.

Using GFlags with System-Wide Page Heap

The GFlags tool is used to enable system-wide page heap. In order for a GFlags command to take effect, you must restart your computer after you issue the command.

To enable system-wide normal page heap

  1. Type the following at the command line:
    gflags -r +hpa
  2. Restart your computer.

To disable system-wide normal page heap

  1. Type the following at the command line:
    gflags -r -hpa
  2. Restart your computer.

Note

  • No other GFlags settings are useful when you enable page heap. If other settings that appear to be related to the heap are enabled, then page heap bugs can be introduced due to conflicts between page heap manager and these "harmless" heap flags.

Unaligned Allocations

The Windows heap managers (all versions) have always guaranteed that the heap allocations have a start address that is 8-byte aligned (on 64-bit platforms the alignment is 16-bytes). The page heap manager makes the same guarantee. This is impossible, however, if you want to have the end-of-the-allocation exactly at the end of a page. The exact end-of-page allocation is needed so that an off-by-one-byte error will trigger a read or write into the non-accessible page and cause an immediate fault.

If the user-requested size for the block is not 8-byte aligned, then page heap cannot meet both the "start address 8-byte aligned" and the "end address page aligned" constraints. The solution is to meet the first constraint and make the start of the block 8-byte aligned. Then use a small fill pattern between the end of the block and the start of the non-accessible page. This fill pattern can be from 0 bytes through 7 bytes in length on 32-bit architectures. The fill pattern is checked upon free.

If immediate fault detection is needed for these allocations that otherwise will have a fill pattern at the end, then make the page heap manager ignore the 8-byte alignment rule, and always align the end of the allocation at a page boundary by using the /unaligned and /full parameters. For more information, see the /unaligned parameter.

Note

  • Some applications make assumptions about 8-byte alignment and they will stop working correctly with the /unaligned parameter. Internet Explorer is one such example.

Uncommitted Pages for Full-Page Heap Allocations

The core full-page heap implementation commits two pages for any allocation smaller than one page. One page is used for the user allocation, and the other is made non-accessible at the end of the buffer.

End-of-buffer overruns can be detected by using a zone of reserved virtual space, instead of a non-accessible committed page. An access violation exception occurs when the process touches that reserved virtual space. This approach can reduce memory consumption by up to 50 percent. For more information, see the /decommit parameter.

Fault Injection

You can control page heap manager so that some allocations are deliberately failed. This is useful in simulating low memory conditions without actually using all system resources.

Specify a number from 1 through 10000 to represent the probability that an allocation will fail. Using a probability of 10000 ensures that 100 percent of allocations will fail. A probability of 2000 specifies that approximately 20 percent of allocations will fail.

The page heap manager takes special care to avoid fault injection in both the first five seconds of the process’ life, and the Windows NT loader code paths (for exampole, LoadLibrary, FreeLibrary). If five seconds is not sufficient to allow your process to complete startup, then ou can specify a longer timeout at the beginning of the process. For more information, see the /fault parameter.

When you use the /fault parameter and the process being tested has a bug, an exception will be raised. Generally, the reason for this is that the allocate operation returned a NULL, and the application later tries to access the allocated memory. Since the allocate failed, however, the memory cannot be accessed, and therefore an access violation occurs.

The other reason that an exception is raised is that the application tries to deal with the allocation failure, but does not release some resources. This manifests as a memory leak and is more difficult to debug.

In order to help diagnose these failures, the page heap manager keeps a history of stack traces from the moment of fault injection. These traces can be displayed with the following debugger command:

!heap –p –f [NUMBER-OF-TRACES]

By default the extension will display only the last four traces.

Automatically Attaching a Debugger When the Application Starts

Some applications are difficult to start from a command prompt, or they are spawned from other processes. For these applications, specify that, whenever they are started, a debugger will automatically be attached to them. This is useful if page heap is enabled for that process and heap failures occur. For more information, see the /debug parameter.

What Interfaces Does PageHeap Verify?

PageHeap is effective when used to verify any memory allocation process, including C++ style allocations new and delete, as long as the custom allocation/free functions eventually call into NT heap management interfaces (that is, RtlAllocateHeap, RtlFreeHeap). The following functions are guaranteed to do that:

  • Functions like HeapAlloc, HeapFree, HeapReAlloc: These functions are exported by kernel32.dll and call directly into the NT heap interfaces.
  • Functions like GlobalAlloc, GlobalFree, GlobalReAlloc: These functions are exported by kernel32.dll and call either directly or indirectly into the NT heap interfaces.
  • Functions like LocalAlloc, LocalFree, LocalReAlloc: These functions are exported by kernel32.dll and call either directly or indirectly into the NT heap interfaces.
  • Functions malloc, free, realloc, msize, expand: These functions are exported by msvcrt.dll and call either directly or indirectly into NT heap. This has not always been the case. The C run-time used to have a different heap implementation, but the current C run-time calls directly into NT heap.
  • Operators new, delete, new[ ] , delete[ ] : These functions are exported by msvcrt.dll and call either directly or indirectly into NT heap.

    • Any other allocation/free set of functions probably is a custom scheme and is not guaranteed to call either directly or indirectly into NT heap. Only source code inspection or running under debugger can reveal the actual implementation.

    Avoid using static linking. Some applications have been statically linked to old versions of the C runtime. These old versions do not call NT heap APIs, and PageHeap cannot be used to verify these allocations. Dynamic linking ensures that you get the latest C runtime library (msvcrt.dll).

Classes of Bugs Found by PageHeap

PageHeap detects most heap-related bugs; however, it is focused on heap corruption problems and not focused on leaks. PageHeap has limited success with finding heap leaks, although it has functionality to target this.

One of the advantages of PageHeap is that many errors are detected when they happen. For example, an off-by-one-byte error at the end of a dynamically allocated buffer might cause an instant access violation. There are few types of errors that cannot be detected when they occur. In those cases, the error report is delayed until the block is freed.

  • Invalid heap pointer: All Win32 and Windows NT level heap interfaces take as a first parameter a pointer to the heap where the operation should happen. The page heap manager detects an invalid heap pointer at the moment the call is made.
  • Invalid heap block pointer: After a block is allocated, it can be used as a parameter for several heap interfaces, notably the free() class of interfaces. The page heap manager immediately detects an invalid heap block pointer. See Debugging Page Heap Failures for a way to determine if the invalid address is a few bytes off, or is completely incorrect.
  • Multithreaded unsynchronized access to the heap: Some applications call into a heap from multiple threads. This type of scenario requires setting a flag (by the user) which will trigger acquiring a heap lock. The page heap manager will detect this type of violation when two threads attempt to call simultaneously into the heap.
  • Assumptions about reallocation of a block at the same address: A reallocation operation is not guaranteed to return the same address. This is especially true when the reallocation reduces the size of the block. Some applications assume that reallocation will return the same address. The page heap manager always allocates a new block during a reallocation and frees the old block. The free block is protected for read/write access, and therefore any access to it will raise an access violation.
  • Double free: This bug, where the same heap blocks are freed several times, is common in some applications. This is detected immediately by the page heap manager because, on the second free, the block will not have the proper prefix header and cannot be found among the allocated blocks. See Debugging Page Heap Failures for ways to analyze the stack trace of the first free operation. This error can be a variant of the reallocation problem because, when the application frees what it thinks it is the address of the block, that block was already freed as part of the reallocation.
  • Access of block after free: Freed memory blocks are kept for a short time by the page heap manager in a pool of protected memory. Any access to those blocks will raise an access violation. Based on the "locality" principle, most of the problems should be caught if the free protected pool is large enough. If the freed block is still in the protected pool, the bug is caught instantly. However, if the memory was reused, then there is less chance of finding the bug or identifying the code that caused it.
  • Access after the end of allocated block: The page heap manager places an inaccessible page immediately following the allocated block. Any access past the end of the block will raise an access violation. Some applications expect allocations to be 8-byte aligned. This feature has been supported since Windows NT 3.5 heap managers. A request size that is not 8-byte aligned will still get an 8-byte aligned address, but this leaves a few bytes after the end of the block that are still accessible. If the application corrupts only those few bytes, then the error will be caught only by checking the block suffix pattern when the block is freed.
  • Access before the start of allocated block: The page heap manager can be instructed through a settable flag to place the inaccessible page at the beginning of the block, rather than at the end. Any access before the start of the block will raise an access violation.
Failure | Normal page heap | Full-page heap
Invalid heap pointer | Caught instantly | Caught instantly
Invalid heap block pointer | Caught instantly | Caught instantly
Unsynchronized access | Caught instantly | Caught instantly
Assumption about reallocation address | 90% until real free | 90% caught instantly
Double free | 90% caught instantly | 90% caught instantly
Reuse after free | 90% until real free | 90% caught instantly
Access after end of block | Caught upon free | Caught instantly
Access before start of block | Caught upon free | Caught instantly (special flag)

Debugging Page Heap Failures

With full-page heap enabled for end-of-buffer-overrun bug detection, an application will access violate at the moment it tries to access memory past the end of the page. These failures are easy to debug because the current stack trace points directly to the failing code.

If normal page heap is used, or if the corruption happens in the small fill pattern at the end of the buffer for alignment reasons, then the corruption will be detected only when the block is freed. In these cases, additional debugging is required to identify the problem.

The Structure of a Page Heap Block

The page heap manager places a header at the beginning of all allocations, both full and normal. This header contains valuable information: the owning heap, user requested size, and in some cases, stack trace for the allocation.

Diagram of a normal page heap block structure Diagram of a full page heap block structure

The information block has the following structure:

DPH_BLOCK_INFORMATION

ULONG 		StartStamp;
PVOID 		Heap;
SIZE_T 	         RequestedSize;
SIZE_T 	         ActualSize;
LIST_ENTRY 	FreeQueue;
PVOID 		StackTrace;
ULONG 		EndStamp;

The Heap field stores the owning heap. The user-requested size for the block is in RequestedSize. The stack can be obtained by issuing a dds debugger command at StackTrace address. The best way to get a dump of this structure is to use the following dd debugger command:

dd ADDRESS L20

Or if you have the latest NT debugger package and PDB symbols for ntdll.dll, then use the following:

dt ntdll!_DPH_BLOCK_INFORMATION ADDRESS

The StackTrace field does not always contain a non-null value. Stack trace detection is only supported on x86 platforms, but even on x86 machines the stack trace detection algorithms are not completely reliable. If the block is an allocated block, then the stack trace is for the allocation moment. If the block was freed, then the stack trace is for the free moment.

The Page Heap Debugger Extension

The page heap debugger extension is part of the !heap extension (Windows NT heap debugger extension). Simple help can be obtained by typing the following from within the debugger:

!heap -?

More extensive information is available by typing the following:

!heap -p -?

The extension is not intelligent enough to detect on its own if page heap is enabled for a process. The user needs to know that page heap is enabled and use commands prefixed by !heap -p.
Command | Description
!heap -p | Dumps addresses of all full page heaps created in the process.
!heap -p -h HEAP-ADDRESS | Full dump of full page heap at HEAP-ADDRESS.
!heap -p -a ADDRESS | Tries to determine if there is a heap block at ADDRESS. This value does not need to be the address of the start of the block. The command is useful if you have no information about the nature of a memory area.
!heap -p -t NUMBER | This command dumps the first NUMBER heavy users of heap allocations. This command is useful for leak analysis.

Typical Debug Scenarios

There are several failure scenarios that you may encounter. Some of them require additional detective work to get the whole picture.

Access violation in a non-accessible page

This happens when full-page heap is enabled and the tested application accesses heap beyond the end of the buffer. It can also happen when the application touches a freed block. In order to understand the nature of the address on which the exception happened, use this command in the debugger:

!heap -p -f ADDRESS-OF-AV

Corrupted block message

At several moments during the lifetime of an allocation (allocation, user free, real free), the page heap manager checks to see if the block has all fill patterns intact, and if the block header has consistent data. If this is not the case you will get the message "Page heap: block @ ADDRESS is corrupted".

If this is a full-page heap block (that is, if you know that full-page heap is enabled for all allocations), then you can use this command to find the characteristics of the block:

!heap -p -f ADDRESS

If it is a normal page heap block, then you must determine the start address for the block header. To do this, dump 30-40 bytes below the reported address and look for the start/end patterns for a block header: ABCDAAAA, ABCDBBBB, ABCDAAA9, ABCDBBBA. See The Structure of a Page Heap Block for more information about the structure of the heap.

The header provides most of the information that you need to understand a failure. Specifically the start/end patterns tell you if the block is allocated or free, and if it is a normal or full-page heap block. The information has to be matched carefully with the offending call. For example, if a call to HeapFree is made with the address of a block plus four bytes, then you will get the corrupted block message. The block header will look fine, but the first byte after the end of the header (that is, the first byte after 0xDCBAxxxx) has a different address then the one in the call.

Note

  • Even if you have full-page heap enabled, you can get the corrupted block message if there is an "off-by-a-few-bytes" error because of the small fill pattern needed at end of allocations for alignment reasons. See "Unaligned allocations" earlier in this document.

Special fill pointers

The page heap manager fills the user allocation with values that look like kernel pointers (fill value is F0). This occurs when the block is freed and if the block is allocated, but no request is made for the block to be zeroed (fill value is E0 for normal page heap and C0 for full-page heap). The non-zeroed allocations are typical for malloc/new users. If there is an access violation where a read/write is attempted at addresses like 0xF0F0F0F0, 0xE0E0E0E0, 0xC0C0C0C0, then the test application has probably hit one of these cases.

A read/write at 0xF0F0F0F0 means that a block has been used after it was freed. You need to do some detective work to find out which block caused this. Inspect the stack trace of the failure and the code for the functions on the stack. Look for functions that make wrong assumptions about an allocation being available after it was freed.

A read/write at 0xE0E0E0E0 or 0xC0C0C0C0 means that the application did not initialize the allocation properly. Inspect the code of the functions in the current stack trace.


PageHeap Syntax
Overview | Notes | Syntax | Examples | Related Tools

PageHeap uses the following syntax:

One Step pageheap [/enable ProgramName] [/disable ProgramName] [/full | /size SizeStart SizeEnd | /address AddressStart AddressEnd | /dlls DLL [...Dll] | /random Probability] [/debug | /kdebug] [/backwards] [/unaligned] [/decommit] [/notraces] [/fault Rate [Timeout]] [/leaks] [/protect] [/no_sync] [/no_lock_checks]

Parameters

/enable ProgramName
Enables page heap with default settings. ProgramName is the name of the program including the file extension.
/disable ProgramName
Disables page heap. ProgramName is the name of the program including the file extension.
/full
Specifies page heap for all allocations. Full-page heap allocations are memory intensive and should only be used in conjunction with a specified allocation range or DLL for large-scale processes. For more information about the full-page heap method, see Choosing a Method to Investigate Heap Block Corruptions in PageHeap Notes.
/size SizeStart SizeEnd
Specifies PageHeap allocations for a size range. SizeStart and SizeEnd are decimal integers.
/address AddressStart AddressEnd
Allows page heap allocations only in blocks that are contained in the stack trace, captured at the moment of allocation, and only if the address also falls in the specified range of addresses. AddressStart and AddressEnd specify the address range to be searched on all allocation stack traces and are specified as hexadecimal numbers in "C" syntax (that is, 0xAABBCCDD). This parameter is not commonly used.

Note

  • The /address parameters works only on x86 architectures and is not always reliable due to the underlying stack trace capturing algorithms.
/dlls DLL
Allocates in full-page heap only if the request comes from certain DLLs, and redirects all imports for the specified DLL to page heap functions. DLL is the name of a binary file including its file extension. The following imported functions are redirected:
HeapAlloc/Free | GlobalAlloc/Free | LocalAlloc/Free
malloc/free | operator new/delete | operator new[ ]/delete[ ]
/random Probability
Allows page heap to decide randomly if the allocation will be made in full-page heap or in normal page heap. Probability is a decimal integer from 0 through 100, representing the probability of a full-page heap allocation, rather than a normal heap allocation. Probability of 100 is the equivalent of using the /full parameter. Probability of 0 is the equivalent of using normal page heap.
/debug
Automatically launches PageHeap under debugger "ntsd -g -G -x" and attaches to the process specified by the /enable parameter. For more information, see Automatically Attaching a Debugger When the Application Starts in PageHeap Notes.
/kdebug
Launches PageHeap under debugger "ntsd -g -G -d -x" and redirects debugger output to the kernel debugger if there is one attached. This paremeter is not commonly used.
/backwards
Places a non-accessible page at the beginning of an allocation, rather than the end of it. This enables PageHeap to find overruns at the start of the buffer, instead of end buffer overruns. Use /backwards only with the /full parameter.
/unaligned
Directs page heap manager to ignore the 8-byte alignment rule and always align the end of the allocation at a page boundary. For more information, see Unaligned Allocations in PageHeap Notes.

Note

  • Some applications make assumptions about 8-byte alignment and will stop working correctly with the /unaligned parameter. Internet Explorer is one such example.
/decommit
Enables the use of the reserved virtual space feature, instead of non-accessible committed pages, and therefore reduces memory overhead. For more information, see Uncommitted Pages for Full-Page Heap Allocations in PageHeap Notes.
/notraces
Specifies that no stack traces are collected.
/fault Rate [Timeout]
Simulates low memory conditions by introducing heap allocation errors into the application being tested (fault injection). Rate is an integer from 1 through 10000 representing the probability that an allocation will fail. Timeout is the number of seconds that fault injection is disabled after an application starts. For more information, see Fault Injection in PageHeap Notes.
/leaks
Checks for heap leaks when a process shuts down. The /leaks parameter is effective only when normal page heap is enabled (that is, not full-page heap). Therefore, when the /leaks parameter is specified, all flags that force full-page heap are disabled.
/protect
Protects heap internal structures. The /protect parameter can be used to detect random corruptions, but will slow execution.
/no_sync
Checks for unsynchronized access and causes page heap to break if it detects that a heap created with HEAP_NO_SERIALIZE flag is accessed from different threads. Do not use this flag for a process that has its own custom heap manager (for example, MPheap process). If a process has a custom scheme to synchronize access then this parameter will give false positives.

Notes

  • When run without options, PageHeap will print all page heap enabled applications and their specific options.
  • Enabling page heap does not affect any processes that are already running. If you need to use page heap for a process that is already running and cannot be restarted (for example csrss.exe or winlogon.exe), then you must restart your computer after page heap has been enabled for that process.
  • Page heap manager supports multiple simultaneous parameters. The following command is an example of this:
    pageheap /enable iexplore.exe /dlls jscript.dll vbscript.dll /size 40 56 /random 3
    This command allocates in full-page heap all allocations made by iexplore.exe in jscript.dll or vbscript.dll, plus all blocks in range 40-56 bytes, and all other allocations with a probability of 3 percent.
  • If you try to use conflicting parameters, then PageHeap will give you an error message that a parameter has been disabled because of incompatibility with another parameter.

Sample Usage

pageheap /enable csapp.exe
pageheap /enable csapp.exe /full
pageheap /enable csapp.exe /dlls ole32.dll mshtml.dll jscript.dll
pageheap /enable csapp.exe /full /size 20 36
pageheap /enable csapp.exe /full /random 25
pageheap /enable csapp.exe /full /backwards
pageheap /enable csapp.exe /full /unaligned
pageheap /enable csapp.exe /full /decommit


PageHeap Examples
Overview | Notes | Syntax | Examples | Related Tools

Example 1: Test an Application Using PageHeap

Your application (pheap-buggy.exe) seems to have a problem with the heap. To enable normal page heap checking for the application, thereby minimizing the memory requirements, type the following at the command line:

pageheap /enable pheap-buggy.exe

To make sure that the partial page heap is actually enabled, type the following at the command line:

pageheap

You should see output similar to the following, confirming that partial page heap is enabled for pheap-buggy.exe:

pheap-buggy.exe: page heap enabled with flags

Next you need to run the application in a debugger. Type the following at the command line:

ntsd -g -x pheap-buggy /CorruptAfterEnd

When the application fails, you will see output similar to the following:

===========================================================
VERIFIER STOP 00000008: pid 0xAA0: corrupted suffix pattern

        00C81000 : Heap handle
        00D81EB0 : Heap block
        00000100 : Block size
        00000000 :
===========================================================

Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00d81eb0 ecx=77f7e257 edx=0006fa18 esi=00000008 edi=00c81000
eip=77f7e098 esp=0006fc48 ebp=0006fc5c iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
77f7e098 cc               int     3

The header information contains the address of the heap where the corrupted block is (00C81000 : Heap handle), the address of the corrupted block itself (00D81EB0 : Heap block) and the size of the allocation (00000100 : Block size). It is clear that PageHeap caught an error in pheap-buggy.exe. To further investigate the cause of the error by turning on line number dumping, type the following in the debuger:

.lines

The following information is displayed:

Line number information will be loaded

To specify that you want a call stack, type the following in the debugger:

kb

You will see output similar to the following call stack:

ChildEBP RetAddr  Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
0006fc5c 77f9e6dd 00000008 77f9e3e8 00c81000 ntdll!DbgBreakPoint
0006fcd8 77f9f3c8 00c81000 00000004 00d81eb0 ntdll!RtlpNtEnumerateSubKey+0x2879
0006fcfc 77f9f5bb 00c81000 01001002 00000010 ntdll!RtlpNtEnumerateSubKey+0x3564
0006fd4c 77fa261e 00c80000 01001002 00d81eb0 ntdll!RtlpNtEnumerateSubKey+0x3757
0006fdc0 77fc0dc2 00c80000 01001002 00d81eb0 ntdll!RtlpNtEnumerateSubKey+0x67ba
0006fe78 77fbd87b 00c80000 01001002 00d81eb0 ntdll!RtlSizeHeap+0x16a8
0006ff24 010013a4 00c80000 01001002 00d81eb0 ntdll!RtlFreeHeap+0x69
0006ff3c 01001450 00000000 00000001 0006ffc0 pheap-buggy!TestCorruptAfterEnd+0x2b [d:\nttest\base\testsrc\kernel\rtl\pageheap\pheap-buggy.cxx @ 185]
0006ff4c 0100157f 00000002 00c65a68 00c631d8 pheap-buggy!main+0xa9 [d:\nttest\base\testsrc\kernel\rtl\pageheap\pheap-buggy.cxx @ 69]
0006ffc0 77de43fe 00000000 00000001 7ffdf000 pheap-buggy!mainCRTStartup+0xe3 [crtexe.c @ 349]
0006fff0 00000000 0100149c 00000000 78746341 kernel32!DosPathToSessionPathA+0x204

Looking at this call stack, you see that this bug was caught when the function TestCorruptAfterEnd in pheap-buggy.exe tried to free an allocation at 0x00c80000 by calling HeapFree, which is just a redirect to RtlFreeHeap. You suspect that this "corrupted suffix pattern" break means that the application has violated a data integrity pattern after the end of its heap allocation. This leads you to believe that your code has written past the end of the buffer it allocated here. To quit the debugger so that you can look at your code, type the following in the debugger:

q

You look for the bug in your code, but you cannot find the problem. You decide to change PageHeap mode from normal to full and see if it can catch the misuse of this heap buffer at the exact time of misuse. To enable full-page heap for pheap-buggy.exe, type the following at the command line:

pageheap /enable pheap-buggy.exe /full

To make sure that full-page heap is actually enabled, type the following at the command line:

pageheap

You should see output similar to the following, confirming that full-page heap is enabled for pheap-buggy.exe:

pheap-buggy.exe: page heap enabled with flags (full traces )

To run pheap-buggy.exe in the debugger, type the following at the command line:

ntsd -g -x pheap-buggy /CorruptAfterEnd

When the application fails, you will see output similar to the following:

Page heap: process 0x5BC created heap @ 00880000 (00980000, flags 0x3)
ModLoad: 77db0000 77e8c000   kernel32.dll
ModLoad: 78000000 78046000   MSVCRT.dll
Page heap: process 0x5BC created heap @ 00B60000 (00C60000, flags 0x3)
Page heap: process 0x5BC created heap @ 00C80000 (00D80000, flags 0x3)
Access violation - code c0000005 (first chance)
Access violation - code c0000005 (!!! second chance !!!)
eax=00c86f00 ebx=00000000 ecx=77fbd80f edx=00c85000 esi=00c80000 edi=00c16fd0
eip=01001398 esp=0006ff2c ebp=0006ff4c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000206
pheap-buggy!TestCorruptAfterEnd+1f:
01001398 889801010000     mov     [eax+0x101],bl          ds:0023:00c87001=??

This time you have an access violation. To investigate the actual location of the access violation, you turn on line number dumping again by typing the following in the debuger:

.lines

The following information is displayed:

Line number information will be loaded

Once again you specify that you want a call stack by typing the following in the debugger:

kb

You will see output similar to the following call stack:

ChildEBP RetAddr  Args to Child
0006ff3c 01001450 00000000 00000001 0006ffc0 pheap-buggy!TestCorruptAfterEnd+0x1f [d:\nttest\base\testsrc\kernel\rtl\pageheap\pheap-buggy.cxx @ 184]
0006ff4c 0100157f 00000002 00c16fd0 00b70eb0 pheap-buggy!main+0xa9 [d:\nttest\base\testsrc\kernel\rtl\pageheap\pheap-buggy.cxx @ 69]
0006ffc0 77de43fe 00000000 00000001 7ffdf000 pheap-buggy!mainCRTStartup+0xe3 [crtexe.c @ 349]
WARNING: Stack unwind information not available. Following frames may be wrong.
0006fff0 00000000 0100149c 00000000 78746341 kernel32!DosPathToSessionPathA+0x204

You can see by the stack trace that the problem takes place at line 184 of pheap-buggy.exe ([d:\nttest\base\testsrc\kernel\rtl\pageheap\pheap-buggy.cxx @ 184]). Because you used a full-page heap, this time the call stack starts in your code, not in a system DLL. As a result the bug was caught as it happened instead of when the heap block was freed. To quit the debugger so that you can look at your code, type the following in the debugger:

q

Line 184 in pheap-buggy.cxx reads as follows:

*((PCHAR)Block + 0x100 + 1) = 0;

Looking at this code you see that the buffer is 0x100 bytes large, but you are trying to write to the 0x101th byte. You have identified the bug. It is an off-by-one error where you have written beyond the end of the memory allocation.


Qfixapp.exe: Quick Fix Application
Overview | Notes | UI | Examples | Related Tools

This GUI tool provides an interface for determining which combination of fixes will resolve an application compatibility problem for a selected executable (.exe) file. When your target file has a common name (for example, setup.exe), QFixApp provides the ability to identify a file using file properties and matching file information. This ensures that fixes are applied to the correct file. Once you have uniquely identified a target file, use QFixApp to identify which combinations of fixes allow that application to work on Windows XP.

Use CompatAdmin to create an SDB package to deploy your fix to other target computers.

Corresponding UI

QFixApp provides its own user interface. See QFixApp UI for more information.

Concepts

Applications that worked on earlier versions of Windows may fail to function properly on Windows XP. There are several reasons that this may happen:

  • The application refuses to run when Windows reports new, higher operating system version numbers. Often the application will work well on the new version of Windows if the user can get past this block in the application.
  • The application calls older versions of Win32 API functions that return unexpected values on computers with large amounts of resources such as disk free space.
  • The application expects older formats of Windows data.
  • The application expects user information (such as personal and temporary folders) to be in specific locations or specific formats.

System Requirements

The following are the system requirements for QFixApp:

  • Windows XP Professional

Files Required

  • Qfixapp.exe
  • Shimdbc.exe
  • Acfileattr.dll


QFixApp Notes
Overview | Notes | UI | Examples | Related Tools

Identifying a Specific Executable

There might be more than one executable (.exe) file on any given computer with the same name (for example, setup.exe), but only one of those files should have the specified QFixApp fixes applied to it. Use QFixApp advanced features to control how the tool identifies target files.

To identify a specific executable file:

  1. Click Browse and select the application's executable file.
  2. Click Advanced to display QFixApp's advanced features.
  3. Select one or more of the properties listed in the Choose file identification attributes box.
  4. If there are not enough file properties to uniquely identify the target file, then click Add matching file.
  5. Select the files with which you want to associate your executable file.

Note

  • If a matching file is added, but it should not actually be used, it cannot be deleted from the QFixApp interface. Instead, reselect the target executable file in QFixApp. QFixApp will remove all matching file information.

Identifying Application Fixes

The QFixApp interface provides the ability to select an executable file and apply fixes to it. QFixApp also provides the ability to group sets of fixes so that a group of fixes can be applied to an executable file.

Applying Fixes to an Executable

To apply fixes to an executable file:

  1. Click Browse and select the application's executable file.
  2. Click the Fixes tab. This displays a list of each of the 139 fixes currently available for applications on Windows XP.
  3. Select any combination of these fixes by checking the box next to each name.

Applying a Layer to an Executable

To apply a group of fixes to an executable file:

  1. Click Browse and select the application's executable file.
  2. Click the Layers tab. This displays a list sets of fixes currently available for applications on Windows XP.
  3. Select any layer by checking the box next to its name.

Testing an Application with Fixes

To test an application's executable file with one or more of the fixes:
  1. Click Browse and select the application's executable file.
  2. Add any required, command-line parameters in the Cmd line box.
  3. Select fixes by checking the appropriate boxes on the Fixes and/or Layers tab.
  4. Click Run.

Use Tasklist, a utility that is part of the Windows XP operating system, to display information on the application process started by QFixApp. The Tasklist output displays the DLLs normally used by the application, as well as any additional DLLs that implement the specified fix.

Note

  • QFixApp uses the support utility Shimdbc.exe to test fixes.

Understanding the QFixApp Output

QFixApp creates a log file called Qfixapp.log in the %WINDIR%\AppPatch folder. This file shows information about the QFixApp session. View the log by clicking View log in the QFixApp interface. The systest.sdb file and the .xml file with the base name of the target application contain the fix information.

When QFixApp is closed, Windows XP will not continue to apply fixes to the application, even though the new files are not removed from the \AppPatch folder.

Note

  • If a fix is applied to an application executable file with QFixApp, and the application is then closed, the fix will still be applied to any new instances of that same executable file until QFixApp is closed. This feature allows the application of fixes to several executable files in the same QFixApp session.

Understanding the AppPatch Folder

Four DLLs located in the %WINDIR%\AppPatch folder contain all the fixes. The apphelp.sdb and sysmain.sdb files implement the AppHelp messages and application fixes supplied as part of Windows XP.

When a fix is tested for an application with QFixApp, QFixApp adds new files to the folder.

Deploying Fixes on Windows XP

QFixApp is intended to help determine which fixes to apply to an application. Once this is done, use Compatadmin to deploy the fixes for the application to other users' Windows XP computers. It is possible to use the .sdb file generated by QFixApp to deploy fixes for a single application to other target computers, but Compatadmin allows you to create a single .sdb file containing the fixes for multiple applications. Compatadmin also provides an interface for managing multiple .sdb files.


QFixApp UI
Overview | Notes | UI | Examples | Related Tools

The top of the QFixApp dialog box allows you to select the file to which you want to apply fixes and specify any required command-line parameters.

Top of QFixApp dialog box

You can also use Disable existing fixes in the database if you want to ensure that the fixes you are trying are the only ones being applied to the application. This is a quick way to make sure that no other .sdb is also applying fixes.

Note

  • If you want to disable fixes in the system, the Application Compatibility Team strongly suggests that you use Compatadmin.

Fixes Tab

The Fixes tab shows each of the 139 fixes that are currently available for applications on Windows XP. You can select any combination of these fixes by checking the box next to each name.

To get more information about a fix, select a fix and read the descriptive text in the Fix description box. You need not check a fix to read the description.

Note

  • Some of the descriptions refer to shims, an older term for application fixes.

Layers Tab

Many applications require the same sets of fixes to work well on Windows XP. The Layers tab groups sets of fixes so that you can apply them without selecting each fix separately. These groups are called layers or modes.

To see which fixes are used in each layer, select a layer on the Layers tab, then choose the Fixes tab. Each fix applied by the selected layer is checked on the Fixes tab.

Advanced Features

QFixApp uses several mechanisms to make sure that it applies fixes to the correct executable (.exe) file. The Advanced button provides access to additional QFixApp features that control how the tool identifies target files.

Advanced Features view

File Properties

QFixApp identifies up to sixteen properties in the target file and lists them in the Choose file identification attributes box. Sixteen properties are usually sufficient to uniquely identify any executable file. You can select one or more properties for the verification process.

File Matching

Some applications do not expose all sixteen properties. In some cases, the number of properties actually exposed may not be enough to uniquely identify fixes for a particular executable file in an application-rich environment.

QFixApp can use information for one or more additional files to help identify the target file. Click Add matching file to select additional files for verification. Selecting additional files instructs QFixApp to use that file information to help verify the target file. QFixApp will only apply fixes to the specified target file if it meets the criteria specified in the window on the right side of the QFixApp interface.

Note

  • If you mistakenly add a matching file that should not be used, you cannot delete it from the QFixApp interface. Instead, reselect the target executable file in QFixApp. QFixApp will remove all matching file information.

Creating a Fix

When you have identified the layers or fixes that you want to apply to an application, you can use Create fix support to create an .sdb file; however, QFixApp gives you little control over this file. You cannot rename it, and it only contains the fix for the single application.

The Compatadmin tool has a fix wizard that adds your single fix to an SDB package. It also allows you to name the SDB package as well as providing an interface for building and managing SDB files.

Show XML

This is used by the Microsoft development team.


QFixApp Examples
Overview | Notes | UI | Examples | Related Tools

Example 1: Fix a Windows 95 Application

The following example uses QFixApp to fix the demoapp.exe file that ships with the Application Compatibility Toolkit.

Double click on demoapp.exe in the following path:

c:\program files\application compatibility toolkit\demoapp\demoapp.exe

The following error is displayed:

Demoapp.exe requires Windows 95.

Before you start using QFixApp, open a command window and type the following at the command line:

dir c:\windows\apppatch\*.*

This will show the files that are in the %WINDIR%\AppPatch folder by default. Your output will be similar to the following:

 Volume in drive C has no label.
 Volume Serial Number is E827-33AC

 Directory of C:\WINDOWS\AppPatch

05/11/2001  01:02 PM    <DIR>          .
05/11/2001  01:02 PM    <DIR>          ..
04/06/2001  05:00 AM           369,152 AcGenral.dll
04/06/2001  05:00 AM           231,936 AcLayers.dll
04/06/2001  05:00 AM            89,600 AcSpecfc.dll
04/06/2001  05:00 AM            54,272 AcXtrnal.dll
04/06/2001  05:00 AM           171,182 apphelp.sdb
04/06/2001  05:00 AM           713,946 sysmain.sdb
               6 File(s)      1,630,088 bytes
               2 Dir(s)   1,520,504,832 bytes free

The four DLLs located in the %WINDIR%/AppPatch folder contain the fixes. The two files, apphelp.sdb and sysmain.sdb, implement the AppHelp messages and application fixes supplied as part of Windows XP Professional.

To try fixes with demoapp.exe, run QFixApp. Click Browse and locate the demoapp.exe file. Select the Layers tab if it is not already selected. Since we know that the application requires Windows 95 to run, we'll start by selecting the Windows 95 layer.

You can see what fixes are included in this layer by clicking the Fixes tab. Select any fix, and without clearing the checkbox, read the description displayed in the Fix description text box.

To test the Windows 95 layer with the demoapp.exe application, click Run. This application does not require any command-line parameters, but if it did, we would type them into the Cmdline box.

Click Run to test demoapp. Now the following error is displayed:

Debug: couldn't load CVT32.DLL.

However, when you click OK to dismiss the error dialog box, the setup program appears to be ready to continue. Follow the rest of the installation process and the application will now run to completion. Choose to restart your computer later, and click Finish.

To see what files are now in the %WINDIR%\AppPatch folder, type the following at the command line in a command window:

dir c:\windows\apppatch

Your output will look similar to the following:

 Volume in drive C has no label.
 Volume Serial Number is E827-33AC

 Directory of c:\windows\apppatch

05/11/2001  01:57 PM    <DIR>          .
05/11/2001  01:57 PM    <DIR>          ..
04/06/2001  05:00 AM           369,152 AcGenral.dll
04/06/2001  05:00 AM           231,936 AcLayers.dll
04/06/2001  05:00 AM            89,600 AcSpecfc.dll
04/06/2001  05:00 AM            54,272 AcXtrnal.dll
04/06/2001  05:00 AM           171,182 apphelp.sdb
05/11/2001  01:57 PM             1,042 demoapp.xml
05/11/2001  01:57 PM             1,764 QFixApp.log
04/06/2001  05:00 AM           713,946 sysmain.sdb
05/11/2001  01:57 PM               650 systest.sdb
               9 File(s)      1,633,544 bytes
               2 Dir(s)   1,520,295,936 bytes free

There are now three additional files in the folder: systest.sdb (which contains the fixes that were applied to demoapp.exe), Qfixapp.log (which shows the fixes applied to the application during the test run), and demoapp.xml (which is list of the fixes being applied in xml format). As long as QFixApp is open, the fixes in systest.sdb will be applied to demoapp.exe when it is run.

Click View log to open the Qfixapp.log file. The contents will look similar to the following:

Expand to see Qfixapp.log Sample 1

-------------------------------------------
 Log  "C:\Program Files\Application Compatibility Toolkit 2\demoapp\demoapp.exe"
-------------------------------------------
05/11/2001 13:25:11 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "C:\Program".
05/11/2001 13:25:11 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "Files\Application".
05/11/2001 13:25:11 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "Compatibility".
05/11/2001 13:25:11 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "Toolkit".
05/11/2001 13:25:11 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "2\demoapp\demoapp.exe".
05/11/2001 13:25:11 MapMemoryB0000 3 - [NotifyFn] Created block at 0xB0000.
05/11/2001 13:25:11 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:25:11 EmulateGetCommandLine 1 - [GetCommandLineA] Changed "C:\PROGRA~1\APPLIC~1\demoapp\demoapp.exe " to "C:\PROGRA~1\APPLIC~1\demoapp\demoapp.exe ".
05/11/2001 13:25:11 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:25:11 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:25:11 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:25:11 Win95VersionLie 3 - [GetVersion] Return Win95.
05/11/2001 13:25:11 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:25:11 EmulateGetCommandLine 1 - [GetModuleFileNameA] Changed "C:\Program Files\Application Compatibility Toolkit 2\demoapp\demoapp.exe" to "C:\PROGRA~1\APPLIC~1\demoapp\demoapp.exe".
05/11/2001 13:25:11 EmulateBitmapStride 3 - [GetObjectA] width of scan lines from 426 to 428
05/11/2001 13:25:16 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:25:22 IgnoreLoadLibrary 3 - APIHook_LoadLibraryA Allow(CVT32.DLL)
05/11/2001 13:25:26 EmulateGetDiskFreeSpace 3 - [GetDiskFreeSpaceA] Called. Returning <=2GB FREE SPACE
05/11/2001 13:25:27 EMULATEGETCOMMANDLINE 1 - [GETMODULEFILENAMEA] CHANGED "C:\Program Files\Application Compatibility Toolkit 2\demoapp\demoapp.exe" TO "C:\PROGRA~1\APPLIC~1\demoapp\demoapp.exe".
05/11/2001 13:25:27 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES
    C:\PROGRA~1

05/11/2001 13:25:27 CORRECTFILEPATHS 1 - CREATEDIRECTORYA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:25:27 CORRECTFILEPATHS 1 - CREATEDIRECTORYA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:25:27 CORRECTFILEPATHS 1 - COPYFILEA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT

05/11/2001 13:25:27 CORRECTFILEPATHS 1 - COPYFILEA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:25:27 CORRECTFILEPATHS 1 - COPYFILEA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP

05/11/2001 13:25:27 CORRECTFILEPATHS 1 - COPYFILEA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMODLL.DLL
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMODLL.DLL

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS

05/11/2001 13:25:31 HANDLEREGEXPANDSZREGISTRYKEYS 3 - [REGQUERYVALUEEXW] CAUGHT REG_EXPAND_SZ KEY: "(null)".
05/11/2001 13:25:31 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - CREATEDIRECTORYA CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO

05/11/2001 13:25:31 CORRECTFILEPATHS 1 - WINEXEC CORRECTED PATH:
    EXPLORER.EXE C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO
    EXPLORER.EXE C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO

05/11/2001 13:25:31 WINEXECRACECONDITIONFIX 3 - [WINEXEC] CALLED. RETURNING WITHOUT WAITING FOR NEW PROCESS TO START.
-------------------------------------------
 LOG  "C:\WINDOWS\explorer.exe"
-------------------------------------------
05/11/2001 13:25:31 EMULATECREATEPROCESS 1 - [EMULATECREATEPROCESS_PARSECOMMANDLINE] ILLEGAL COMMAND LINE SWITCH "C:\WINDOWS\explorer.exe".
05/11/2001 13:25:32 MAPMEMORYB0000 3 - [NOTIFYFN] CREATED BLOCK AT 0XB0000.
05/11/2001 13:25:32 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:25:32 EMULATEGETCOMMANDLINE 1 - [GETCOMMANDLINEA] CHANGED "explorer.exe C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Programs\Compatibility Demo" TO "C:\WINDOWS\explorer.exe C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Programs\Compatibility Demo".
05/11/2001 13:25:32 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:25:32 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:25:32 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:25:32 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYW ALLOW(COMCTL32.DLL)
05/11/2001 13:25:32 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:25:32 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYW ALLOW(COMCTL32.DLL)
05/11/2001 13:25:32 HANDLEREGEXPANDSZREGISTRYKEYS 3 - [REGQUERYVALUEEXW] CAUGHT REG_EXPAND_SZ KEY: "(null)".
05/11/2001 13:25:33 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYA ALLOW(CLBCATQ.DLL)
05/11/2001 13:25:33 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYA ALLOW(CLBCATQ.DLL)
05/11/2001 13:25:33 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYEXW ALLOW(SHELL32.DLL)
05/11/2001 13:25:33 CORRECTFILEPATHS 1 - COMHOOK_ISHELLLINKA_SETPATH CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT

05/11/2001 13:25:33 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:33 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:33 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:33 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESECTIONW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\DESKTOP
    C:\DOCUME~1\ALLUSE~1.WIN\DESKTOP

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\DESKTOP
    C:\DOCUME~1\ALLUSE~1.WIN\DESKTOP

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - COMHOOK_IPERSISTFILE_SAVE CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO README.LNK
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO README.LNK

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\WINDOWS\SYSTEM32
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\SYSTEM32

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\WINDOWS\SYSTEM32
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\SYSTEM32

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES
    C:\PROGRA~1

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:34 HANDLEREGEXPANDSZREGISTRYKEYS 3 - [REGQUERYVALUEEXW] CAUGHT REG_EXPAND_SZ KEY: "(null)".
05/11/2001 13:25:37 CORRECTFILEPATHS 1 - COMHOOK_ISHELLLINKA_SETPATH CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESECTIONW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - COMHOOK_IPERSISTFILE_SAVE CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO.LNK
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO.LNK

05/11/2001 13:25:37 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - COMHOOK_ISHELLLINKA_SETPATH CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESECTIONW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - COMHOOK_IPERSISTFILE_SAVE CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO HELP.LNK
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO HELP.LNK

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\WINDOWS\SYSTEM32
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\SYSTEM32

05/11/2001 13:25:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\WINDOWS\SYSTEM32
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\SYSTEM32

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - COMHOOK_ISHELLLINKA_SETPATH CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESECTIONW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - COMHOOK_IPERSISTFILE_SAVE CORRECTED PATH:
    C:\WINDOWS\DESKTOP\COMPATIBILITY DEMO.LNK
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\DESKTOP\COMPATIBILITY DEMO.LNK

05/11/2001 13:25:43 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

-------------------------------------------
 LOG  "C:\WINDOWS\notepad.exe"
-------------------------------------------

If you look through the output, you will see that the only fixes that were applied from the Windows 95 layer are CorrectFilePaths, EmulateBitmapStride, EmulateCreateProcess, EmulateGetCommandLine, EmulateGetDiskFreeSpace, HandleRegExpandSzRegistryKeys, IgnoreLoadLibrary, MapMemoryB0000, and Win95VersionLie.

Select the Fixes tab and click Clear to deselect the fixes associated with the Windows 95 layer. Instead, select only those fixes that were used.

As you select the fixes, read the description associated with each in the Fix description box. For example, you will notice that the description for the EmulateBitmapStride specifies that it is only used with Windows 2000. Since you are not applying a fix to an application on Windows 2000, deselect the EmulateBitmapStride fix.

When you have selected the remaining fixes from the list, click Run again. Dismiss the error dialog box and let the application run to completion. Choose to restart your computer later, and click Finish.

Click View log to open the new Qfixapp.log file. The contents will look similar to the following:

Expand to see Qfixapp.log Sample 2

-------------------------------------------
 Log  "C:\Program Files\Application Compatibility Toolkit 2\demoapp\demoapp.exe"
-------------------------------------------
05/11/2001 13:29:59 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "C:\Program".
05/11/2001 13:29:59 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "Files\Application".
05/11/2001 13:29:59 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "Compatibility".
05/11/2001 13:29:59 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "Toolkit".
05/11/2001 13:29:59 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "2\demoapp\demoapp.exe".
05/11/2001 13:29:59 MapMemoryB0000 3 - [NotifyFn] Created block at 0xB0000.
05/11/2001 13:29:59 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:29:59 EmulateGetCommandLine 1 - [GetCommandLineA] Changed "C:\PROGRA~1\APPLIC~1\demoapp\demoapp.exe " to "C:\PROGRA~1\APPLIC~1\demoapp\demoapp.exe ".
05/11/2001 13:29:59 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:30:00 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:30:00 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:30:00 Win95VersionLie 3 - [GetVersion] Return Win95.
05/11/2001 13:30:00 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:30:00 EmulateGetCommandLine 1 - [GetModuleFileNameA] Changed "C:\Program Files\Application Compatibility Toolkit 2\demoapp\demoapp.exe" to "C:\PROGRA~1\APPLIC~1\demoapp\demoapp.exe".
05/11/2001 13:30:05 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:30:11 IgnoreLoadLibrary 3 - APIHook_LoadLibraryA Allow(CVT32.DLL)
05/11/2001 13:30:15 EmulateGetDiskFreeSpace 3 - [GetDiskFreeSpaceA] Called. Returning <=2GB FREE SPACE
05/11/2001 13:30:16 EMULATEGETCOMMANDLINE 1 - [GETMODULEFILENAMEA] CHANGED "C:\Program Files\Application Compatibility Toolkit 2\demoapp\demoapp.exe" TO "C:\PROGRA~1\APPLIC~1\demoapp\demoapp.exe".
05/11/2001 13:30:16 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES
    C:\PROGRA~1

05/11/2001 13:30:16 CORRECTFILEPATHS 1 - CREATEDIRECTORYA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:30:16 CORRECTFILEPATHS 1 - CREATEDIRECTORYA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:30:16 CORRECTFILEPATHS 1 - COPYFILEA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT

05/11/2001 13:30:16 CORRECTFILEPATHS 1 - COPYFILEA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:30:17 CORRECTFILEPATHS 1 - COPYFILEA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP

05/11/2001 13:30:17 CORRECTFILEPATHS 1 - COPYFILEA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMODLL.DLL
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMODLL.DLL

05/11/2001 13:30:20 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS

05/11/2001 13:30:20 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1

05/11/2001 13:30:20 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:20 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - CREATEDIRECTORYA CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO

05/11/2001 13:30:21 CORRECTFILEPATHS 1 - WINEXEC CORRECTED PATH:
    EXPLORER.EXE C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO
    EXPLORER.EXE C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO

-------------------------------------------
 LOG  "C:\WINDOWS\explorer.exe"
-------------------------------------------
05/11/2001 13:30:21 EMULATECREATEPROCESS 1 - [EMULATECREATEPROCESS_PARSECOMMANDLINE] ILLEGAL COMMAND LINE SWITCH "C:\WINDOWS\explorer.exe".
05/11/2001 13:30:21 MAPMEMORYB0000 3 - [NOTIFYFN] CREATED BLOCK AT 0XB0000.
05/11/2001 13:30:21 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:30:21 EMULATEGETCOMMANDLINE 1 - [GETCOMMANDLINEA] CHANGED "explorer.exe C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Programs\Compatibility Demo" TO "C:\WINDOWS\explorer.exe C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Programs\Compatibility Demo".
05/11/2001 13:30:21 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:30:21 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:30:21 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:30:21 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYW ALLOW(COMCTL32.DLL)
05/11/2001 13:30:21 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:30:21 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYW ALLOW(COMCTL32.DLL)
05/11/2001 13:30:23 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYA ALLOW(CLBCATQ.DLL)
05/11/2001 13:30:23 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:30:23 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYA ALLOW(CLBCATQ.DLL)
05/11/2001 13:30:23 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYEXW ALLOW(SHELL32.DLL)
05/11/2001 13:30:23 CORRECTFILEPATHS 1 - COMHOOK_ISHELLLINKA_SETPATH CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESECTIONW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\DESKTOP
    C:\DOCUME~1\ALLUSE~1.WIN\DESKTOP

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\DESKTOP
    C:\DOCUME~1\ALLUSE~1.WIN\DESKTOP

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - COMHOOK_IPERSISTFILE_SAVE CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO README.LNK
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO README.LNK

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\WINDOWS\SYSTEM32
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\SYSTEM32

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\WINDOWS\SYSTEM32
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\SYSTEM32

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES
    C:\PROGRA~1

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:23 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - COMHOOK_ISHELLLINKA_SETPATH CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESECTIONW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - COMHOOK_IPERSISTFILE_SAVE CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO.LNK
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO.LNK

05/11/2001 13:30:26 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - COMHOOK_ISHELLLINKA_SETPATH CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESECTIONW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - COMHOOK_IPERSISTFILE_SAVE CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO HELP.LNK
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO HELP.LNK

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\WINDOWS\SYSTEM32
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\SYSTEM32

05/11/2001 13:30:29 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\WINDOWS\SYSTEM32
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\SYSTEM32

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - COMHOOK_ISHELLLINKA_SETPATH CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESECTIONW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:30:32 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:30:33 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:30:33 CORRECTFILEPATHS 1 - COMHOOK_IPERSISTFILE_SAVE CORRECTED PATH:
    C:\WINDOWS\DESKTOP\COMPATIBILITY DEMO.LNK
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\DESKTOP\COMPATIBILITY DEMO.LNK

05/11/2001 13:30:33 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

-------------------------------------------
 LOG  "C:\WINDOWS\notepad.exe"
-------------------------------------------

This time when you look through the output, you will see that only seven of the eight selected fixes were applied: CorrectFilePaths, EmulateCreateProcess, EmulateGetCommandLine, EmulateGetDiskFreeSpace, IgnoreLoadLibrary, MapMemoryB0000, and Win95VersionLie. Deselect the HandleRegExpandSzRegistryKeys fix. Then click Run to test demoapp.exe again. Dismiss the error dialog box and let the application run to completion, choose to restart your computer later, and click Finish.

Click View log to open the new Qfixapp.log file. The contents will look similar to the following:

Expand to see Qfixapp.log Sample 3

-------------------------------------------
 Log  "C:\Program Files\Application Compatibility Toolkit 2\demoapp\demoapp.exe"
-------------------------------------------
05/11/2001 13:46:16 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "C:\Program".
05/11/2001 13:46:16 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "Files\Application".
05/11/2001 13:46:16 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "Compatibility".
05/11/2001 13:46:16 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "Toolkit".
05/11/2001 13:46:16 EmulateCreateProcess 1 - [EmulateCreateProcess_ParseCommandLine] Illegal command line switch "2\demoapp\demoapp.exe".
05/11/2001 13:46:16 MapMemoryB0000 3 - [NotifyFn] Created block at 0xB0000.
05/11/2001 13:46:16 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:46:16 EmulateGetCommandLine 1 - [GetCommandLineA] Changed "C:\PROGRA~1\APPLIC~1\demoapp\demoapp.exe " to "C:\PROGRA~1\APPLIC~1\demoapp\demoapp.exe ".
05/11/2001 13:46:16 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:46:16 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:46:16 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:46:16 Win95VersionLie 3 - [GetVersion] Return Win95.
05/11/2001 13:46:16 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:46:16 EmulateGetCommandLine 1 - [GetModuleFileNameA] Changed "C:\Program Files\Application Compatibility Toolkit 2\demoapp\demoapp.exe" to "C:\PROGRA~1\APPLIC~1\demoapp\demoapp.exe".
05/11/2001 13:46:21 Win95VersionLie 3 - [GetVersionExA] Return Win95.
05/11/2001 13:46:27 IgnoreLoadLibrary 3 - APIHook_LoadLibraryA Allow(CVT32.DLL)
05/11/2001 13:46:32 EmulateGetDiskFreeSpace 3 - [GetDiskFreeSpaceA] Called. Returning <=2GB FREE SPACE
05/11/2001 13:46:33 EMULATEGETCOMMANDLINE 1 - [GETMODULEFILENAMEA] CHANGED "C:\Program Files\Application Compatibility Toolkit 2\demoapp\demoapp.exe" TO "C:\PROGRA~1\APPLIC~1\demoapp\demoapp.exe".
05/11/2001 13:46:33 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES
    C:\PROGRA~1

05/11/2001 13:46:33 CORRECTFILEPATHS 1 - CREATEDIRECTORYA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:46:33 CORRECTFILEPATHS 1 - CREATEDIRECTORYA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:46:33 CORRECTFILEPATHS 1 - COPYFILEA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT

05/11/2001 13:46:33 CORRECTFILEPATHS 1 - COPYFILEA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:46:34 CORRECTFILEPATHS 1 - COPYFILEA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP

05/11/2001 13:46:34 CORRECTFILEPATHS 1 - COPYFILEA CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMODLL.DLL
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMODLL.DLL

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\DESKTOP.INI

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - CREATEDIRECTORYA CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO

05/11/2001 13:46:38 CORRECTFILEPATHS 1 - WINEXEC CORRECTED PATH:
    EXPLORER.EXE C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO
    EXPLORER.EXE C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO

-------------------------------------------
 LOG  "C:\WINDOWS\explorer.exe"
-------------------------------------------
05/11/2001 13:46:38 EMULATECREATEPROCESS 1 - [EMULATECREATEPROCESS_PARSECOMMANDLINE] ILLEGAL COMMAND LINE SWITCH "C:\WINDOWS\explorer.exe".
05/11/2001 13:46:38 MAPMEMORYB0000 3 - [NOTIFYFN] CREATED BLOCK AT 0XB0000.
05/11/2001 13:46:38 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:46:38 EMULATEGETCOMMANDLINE 1 - [GETCOMMANDLINEA] CHANGED "explorer.exe C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Programs\Compatibility Demo" TO "C:\WINDOWS\explorer.exe C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Programs\Compatibility Demo".
05/11/2001 13:46:38 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:46:38 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:46:38 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:46:38 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYW ALLOW(COMCTL32.DLL)
05/11/2001 13:46:38 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:46:38 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYW ALLOW(COMCTL32.DLL)
05/11/2001 13:46:40 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYA ALLOW(CLBCATQ.DLL)
05/11/2001 13:46:40 WIN95VERSIONLIE 3 - [GETVERSIONEXA] RETURN WIN95.
05/11/2001 13:46:40 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYA ALLOW(CLBCATQ.DLL)
05/11/2001 13:46:40 IGNORELOADLIBRARY 3 - APIHOOK_LOADLIBRARYEXW ALLOW(SHELL32.DLL)
05/11/2001 13:46:40 CORRECTFILEPATHS 1 - COMHOOK_ISHELLLINKA_SETPATH CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESECTIONW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\DESKTOP
    C:\DOCUME~1\ALLUSE~1.WIN\DESKTOP

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\DESKTOP
    C:\DOCUME~1\ALLUSE~1.WIN\DESKTOP

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.TXT

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - COMHOOK_IPERSISTFILE_SAVE CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO README.LNK
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO README.LNK

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\DESKTOP.INI
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\WINDOWS\SYSTEM32
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\SYSTEM32

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\WINDOWS\SYSTEM32
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\SYSTEM32

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES
    C:\PROGRA~1

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:40 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:43 CORRECTFILEPATHS 1 - COMHOOK_ISHELLLINKA_SETPATH CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:46:43 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:43 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:43 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESECTIONW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - COMHOOK_IPERSISTFILE_SAVE CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO.LNK
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO.LNK

05/11/2001 13:46:44 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - COMHOOK_ISHELLLINKA_SETPATH CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESECTIONW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.HLP

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - COMHOOK_IPERSISTFILE_SAVE CORRECTED PATH:
    C:\DOCUMENTS AND SETTINGS\V-EVEGO.XP\START MENU\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO HELP.LNK
    C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\PROGRAMS\COMPATIBILITY DEMO\COMPATIBILITY DEMO HELP.LNK

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\WINDOWS\SYSTEM32
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\SYSTEM32

05/11/2001 13:46:47 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\WINDOWS\SYSTEM32
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\SYSTEM32

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - COMHOOK_ISHELLLINKA_SETPATH CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESTRINGW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO
    C:\PROGRA~1\COMPATIBILITY DEMO

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - GETFILEATTRIBUTESW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - GETPRIVATEPROFILESECTIONW CORRECTED PATH:
    C:\PROGRAM FILES\DESKTOP.INI
    C:\PROGRA~1\DESKTOP.INI

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - FINDFIRSTFILEEXW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - COMHOOK_IPERSISTFILE_SAVE CORRECTED PATH:
    C:\WINDOWS\DESKTOP\COMPATIBILITY DEMO.LNK
    C:\DOCUME~1\V-EVEGO.XP\WINDOWS\DESKTOP\COMPATIBILITY DEMO.LNK

05/11/2001 13:46:50 CORRECTFILEPATHS 1 - CREATEFILEW CORRECTED PATH:
    C:\PROGRAM FILES\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE
    C:\PROGRA~1\COMPATIBILITY DEMO\DEMOAPP\DEMOAPP.EXE

-------------------------------------------
 LOG  "C:\WINDOWS\notepad.exe"
-------------------------------------------

This time when you look through the output, you will see that the same seven fixes that were selected were applied: CorrectFilePaths, EmulateCreateProcess, EmulateGetCommandLine, EmulateGetDiskFreeSpace, IgnoreLoadLibrary, MapMemoryB0000, and Win95VersionLie. Deselect the HandleRegExpandSzRegistryKeys fix.

Now that you know what fixes demoapp.exe requires to run, use Compatadmin to add these fixes to a custom .sdb file that you can deploy to other computers in your organization. If you want to create a single fix .sdb file, Example 2: Create a Single Fix .sdb File.

Example 2: Create a Single Fix .sdb File

The following example uses QFixApp to create a single fix .sdb file to allow you to distribute the fixes for the demoapp.exe file that ships with the Application Compatibility Toolkit. See Example 1: Fix a Windows 95 Application to determine what fixes the demoapp.exe file requires. This example assumes that you have already followed the steps listed in that example.

With the demoapp.exe file and its associated fixes selected, you now need to ensure that the target file is uniquely identified on the target computer(s).

Click Advanced. The QFixApp dialog box expands to show the file attributes that can be used to identify the target file. Demoapp.exe has a number of file properties that you can select. Additionally, you can click Add matching file and choose files that must exist in the same or related directories to provide additional information to uniquely identify the target file. Between the file attributes and the ability to select matching files, you should always have enough information to uniquely identify a target file.

Note

  • You do not need to uniquely identify the target executable file in QFixApp unless you intend to distribute the .sdb file containing the single fix made by QFixApp. The Application Compatibility Team strongly encourages you to use QFixApp to identify what fixes must be applied to an application and to use Compatadmin to create and manage the .sdb files that you deploy to other users.

Inspect the properties that are exposed for demoapp.exe.

Click Add matching file and browse to the c:\program files \application compatibility toolkit \demoapp folder. Select demoapp.hlp and click OK.


SIDWalker Security Administration Tools
Overview | Notes | Syntax | Examples | Related Tools

This set of programs helps system administrators manage access-control policies on systems running Windows XP, Windows 2000, and Windows NT. The SIDWalker tools are designed to support a three-phase approach to modifying access control. Each phase of changing access control can take a day or longer to complete and verify, and requires significant amounts of system resources and administrator time. The phases are:

  • Planning. The administrator needs to determine what users have been granted access to resources (file shares, print shares, NTFS files, registry keys, and local group membership) on a particular computer.
  • Mapping Accounts. Based on who has access to what resources on the system, the administrator can chose to delete old, unused security identifiers (SIDs), or replace them with corresponding new SIDs, such as new security groups.
  • Converting ACLs. Using the information from the planning and mapping phases, the third phase is the conversion of security identifiers found anywhere on a system to corresponding new SIDs.

SIDWalker Components

ShowAccs

This command-line tool enables users to examine the access control lists (ACLs) on the registry, file system, and file and print shares, and to look at membership in local groups. ShowAccs command options support looking at specific areas of Windows 2000 and Windows XP (such as specific file-system directories) or examining the entire system.

The output file of ShowAccs is a comma-separated text file, called the access-profile file, that shows all the object-specific access rights on the system. The access-profile file can be reviewed and analyzed by using a text editor, or it can be imported into a spreadsheet or database management program.

ShowAccs also creates a mapping file that lists the security principals (users and groups) that show up somewhere in ACLs. The mapping file can be input to the Security Migration Editor Microsoft Management Console (MMC) snap-in for account mapping.

SIDWalk

This command-line tool takes a mapping file as input and scans all the access control lists in the registry, file system, file and print shares, and local group membership. SIDWalk uses the mapping information in the mapping file to either delete or replace every occurrence of an old security identifier (SID) with the corresponding new SID. The same mapping file can be used for SIDWalk conversion on multiple computers.

Security Migration Editor

The Security Migration Editor is a Microsoft Management Console (MMC) snap-in that provides a graphical user interface (GUI) for mapping old security identifiers (SIDs) listed in a mapping file created by ShowAccs to new security identifiers. The "migration" referred to is from old SIDs to corresponding new SIDs, which are mapped by selecting from the list of user and group accounts in target domains or computers. The snap-in also gives options to ignore or delete these SIDs as they show up in access-control lists (ACLs). The Security Migration Editor updates the mapping file, which is then used as input to SIDWalk.

Corresponding UI

There is no corresponding user interface for ShowAccs or SIDWalk. Security Migration Editor provides its own user interface.

Concepts

Access control is implemented by access control lists (ACLs). Every file in the NTFS file system and every registry key has a unique ACL, granting access rights to file resources to users and groups and defining what specific access rights each is granted. Each user and group is identified in the ACL by a security identifier (SID).

System Requirements

The SIDWalker tools have different system requirements.

ShowAccs Requirements

ShowAccs can be run as scheduled batch jobs. It must be run locally on the computer where the access permissions are to be changed. ShowAccs uses Windows NT security APIs (supported on Windows NT 4.0, Windows 2000, and Windows XP) to examine every access control list (ACL) on every object on the system. It is a CPU and I/O intensive program; plan to run it when system use is otherwise very light and expect significant resource use.

In Windows NT 4.0, ShowAccs requires Msvcrt50.dll, which is found in the \System32 directory of any Windows 2000 installation.

SIDWalk Requirements

SIDWalk can be run as scheduled batch jobs. It must be run locally on the computer where the access permissions are to be changed. SIDWalk uses Windows NT security APIs (supported on Windows NT 4.0, Windows 2000, and Windows XP) to examine every access control list (ACL) on every object on the system. It is a CPU and I/O intensive program; plan to run it when system use is otherwise very light and expect significant resource use.

Security Migration Editor Requirements

Security Migration Editor does not have to run on the same computer on which ShowAccs or SIDWalk runs. An administrator can schedule ShowAccs to run remotely on one server in the network, can transfer the resulting files to a local workstation for analysis and update using Security Migration Editor, and then can copy the mapping file back to one or more target systems and run SIDWalk on them.

Files Required

  • Sidwalk.exe
  • Sidwalk.msc
  • Showaccs.exe
  • Msvcrt50.dll (found in the \System32 directory)
  • Sidwkr.dll (the snap-in file for Security Migration Editor)


SIDWalker Notes
Overview | Notes | Syntax | Examples | Related Tools

Using ShowAccs

ShowAccs can examine the registry in approximately five minutes. Walking through the entire registry or file system, however, might require many hours, depending on the size of the file system and the scope of analysis. Examining every ACL on every file and converting security identifiers (SIDs) on a large file system of roughly 50 gigabytes (GB) can take two or more hours with 100 percent CPU utilization.

Installing Security Migration Editor

Before running the Security Migration Editor snap-in, it must be initialized from the command prompt with the command:

regsvr32 sidwkr.dll

This initializes the class libraries used by the snap-in.

Using Security Migration Editor

To use the snap-in, add it to the MMC. Security Migration Editor can also be started from the command prompt with the command:

sidwalk.msc

Further instructions on using snap-ins can be found in Help for the MMC.


SIDWalker Syntax
Overview | Notes | Syntax | Examples | Related Tools

ShowAccs Syntax

One Step showaccs AccessProfileFile [/f [Path]] [/r] [/s] [/p] [/g] [/m [MapFilePath]] [/nobuiltins] [/?]

Parameters

AccessProfileFile
Specifies the path of the .csv file to be generated.
/f [Path]
Shows access rights for all NTFS files or, optionally, for those in the directory tree of the specified path.
/r
Shows access rights for the registry.
/s
Shows access rights for file shares.
/p
Shows access rights for printer shares.
/g
Shows access rights for local groups.
/m [MapFilePath]
Generates a map file, optionally in the directory specified by MapFilePath.
/nobuiltins
Omits access rights for built-in groups.
/?
Displays help on Showaccs.

Remarks

  • When run without parameters, ShowAccs displays help.

SIDWalk Syntax

One Step sidwalk ProfileFile [ProfileFile …] [/t] [/f [Path]] [/r] [/s] [/p] [/g] [/l File] [/?]

Parameters

ProfileFile
Specifies the path and file name of one or more .csv mapping files to be used for input.
/t
Conducts a test/dry run.
/f [Path]
Scans all NTFS file system files or, optionally, only those on the directory tree of the specified path.
/r
Scans the registry.
/s
Scans file shares.
/p
Scans printer shares.
/g
Scans local groups.
/l File
Generates a Converter log file with File as the file name and path.
/?
Displays help on Sidwalk.

Remarks

  • When run without parameters, SIDWalk displays help.


SIDWalker Examples
Overview | Notes | Syntax | Examples | Related Tools

Access-control Policy Migration Scenario

The following example is a scenario requiring migration of access control policies:

All of the files for a project on a file server have an access control list (ACL) that grants the group ProjectTeam read/write access to the project files.

ProjectTeam is a security group that has a unique security identity in the Windows XP account directory. If the project changes and ProjectTeam merges into a larger project team, the administrator might want to change the access permissions on the project files. The read/write access-control rights granted to the original ProjectTeam can be replaced by access rights granted to a NewProjectTeam group. NewProjectTeam can be defined in a different domain and project file server. The computer on which the project file server runs can move from the current domain to a new domain for the larger project. In changing situations like this, SIDWalker can facilitate managing and updating security access policies on the servers involved.


DFSUtil.exe: Distributed File System Utility
Overview | Syntax | Examples | Related Tools Open Command Prompt

This tool enables administrators to query and troubleshoot the Microsoft Distributed File System (DFS) from the command prompt. It can be used to perform maintenance of a DFS root and to clean up metadata left behind by orphaning or abandoning domain-based DFS roots.

Note

  • You must run DFSUtil from the command window.

Corresponding UI

DFSUtil provides command-line functionality that parallels much of the Distributed File System Manager snap-in.

Concepts

Distributed File System, a feature of Windows 2000, makes it easier to access and manage files that are physically distributed across a network. With DFS, you can make files distributed across multiple servers appear to users as if they reside in one place on the network. Users and applications no longer need to know and specify the actual physical location of files in order to access them: DFS makes the physical storage of data transparent by mapping it to a logical representation.

DFS does for servers and shares what file systems do for hard disks. File systems provide uniform named access to collections of sectors on disks; DFS provides a uniform naming convention and mapping for collections of servers, shares, and files. Thus, DFS makes it possible to organize file servers and their shares into a logical hierarchy, making it considerably easier to manage and use extensive information resources. In addition, DFS is not limited to a single file protocol—it can support the mapping of servers, shares, and files, regardless of the file client being used, provided that the client supports the native server and share.

In the past, with the universal naming convention (UNC), a user or application was required to specify the physical server and share in order to access file information (that is, the user or application had to specify \\Server\Share\Path\FileName).

System Requirements

The following are the system requirements for DFSUtil:

  • Windows XP Professional or Windows 2000

Files Required

  • DFSUtil.exe


DFSUtil Syntax
Overview | Syntax | Examples | Related Tools Open Command Prompt

DFSUtil uses the following syntax:

One Step dfsutil [Parameters]

Parameters

Parameters that work on client or server

/view:\\ DfsName \ DfsShare [/dcname: DcName] [/export: FileName] [/level:{0|1}]
Views the metadata in \\ DfsName \ DfsShare. This parameter dumps the Active Directory-based Partition Knowledge Table (PKT), showing each directory in the DFS tree, the computers backing each directory, and their Active Directory site location. You can pipe the output with the |more command or send it to a text file for large DFS configurations. The DCName option is useful for "walking" a specific domain controller's view of the DFS configuration to check for inconsistencies in the DFS namespace due to latency in Active Directory replication.
/export: FileName
Exports the DFS metadata script to FileName.
/level:{0 | 1}
Specifies a level of viewing. A higher level shows more detail.
Example
/addroot: DomDfsName /server: ServerName /share: ShareName [/comment: Comment]
Creates a standalone or DomDfs root on ServerName at ShareName.
/remroot: DomDfsName /server: ServerName /share: ShareName
Removes a standalone or DomDfs root on ServerName at ShareName.
/import: FileName
Runs DFS metadata script from the file FileName.
/unmap:\\ DfsName \ DfsShare /root:\\ Server \ Share
Removes \\ Server \ Share from \\ DfsName \ DfsShare .
/scripthelp
Displays information on DFS metadata scripts at the command line.
/? or /help
Displays this syntax at the command line.

Parameters that work on client only

/pktinfo [/dfs] [/level:{0|1}]
Shows the parts of the DFS namespace cached by the client, the names of the servers participating in the DFS share, the clients’ randomization order of the participating servers, and the current "go to" server.
DFS servers store the DFS namespace and the servers backing up the namespace in a BLOB format in the registry (standalone DFS) or Active Directory (domain DFS). The DFS BLOB is formally known as the Partition Knowledge Table (PKT). DFS clients retrieve and cache each piece of the DFS namespace for a period of time determined by the server.
For Windows NT 4.0 DFS, DFS servers send the list of servers backing a piece of the DFS namespace in the same order. Clients randomize the list of servers to provide a degree of load balancing.
For Windows 2000 servers accessed by Windows 2000 DFS clients, the scrambling and site preference takes place on the server.
/dfs
Retrieves the data from Dfs.sys.
/level:{0|1}
Specifies a level of of detail to display. A higher level dumps more details.
Example
/pktflush
Flushes the local Partition Knowledge Table (PKT) cached by the client.
DFS clients cache the portions of the DFS namespace (PKT) for the duration of time specified in the Distributed File System Manager and referred to as the Time to Live (TTL). For DFS 4.1, the PKT was cached for a hard coded 7 days. Windows 2000 servers use 1800 seconds (30 minutes) as the default TTL. All Microsoft DFS clients delete the PKT for a given folder in the DFS tree if not accessed by the TTL expiration or when the client is rebooted, whichever occurs first.
Windows 2000-based computers support the DFS tab in Windows Explorer property sheet, which uses the NetDFSGetClientInfo() and NetDFSSetClientInfo() APIs to show the list of alternate paths residing in the volume, and which allows choosing another alternate (refresh PKT) without having to reboot or wait for TTL to expire.
Non-Windows 2000 DFS clients must reboot or wait for the TTL for a cached portion of the DFS tree to expire.
Example
/spcinfo [/all]
Dumps the SPC table.
/all
Dumps the SPC tables for all domains.
Example
/spcflush
Flushes the local SPC table.


DFSUtil Examples
Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Dfsutil /view

This example dumps the DFS configuration of the local computer for the fault-tolerant root "dfsft" in the a.com domain. Multiple servers back up the root and \apps shares (child nodes) in the \\a.com\dfsft DFS tree.

Type the following at the command prompt:

C:\UTILS>dfsutil /VIEW:\\NA-DC-01\dfsft

Output similar to the following displays:

Getting DomDfs metadata for DFSFT
Connecting to DC NA-DC-01.a.com
Volume information
Type is DomDfs
remoteServerName:[\\NA-DC-01\dfsft][\\NA-DC-01\dfsft][*]

\\A\dfsft    [(null)]
    \\NA-DC-01\dfsft
    \\ NA-DC-02\dfsft

\\A\dfsft\apps    [(null)]
    \\ NA-DC-01\apps
    \\ NA-DC-02\apps

Site information:
NA-DC-01
    Default-First-Site-Name
NA-DC-02
    Default-First-Site-Name

DFSUTIL completed successfully.

Example 2: Dfsutil /spcinfo

To display the information contained within the SPC table, type the following at the command prompt:

C:\UTILS>DFSUTIL /SPCINFO

Output similar to the following displays:

NtStatus=0x0, status=0x0
[*][SERVER5.a.com]
[*][A]
[*][a.com]
NtStatus=0x0, status=0x0
[+][A]
        [+SERVER3]
        [-SERVER4]
        [-SERVER2]
        [-SERVER6]
        [-SERVER5]
[+][a.com]
        [+SERVER5.a.com]
        [-SERVER3.a.com]
        [-SERVER4.a.com]
        [-SERVER6.a.com]
        [-SERVER2.a.com]

Example 3: Dfsutil /pktinfo

To show the client cache of the DFS namespace, type the following at the command prompt:

C:\UTILS>dfsutil /pktinfo

Output similar to the following displays:

--mup.sys--
3 entries...
Entry: \distfolders\release
ShortEntry: \distfolders\release
Expires in 0 seconds
UseCount: 7 Type:0x81 ( REFERRAL_SVC DFS )
   0:[\DISTFOLDERS\release][0x1]

Entry: \A\dfsft
ShortEntry: \A\dfsft
Expires in 0 seconds
UseCount: 0 Type:0x81 ( REFERRAL_SVC DFS )
   0:[\NA-DC-01\dfsft][0x0]
   1:[\NA-DC-01\dfsft][0x1]

Entry: \a.com\sysvol
ShortEntry: \a.com\sysvol
Expires in 0 seconds
UseCount: 0 Type:0x81 ( REFERRAL_SVC DFS )
   0:[\NA-DC-01.a.com\sysvol][0x0]
   1:[\NA-DC-01.a.com\sysvol][0x1]

DFSUTIL completed successfully.

Example 4: Dfsutil /pktflush

The example below:

  1. Displays the existing Partition Knowledge Table (PKT) for \\Distfolders\Release\Namer\Bnum\Vers by using the /pktinfo parameter.
  2. Flushes all client PKTs by using DFSFLUSHPKT ("EntryPath=[*]").
  3. Shows the empty PKT on the client by using the /pktinfo parameter.

To display the existing PKT, type the following at the command prompt:

C:\UTILS>dfsutil /pktinfo

Output similar the following displays:

--mup.sys--
NtStatus=0x0, status=0x0
2 entries...
Entry: \distfolders\release
ShortEntry: \distfolders\release
   0:[\DISTFOLDERS\release][0x1]

Entry: \distfolders\release\namer\bnum\vers
ShortEntry: \distfolders\release\namer\bnum\vers
   0:[\servxx1\namer.bnum.vers][0x1]
   1:[\ntold2\namer.bnum.vers][0x0]
   2:[\servxx3\namer.bnum.vers][0x0]
   3:[\servxx4\namer.bnum.vers][0x0]
   4:[\servxx2\namer.bnum.vers][0x0]

Now to flush the PKT cache, type the following at the command prompt:

C:\UTILS>dfsutil /pktflush

Output similar the following displays:

EntryPath=[*]

To redisplay the existing PKT, type the following at the command prompt:

C:\UTILS>dfsutil /pktinfo

Output similar the following displays:

--mup.sys--
NtStatus=0x0, status=0x0
0 entries...


Diruse.exe: Directory Disk Usage
Overview | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool displays directory size information, including compression information for NTFS volumes. You can use DirUse to determine the actual usage of space for compressed files and directories.

You can also specify a maximum folder size. DirUse then marks any folders that exceed the specified limit and, if you choose, alerts you to the problem.

If you run DirUse while logged on as a member of the Administrators group, you can check the use of disk space in directories even if you do not have access rights to those directories.

Note

  • DirUse is similar to du used in UNIX.

Corresponding UI

You can use Windows Explorer to determine the size of the first level of directories on a drive, but not to determine the overall size of directories and their subdirectories.

There is no other corresponding user interface for DirUse.

Concepts

For more information on NTFS, see NTFS: Getting Started in the Help and Support Center.

System Requirements

The following are the system requirements for DirUse:

  • Windows XP Professional

File required

  • Diruse.exe


DirUse Syntax
Overview | Syntax | Examples | Related Tools Open Command Prompt

DirUse uses the following syntax:

One Step diruse {/s|/v} {/m|/k|/b} [/c] [/,] [/q: Size [/l] [/a] [/d] [/o]] [/*] [DirList] [/?|/h|/help]

Parameters

/s
Includes subdirectories of the specified directories in the output.
/v
Writes progress reports while scanning subdirectories. The /v parameter is ignored if /s is specified.
/m
Displays disk usage in megabytes.
/k
Displays disk usage in kilobytes.
/b
Displays disk usage in bytes (default).
/c
Uses compressed file size instead of apparent file size.

See Example 2: Determine Compressed File and Folder Sizes.

/,
Displays the thousands separator (comma or period) in file sizes.
/q: Size
Marks directories that exceed the specified size with an exclamation point (!). If /m (megabytes) or /k (kilobytes) are not specified, the size is assumed to be in bytes. If /q is specified and any directory is found that exceeds the specified size, the return code is ONE. Otherwise the return code is ZERO.
/l
Writes overflows to the log file Diruse.log in the current directory.
/a
Specifies that an alert is generated if sizes specified by the /q: parameter are exceeded. The Alerter service must be running, and the alert appears only when you are using DirUse.
/d
Displays only directories that exceed specified sizes.
/o
Specifies that subdirectories are not checked to see if they exceed the specified size.
/*
Uses the top-level directories residing in the directories specified in DirList.
DirList
Specifies a list of directories to check. DirList is required if you are doing anything other than getting command-line usage. Use semicolons, commas, or spaces to separate multiple directories.

See Example 1: List Current File Usage for a Shared Volume for examples where DirList is a folder on a network volume and where DirList contains a list of folders.

/?|/h|/help
Displays command-line usage.

Note

  • When run without parameters, DirUse displays command-line usage.


DirUse Examples
Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: List Current File Usage for a Shared Volume

In your company, users store their files on a shared volume called \\shared. The \\shared\data folder is broken down into folders for each department. Each department folder is broken down into folders for users from that department as well as one or more folders that are shared by all users in that department. The \\shared\data folder also has one folder — \\shared\data\common — that is used to share information between departments.

You have been asked to generate a report that shows the current usage for the network volume where users in your company store their data. This report must show the usage by department and list any individual user who has more than 50 MB of data on the volume. To generate the data for the first part of your report, type the following at the command line:

diruse /* /m \\shared\data > c:\deptdata.txt

This generates a list of usage in megabytes of the top-level folders contained in the \\shared\data folder. The output is sent to the Deptdata.txt file on your C drive.

Looking at Deptdata.txt, you see the following output:

    Size (mb)  Files  Directory
       248.60   3739  SUB-TOTAL: \\SHARED\DATA\Admin
        31.27     36  SUB-TOTAL: \\SHARED\DATA\Common
      1448.14  23654  SUB-TOTAL: \\SHARED\DATA\ConsultServ
       107.64    750  SUB-TOTAL: \\SHARED\DATA\CorpServ
      1053.28   6145  SUB-TOTAL: \\SHARED\DATA\Design
       147.11    258  SUB-TOTAL: \\SHARED\DATA\Engrg
        70.56    745  SUB-TOTAL: \\SHARED\DATA\Finance
        18.78   1188  SUB-TOTAL: \\SHARED\DATA\Hardware
        12.18     50  SUB-TOTAL: \\SHARED\DATA\HR
         2.22     23  SUB-TOTAL: \\SHARED\DATA\InfoTech
         5.44     46  SUB-TOTAL: \\SHARED\DATA\Legal
        18.53     56  SUB-TOTAL: \\SHARED\DATA\ProdDev
       470.43   2016  SUB-TOTAL: \\SHARED\DATA\ProdMktg
       107.92   1445  SUB-TOTAL: \\SHARED\DATA\Research
        31.10     43  SUB-TOTAL: \\SHARED\DATA\Sales
         9.98     14  SUB-TOTAL: \\SHARED\DATA\TechSupp
       114.82   1269  SUB-TOTAL: \\SHARED\DATA\Training
      3898.00  41477  TOTAL

You can see in this output that only the Admin, ConsultServ, CorpServ, Design, Engrg, Finance, ProdMktg, Research, and Training departments have more than 50 MB of data each. To see what users have more than 50 MB of data stored on \\shared\data, type the following at the command line:

diruse /* /m /q:50 /d \\shared\data\admin, \\shared\data\consultserv, \\shared\data\corpserv, \\shared\data\design, \\shared\data\engrg, \\shared\data\finance, \\shared\data\prodmktg, \\shared\data\research, \\shared\data\training > c:\userdata.txt

This generates a list of the all top-level folders contained in any of the listed folders that use more than 50 MB of disk space. The output is sent to the Userdata.txt file on your C drive.

Looking at Userdata.txt, you see the following output:

Searching for directories that have exceeded 50 megabytes
    Size (mb)  Files  Directory
!       68.30    697  SUB-TOTAL: \\SHARED\DATA\Finance\Jack
        70.55    744  TOTAL

You can see in this output that only one user, Jack, is marked as using more than 50 MB of data.

Example 2: Determine Compressed File and Folder Sizes

You want to compare the actual size of folders containing compressed files and the apparent uncompressed size in your Windows folders. To generate a list of top-level folders contained in the Windows folder with their associated compressed sizes, type the following at the command line:

diruse /c /* /m c:\Windows > c:\data\compressed.txt

The Compressed.txt file in the C:\Data folder contains the output from the command-line statement. The file contains the following output:

    Size (mb)  Files  Directory
         0.00      0  SUB-TOTAL: C:\WINDOWS\addins
         0.19     64  SUB-TOTAL: C:\WINDOWS\Application Compatibility Scripts
         1.56      7  SUB-TOTAL: C:\WINDOWS\AppPatch
         2.52     16  SUB-TOTAL: C:\WINDOWS\Cluster
         0.00      0  SUB-TOTAL: C:\WINDOWS\Config
         0.00      0  SUB-TOTAL: C:\WINDOWS\Connection Wizard
         0.29    184  SUB-TOTAL: C:\WINDOWS\Cursors
         0.03      5  SUB-TOTAL: C:\WINDOWS\Debug
         0.00      3  SUB-TOTAL: C:\WINDOWS\Downloaded Program Files
        86.94      1  SUB-TOTAL: C:\WINDOWS\Driver Cache
        12.04    177  SUB-TOTAL: C:\WINDOWS\Fonts
        40.71   1536  SUB-TOTAL: C:\WINDOWS\Help
         0.00      0  SUB-TOTAL: C:\WINDOWS\IIS Temporary Compressed Files
         0.60      3  SUB-TOTAL: C:\WINDOWS\ime
         0.00      0  SUB-TOTAL: C:\WINDOWS\ime (x86)
        41.86   1323  SUB-TOTAL: C:\WINDOWS\inf
         1.71     29  SUB-TOTAL: C:\WINDOWS\Installer
        10.96     35  SUB-TOTAL: C:\WINDOWS\java
         2.43     40  SUB-TOTAL: C:\WINDOWS\Media
        29.36    137  SUB-TOTAL: C:\WINDOWS\Microsoft.NET
         3.13     30  SUB-TOTAL: C:\WINDOWS\msagent
         0.00      0  SUB-TOTAL: C:\WINDOWS\msapps
         0.00      0  SUB-TOTAL: C:\WINDOWS\mui
         0.00      1  SUB-TOTAL: C:\WINDOWS\Offline Web Pages
        11.75    801  SUB-TOTAL: C:\WINDOWS\PCHEALTH
         1.07      5  SUB-TOTAL: C:\WINDOWS\Registration
        11.62     10  SUB-TOTAL: C:\WINDOWS\repair
         0.00      1  SUB-TOTAL: C:\WINDOWS\Resource Pro Kit
         2.01      4  SUB-TOTAL: C:\WINDOWS\Resources
         9.48     17  SUB-TOTAL: C:\WINDOWS\security
         0.87     25  SUB-TOTAL: C:\WINDOWS\system
       677.42   5524  SUB-TOTAL: C:\WINDOWS\system32
         0.00      1  SUB-TOTAL: C:\WINDOWS\TAPI
         0.00      3  SUB-TOTAL: C:\WINDOWS\Tasks
         0.02      1  SUB-TOTAL: C:\WINDOWS\Temp
         0.00      1  SUB-TOTAL: C:\WINDOWS\twain_32
         2.44     90  SUB-TOTAL: C:\WINDOWS\Web
         5.03     16  SUB-TOTAL: C:\WINDOWS\WinSxS
       956.01  10090  TOTAL

To generate a list of top-level folders contained in the Windows folder with their apparent sizes, type the following at the command line:

diruse /* /m c:\Windows > c:\data\uncompressed.txt

The Uncompressed.txt file in the C:\Data folder contains the output from the command-line statement. The file contains the following output:

    Size (mb)  Files  Directory
         0.00      0  SUB-TOTAL: C:\WINDOWS\addins
         0.19     64  SUB-TOTAL: C:\WINDOWS\Application Compatibility Scripts
         1.56      7  SUB-TOTAL: C:\WINDOWS\AppPatch
         2.52     16  SUB-TOTAL: C:\WINDOWS\Cluster
         0.00      0  SUB-TOTAL: C:\WINDOWS\Config
         0.00      0  SUB-TOTAL: C:\WINDOWS\Connection Wizard
         0.29    184  SUB-TOTAL: C:\WINDOWS\Cursors
         0.03      5  SUB-TOTAL: C:\WINDOWS\Debug
         0.00      3  SUB-TOTAL: C:\WINDOWS\Downloaded Program Files
        86.94      1  SUB-TOTAL: C:\WINDOWS\Driver Cache
        12.04    177  SUB-TOTAL: C:\WINDOWS\Fonts
        40.71   1536  SUB-TOTAL: C:\WINDOWS\Help
         0.00      0  SUB-TOTAL: C:\WINDOWS\IIS Temporary Compressed Files
         0.60      3  SUB-TOTAL: C:\WINDOWS\ime
         0.00      0  SUB-TOTAL: C:\WINDOWS\ime (x86)
        41.86   1323  SUB-TOTAL: C:\WINDOWS\inf
         1.71     29  SUB-TOTAL: C:\WINDOWS\Installer
        10.96     35  SUB-TOTAL: C:\WINDOWS\java
         2.43     40  SUB-TOTAL: C:\WINDOWS\Media
        29.36    137  SUB-TOTAL: C:\WINDOWS\Microsoft.NET
         3.13     30  SUB-TOTAL: C:\WINDOWS\msagent
         0.00      0  SUB-TOTAL: C:\WINDOWS\msapps
         0.00      0  SUB-TOTAL: C:\WINDOWS\mui
         0.00      1  SUB-TOTAL: C:\WINDOWS\Offline Web Pages
        11.75    801  SUB-TOTAL: C:\WINDOWS\PCHEALTH
         1.07      5  SUB-TOTAL: C:\WINDOWS\Registration
        11.62     10  SUB-TOTAL: C:\WINDOWS\repair
         0.00      1  SUB-TOTAL: C:\WINDOWS\Resource Pro Kit
         2.01      4  SUB-TOTAL: C:\WINDOWS\Resources
         9.48     17  SUB-TOTAL: C:\WINDOWS\security
         0.87     25  SUB-TOTAL: C:\WINDOWS\system
       811.63   5524  SUB-TOTAL: C:\WINDOWS\system32
         0.00      1  SUB-TOTAL: C:\WINDOWS\TAPI
         0.00      3  SUB-TOTAL: C:\WINDOWS\Tasks
         0.02      1  SUB-TOTAL: C:\WINDOWS\Temp
         0.00      1  SUB-TOTAL: C:\WINDOWS\twain_32
         2.44     90  SUB-TOTAL: C:\WINDOWS\Web
         5.03     16  SUB-TOTAL: C:\WINDOWS\WinSxS
      1090.21  10090  TOTAL

When you compare the output, you see that the only folder that contains compressed files is C:\Windows\System32.

Example 3: Use DirUse in a Batch File

You want to gather directory and subdirectory information on drive X. You use a batch file so that the data generated by DirUse can be manipulated in Microsoft Excel. The sample batch file contains the following lines of code:

X:
cd\
diruse /s x:\ > drvdata.txt
c:
"\program files\microsoft office\office\excel.exe" x:\drvdata.txt

The /s parameter specifies that you want information about all subdirectories on drive X. The redirect symbol (>) redirects the output to a file called Drvdata.txt.

After DirUse writes the directory information to the text file, the batch file switches back to drive C and starts Microsoft Excel. The command-line argument of the file name causes Microsoft Excel to open Drvdata.txt when the application starts. If you plan to use the batch file frequently, you can create an Excel macro to sort, delete, or format the data.

To use this batch file, save the sample code in a file called Drvdata.bat and type the following at the command line:

drvdata


Dmdiag.exe: Disk Manager Diagnostics
Overview | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool displays system state and configuration information describing disk storage.

DmDiag displays the following information for the computer on which it is run:

  • Computer name and operating system version
  • Physical disk to disk type
  • Mount points
  • LDM file versions
  • Drive letter usage, GetLogicalDrives(), GetDriveType()
  • \Device
  • Symbolic links
  • ldmsize
  • Kernel list
  • Disk partition information

Corresponding UI

There is no corresponding user interface for DmDiag.

Concepts

For more information, see Disk Management in the Help and Support Center.

System Requirements

The following are the system requirements for DmDiag:

  • Windows XP Professional

File required

  • Dmdiag.exe


DmDiag Syntax
Overview | Syntax | Examples | Related Tools Open Command Prompt

DmDiag uses the following syntax:

One Step dmdiag [/v] [/f FileName]

Parameters

/v
Outputs verbose information. Verbose output includes the following fields: Computer Name and OS Version, LDM File Versions, Mount Points, Drive Letter Usage, Drive Type, Dynamic Disk Information, LDM Volume Information, Device objects, DMIO Kernel List, LDM Disk Header HarddiskX, LDM Disk Config HarddiskX, LDM Disk KLOG HarddiskX, DMAdmin Simple Query, and DMAdmin Verbose Query.
/f FileName
Specifies the filename for the output file. If omitted, the filename defaults to dmdiag.txt

Notes

  • By default, DmDiag output includes the following:
    Field | Description
    Dynamic Disk Information | Displays the disk group name and ID as well as the list of dynamic disks belonging to the group. For each disk the disk extents and the volumes to which these extents belong are displayed.
    LDM Volume Information | Displays the list of dynamic volumes. For each volume the disk extents are displayed.


DmDiag Examples
Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Write Disk Configuration to File

If you want to write disk configuration information to a file named Diskconf.txt, type the following at the command line:

dmdiag > c:\data\diskconf.txt

Example 2: Display Disk Configuration

If you want to display disk configuration information in the command window, type the following at the command line:

dmdiag

You will see information similar to the following output displayed in the command window:

---------- Computer name and OS version ----------

  Computer name: IMACOMPUTER
       NT build: 2154

---------- Drive letter to device name, QueryDosDevice() ----------

              D: \Device\HarddiskVolume2
              E: \Device\HarddiskVolume3
              F: \Device\CdRom0
              G: \Device\HarddiskVolume4
              A: \Device\Floppy0
              C: \Device\HarddiskVolume1

---------- Physical Disk to disk type ----------

  PhysicalDrive0 \Device\Harddisk0\DR0 (Signature 3137382d) Basic Disk

---------- Mount Points ----------

    \\?\Volume{927d670b-69d2-11d2-805b-000000000000}\
        C:\

    \\?\Volume{927d670c-69d2-11d2-805b-000000000000}\
        D:\

    \\?\Volume{927d670d-69d2-11d2-805b-000000000000}\
        E:\

    \\?\Volume{8bb65abe-566f-11d3-80f0-806d6172696f}\
        G:\

    \\?\Volume{54c0c117-dd07-11d2-9795-806d6172696f}\
        F:\

    \\?\Volume{54c0c116-dd07-11d2-9795-806d6172696f}\
        A:\

---------- LDM File Versions ----------

              2152.1.290.1 shp - G:\WINNT\System32\dmadmin.exe
              2152.1.290.1 shp - G:\WINNT\System32\dmconfig.dll
              2152.1.290.1 shp - G:\WINNT\System32\dmdlgs.dll
              2152.1.290.1 shp - G:\WINNT\System32\dmdskmgr.dll
              2152.1.290.1 shp - G:\WINNT\System32\dmdskres.dll
              2152.1.290.1 shp - G:\WINNT\System32\dmintf.dll
              2152.1.290.1 shp - G:\WINNT\System32\dmremote.exe
              2152.1.290.1 shp - G:\WINNT\System32\dmserver.dll
              2152.1.290.1 shp - G:\WINNT\System32\dmutil.dll
              2152.1.290.1 shp - G:\WINNT\System32\dmview.ocx
              2152.1.290.1 shp - G:\WINNT\System32\drivers\dmboot.sys
              2152.1.290.1 shp - G:\WINNT\System32\drivers\dmio.sys
              2152.1.290.1 shp - G:\WINNT\System32\drivers\dmload.sys

---------- Drive letter usage, GetLogicalDrives(), GetDriveType() ----------

              A: Removable disk
              C: Fixed disk
              D: Fixed disk
              E: Fixed disk
              F: CD-ROM
              G: Fixed disk

---------- dosdev ----------

A: = \Device\Floppy0 [Removable]
C: = \Device\HarddiskVolume1 [Fixed]
D: = \Device\HarddiskVolume2 [Fixed]
E: = \Device\HarddiskVolume3 [Fixed]
F: = \Device\CdRom0 [CDRom]
G: = \Device\HarddiskVolume4 [Fixed]

---------- \Device\Harddisk0 ----------

\Device\Harddisk0\DP(1)0x7e00-0x7ff50c00+1 (Device)
\Device\Harddisk0\DP(2)0x7ff60800-0x7ff50c00+2 (Device)
\Device\Harddisk0\DP(3)0xffeb9200-0x7ff50c00+3 (Device)
\Device\Harddisk0\DP(4)0x17fe11c00-0x75a96200+4 (Device)
\Device\Harddisk0\DR0            (Device)
\Device\Harddisk0\Partition0     (SymbolicLink) -> \Device\Harddisk0\DR0
\Device\Harddisk0\Partition1     (SymbolicLink) -> \Device\HarddiskVolume1
\Device\Harddisk0\Partition2     (SymbolicLink) -> \Device\HarddiskVolume2
\Device\Harddisk0\Partition3     (SymbolicLink) -> \Device\HarddiskVolume3
\Device\Harddisk0\Partition4     (SymbolicLink) -> \Device\HarddiskVolume4

---------- \Device ----------

\Device\00000001                 (Device)
\Device\00000002                 (Device)
\Device\00000003                 (Device)
\Device\00011f                   (Device)
\Device\00021f                   (Device)
\Device\00031f                   (Device)
\Device\00041f                   (Device)
\Device\000520                   (Device)
\Device\000620                   (Device)
\Device\000720                   (Device)
\Device\000821                   (Device)
\Device\000922                   (Device)
\Device\001022                   (Device)
\Device\001122                   (Device)
\Device\001223                   (Device)
\Device\001323                   (Device)
\Device\001423                   (Device)
\Device\001523                   (Device)
\Device\001624                   (Device)
\Device\001724                   (Device)
\Device\001825                   (Device)
\Device\001925                   (Device)
\Device\002025                   (Device)
\Device\002125                   (Device)
\Device\002227                   (Device)
\Device\002327                   (Device)
\Device\002427                   (Device)
\Device\002527                   (Device)
\Device\002628                   (Device)
\Device\002728                   (Device)
\Device\002828                   (Device)
\Device\002928                   (Device)
\Device\003029                   (Device)
\Device\003129                   (Device)
\Device\003229                   (Device)
\Device\003329                   (Device)
\Device\003429                   (Device)
\Device\003529                   (Device)
\Device\003629                   (Device)
\Device\00372a                   (Device)
\Device\00382a                   (Device)
\Device\00392a                   (Device)
\Device\00402a                   (Device)
\Device\004132                   (Device)
\Device\004233                   (Device)
\Device\004333                   (Device)
\Device\004433                   (Device)
\Device\004533                   (Device)
\Device\004633                   (Device)
\Device\004733                   (Device)
\Device\004833                   (Device)
\Device\004933                   (Device)
\Device\005034                   (Device)
\Device\005134                   (Device)
\Device\005234                   (Device)
\Device\005334                   (Device)
\Device\005434                   (Device)
\Device\005534                   (Device)
\Device\Afd                      (Device)
\Device\Beep                     (Device)
\Device\CdRom0                   (Device)
\Device\ChangeEventCdRom0        (Event)
\Device\DmControl                (Directory)
\Device\DmLoader                 (Device)
\Device\Floppy0                  (Device)
\Device\FloppyPDO0               (Device)
\Device\FsWrap                   (Device)
\Device\FtControl                (Device)
\Device\Gpc                      (Device)
\Device\Hal Pci 0                (Device)
\Device\Harddisk0                (Directory)
\Device\HarddiskDmVolumes        (Directory)
\Device\HarddiskVolume1          (Device)
\Device\HarddiskVolume2          (Device)
\Device\HarddiskVolume3          (Device)
\Device\HarddiskVolume4          (Device)
\Device\HCD0                     (Device)
\Device\Ide                      (Directory)
\Device\INO_Fltr                 (Device)
\Device\Ip                       (Device)
\Device\IPMULTICAST              (Device)
\Device\IPSEC                    (Device)
\Device\ISAPNP_CSC6835_DEV0000_FFFFFFFF (Device)
\Device\ISAPNP_CSC6835_DEV0001_FFFFFFFF (Device)
\Device\ISAPNP_CSC6835_DEV0002_FFFFFFFF (Device)
\Device\KeyboardClass0           (Device)
\Device\KsecDD                   (Device)
\Device\KSENUM#00000001          (Device)
\Device\KSENUM#00000002          (Device)
\Device\KSENUM#0000004d          (Device)
\Device\LanmanDatagramReceiver   (Device)
\Device\LanmanRedirector         (Device)
\Device\LanmanServer             (Device)
\Device\Mailslot                 (Device)
\Device\MountPointManager        (Device)
\Device\Mup                      (Device)
\Device\NamedPipe                (Device)
\Device\Ndis                     (Device)
\Device\NdisTapi                 (Device)
\Device\NdisWan                  (Device)
\Device\NdisWanIp                (Device)
\Device\NDProxy                  (Device)
\Device\Netbios                  (Device)
\Device\NetbiosSmb               (Device)
\Device\NetBT_Tcpip_{8DF1FF1F-FBC8-4ABB-B154-26D835858B69} (Device)
\Device\NetBt_Wins_Export        (Device)
\Device\NTPNP_PCI0000            (Device)
\Device\NTPNP_PCI0001            (Device)
\Device\NTPNP_PCI0002            (Device)
\Device\NTPNP_PCI0003            (Device)
\Device\NTPNP_PCI0004            (Device)
\Device\NTPNP_PCI0005            (Device)
\Device\NTPNP_PCI0006            (Device)
\Device\NTPNP_PCI0007            (Device)
\Device\NTPNP_PCI0008            (Device)
\Device\NTPNP_PCI0009            (Device)
\Device\Null                     (Device)
\Device\Parallel0                (Device)
\Device\ParallelPort0            (Device)
\Device\ParallelVdm0             (Device)
\Device\ParTechInc0              (Device)
\Device\ParTechInc1              (Device)
\Device\ParTechInc2              (Device)
\Device\PhysicalMemory           (Section)
\Device\PointerClass0            (Device)
\Device\Processor                (Device)
\Device\RasAcd                   (Device)
\Device\RawCdRom                 (Device)
\Device\RawDisk                  (Device)
\Device\RawIp                    (Device)
\Device\RawTape                  (Device)
\Device\ReadDataPort_0           (Device)
\Device\Scsi                     (Directory)
\Device\ScsiPort0                (SymbolicLink) -> \Device\Scsi\aic78xx1
\Device\ScsiPort1                (SymbolicLink) -> \Device\Scsi\aic78u21
\Device\Serial0                  (Device)
\Device\Serial1                  (Device)
\Device\Spud                     (Device)
\Device\sysaudio                 (Device)
\Device\Tcp                      (Device)
\Device\Udp                      (Device)
\Device\USBPDO-0                 (Device)
\Device\Video0                   (Device)
\Device\Video1                   (Device)
\Device\Video2                   (Device)
\Device\VideoPdo0                (Device)
\Device\VolumesSafeForWriteAccess (Event)
\Device\WANARP                   (Device)
\Device\WinDfs                   (Directory)
\Device\WMIDataDevice            (Device)
\Device\WMIServiceDevice         (Device)
\Device\{5AAF27E9-C446-42DF-B037-8EA58A8DE51E} (Device)
\Device\{8DF1FF1F-FBC8-4ABB-B154-26D835858B69} (Device)
\Device\{D5537CCD-EB42-4633-A85F-EFF0B9DA57EC} (Device)
\Device\{E55B60D6-4FB8-44F5-806F-EE3E593D0B63} (Device)

---------- \?? ----------

\??\$VDMLPT1                     (SymbolicLink) -> \Device\ParallelVdm0
\??\A:                           (SymbolicLink) -> \Device\Floppy0
\??\AUX                          (SymbolicLink) -> \DosDevices\COM1
\??\C:                           (SymbolicLink) -> \Device\HarddiskVolume1
\??\CdRom0                       (SymbolicLink) -> \Device\CdRom0
\??\COM1                         (SymbolicLink) -> \Device\Serial0
\??\COM2                         (SymbolicLink) -> \Device\Serial1
\??\D:                           (SymbolicLink) -> \Device\HarddiskVolume2
\??\DISPLAY1                     (SymbolicLink) -> \Device\Video0
\??\DISPLAY2                     (SymbolicLink) -> \Device\Video1
\??\DISPLAY3                     (SymbolicLink) -> \Device\Video2
\??\DmConfig                     (SymbolicLink) -> \Device\DmControl\DmConfig
\??\DmInfo                       (SymbolicLink) -> \Device\DmControl\DmInfo
\??\DmIoDaemon                   (SymbolicLink) -> \Device\DmControl\DmIoDaemon
\??\DmLoader                     (SymbolicLink) -> \Device\DmLoader
\??\DmTrace                      (SymbolicLink) -> \Device\DmControl\DmTrace
\??\E:                           (SymbolicLink) -> \Device\HarddiskVolume3
\??\F:                           (SymbolicLink) -> \Device\CdRom0
\??\FDC#GENERIC_FLOPPY_DRIVE#1&3a2146f1&0&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\FloppyPDO0
\??\fsWrap                       (SymbolicLink) -> \Device\FsWrap
\??\FtControl                    (SymbolicLink) -> \Device\FtControl
\??\G:                           (SymbolicLink) -> \Device\HarddiskVolume4
\??\Global                       (SymbolicLink) -> \??
\??\GLOBALROOT                   (SymbolicLink) ->
\??\HCD0                         (SymbolicLink) -> \Device\HCD0
\??\INO-FILTER                   (SymbolicLink) -> \Device\INO_Fltr
\??\INOFL-FILTER                 (SymbolicLink) -> \FileSystem\INO_FLPYFs
\??\Ip                           (SymbolicLink) -> \Device\Ip
\??\IPMULTICAST                  (SymbolicLink) -> \Device\IPMULTICAST
\??\IPSECDev                     (SymbolicLink) -> \Device\IPSEC
\??\ISAPNP#CSC6835_DEV0000#FFFFFFFF#{65e8773d-8f56-11d0-a3b9-00a0c9223196} (SymbolicLink) -> \Device\ISAPNP_CSC6835_DEV0000_FFFFFFFF
\??\ISAPNP#CSC6835_DEV0000#FFFFFFFF#{65e8773e-8f56-11d0-a3b9-00a0c9223196} (SymbolicLink) -> \Device\ISAPNP_CSC6835_DEV0000_FFFFFFFF
\??\ISAPNP#CSC6835_DEV0000#FFFFFFFF#{6994ad04-93ef-11d0-a3cc-00a0c9223196} (SymbolicLink) -> \Device\ISAPNP_CSC6835_DEV0000_FFFFFFFF
\??\ISAPNP#CSC6835_DEV0000#FFFFFFFF#{dda54a40-1e4c-11d1-a050-405705c10000} (SymbolicLink) -> \Device\ISAPNP_CSC6835_DEV0000_FFFFFFFF
\??\LPT1                         (SymbolicLink) -> \Device\Parallel0
\??\MAILSLOT                     (SymbolicLink) -> \Device\MailSlot
\??\MountPointManager            (SymbolicLink) -> \Device\MountPointManager
\??\NDIS                         (SymbolicLink) -> \Device\Ndis
\??\NDISTAPI                     (SymbolicLink) -> \Device\NdisTapi
\??\NdisWan                      (SymbolicLink) -> \Device\NdisWan
\??\NDISWANIP                    (SymbolicLink) -> \Device\NdisWanIp
\??\NDPROXY                      (SymbolicLink) -> \Device\NDProxy
\??\NUL                          (SymbolicLink) -> \Device\Null
\??\PCI#VEN_10B7&DEV_9055&SUBSYS_00801028&REV_00#2&ebb567f&0&88#{ad498944-762f-11d0-8dcb-00c04fc3358c} (SymbolicLink) -> \Device\NTPNP_PCI0005
\??\PCI#VEN_9004&DEV_8078&SUBSYS_78809004&REV_01#3&c4cf9f2&0&7098#{2accfe60-c130-11d2-b082-00a0c91efb8b} (SymbolicLink) -> \Device\NTPNP_PCI0009
\??\PCI#VEN_9005&DEV_001F&SUBSYS_00801028&REV_00#3&c4cf9f2&0&5098#{2accfe60-c130-11d2-b082-00a0c91efb8b} (SymbolicLink) -> \Device\NTPNP_PCI0008
\??\PhysicalDrive0               (SymbolicLink) -> \Device\Harddisk0\DR0
\??\PIPE                         (SymbolicLink) -> \Device\NamedPipe
\??\PRN                          (SymbolicLink) -> \DosDevices\LPT1
\??\PTILINK1                     (SymbolicLink) -> \Device\ParTechInc0
\??\PTILINK2                     (SymbolicLink) -> \Device\ParTechInc1
\??\PTILINK3                     (SymbolicLink) -> \Device\ParTechInc2
\??\Root#*PNP030b#1_0_22_0_32_0#{884b96c3-56ef-11d1-bc8c-00a0c91405dd} (SymbolicLink) -> \Device\004533
\??\Root#*PNP0401#PnPBIOS_3#{97f76ef0-f883-11d0-af1f-0000f800845c} (SymbolicLink) -> \Device\004633
\??\Root#*PNP0501#PnPBIOS_1#{4d36e978-e325-11ce-bfc1-08002be10318} (SymbolicLink) -> \Device\004733
\??\Root#*PNP0501#PnPBIOS_1#{86e0d1e0-8089-11d0-9ce4-08003e301f73} (SymbolicLink) -> \Device\004733
\??\Root#*PNP0501#PnPBIOS_2#{4d36e978-e325-11ce-bfc1-08002be10318} (SymbolicLink) -> \Device\004833
\??\Root#*PNP0501#PnPBIOS_2#{86e0d1e0-8089-11d0-9ce4-08003e301f73} (SymbolicLink) -> \Device\004833
\??\Root#*PNP0F03#1_0_21_0_31_0#{378de44c-56ef-11d1-bc8c-00a0c91405dd} (SymbolicLink) -> \Device\005534
\??\Root#dmio#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\00011f
\??\Root#ftdisk#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\00021f
\??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} (SymbolicLink) -> \Device\003329
\??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} (SymbolicLink) -> \Device\003429
\??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} (SymbolicLink) -> \Device\003529
\??\Root#MS_PTIMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} (SymbolicLink) -> \Device\003629
\??\Root#SYSTEM#0000#{085aff00-62ce-11cf-a5d6-28db04c10000} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{3e227e76-690d-11d2-8161-0000f8775bf1} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{65e8773e-8f56-11d0-a3b9-00a0c9223196} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{a7c7a5b1-5af3-11d1-9ced-00a024bf0407} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{ad809c00-7b88-11d0-a5d6-28db04c10000} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196} (SymbolicLink) -> \Device\00392a
\??\SCSI#CdRom&Ven_NEC&Prod_CD-ROM_DRIVE:464&Rev_1.05#4&12aa9cc4&0&050#{53f56308-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\Scsi\aic78xx1Port0Path0Target5Lun0
\??\SCSI#CdRom&Ven_NEC&Prod_CD-ROM_DRIVE:464&Rev_1.05#4&12aa9cc4&0&050#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\Scsi\aic78xx1Port0Path0Target5Lun0
\??\SCSI#Disk&Ven_QUANTUM&Prod_VIKING_II_9.1WLS&Rev_3506#4&212b3f19&0&000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\Scsi\aic78u21Port1Path0Target0Lun0
\??\Scsi0:                       (SymbolicLink) -> \Device\Scsi\aic78xx1
\??\Scsi1:                       (SymbolicLink) -> \Device\Scsi\aic78u21
\??\Shadow                       (SymbolicLink) -> \Device\LanmanRedirector
\??\STORAGE#Volume#1&30a96598&0&Signature3137382DOffset17FE11C00Length75A96200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\HarddiskVolume4
\??\STORAGE#Volume#1&30a96598&0&Signature3137382DOffset7E00Length7FF50C00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\HarddiskVolume1
\??\STORAGE#Volume#1&30a96598&0&Signature3137382DOffset7FF60800Length7FF50C00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\HarddiskVolume2
\??\STORAGE#Volume#1&30a96598&0&Signature3137382DOffsetFFEB9200Length7FF50C00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\HarddiskVolume3
\??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c5066e-72c1-11d2-9755-0000f8004788} (SymbolicLink) -> \Device\KSENUM#00000002
\??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50671-72c1-11d2-9755-0000f8004788} (SymbolicLink) -> \Device\KSENUM#00000002
\??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50674-72c1-11d2-9755-0000f8004788} (SymbolicLink) -> \Device\KSENUM#00000002
\??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{fbf6f530-07b9-11d2-a71e-0000f8004788} (SymbolicLink) -> \Device\KSENUM#00000002
\??\sysaudio                     (SymbolicLink) -> \Device\sysaudio
\??\UNC                          (SymbolicLink) -> \Device\Mup
\??\USB#ROOT_HUB#3&32c8bd93&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8} (SymbolicLink) -> \Device\USBPDO-0
\??\Volume{54c0c116-dd07-11d2-9795-806d6172696f} (SymbolicLink) -> \Device\Floppy0
\??\Volume{54c0c117-dd07-11d2-9795-806d6172696f} (SymbolicLink) -> \Device\CdRom0
\??\Volume{8bb65abe-566f-11d3-80f0-806d6172696f} (SymbolicLink) -> \Device\HarddiskVolume4
\??\Volume{927d670b-69d2-11d2-805b-000000000000} (SymbolicLink) -> \Device\HarddiskVolume1
\??\Volume{927d670c-69d2-11d2-805b-000000000000} (SymbolicLink) -> \Device\HarddiskVolume2
\??\Volume{927d670d-69d2-11d2-805b-000000000000} (SymbolicLink) -> \Device\HarddiskVolume3
\??\WanArp                       (SymbolicLink) -> \Device\WANARP
\??\WMIDataDevice                (SymbolicLink) -> \Device\WMIDataDevice
\??\WMIServiceDevice             (SymbolicLink) -> \Device\WMIServiceDevice
\??\{5AAF27E9-C446-42DF-B037-8EA58A8DE51E} (SymbolicLink) -> \Device\{5AAF27E9-C446-42DF-B037-8EA58A8DE51E}
\??\{8DF1FF1F-FBC8-4ABB-B154-26D835858B69} (SymbolicLink) -> \Device\{8DF1FF1F-FBC8-4ABB-B154-26D835858B69}
\??\{D5537CCD-EB42-4633-A85F-EFF0B9DA57EC} (SymbolicLink) -> \Device\{D5537CCD-EB42-4633-A85F-EFF0B9DA57EC}
\??\{E55B60D6-4FB8-44F5-806F-EE3E593D0B63} (SymbolicLink) -> \Device\{E55B60D6-4FB8-44F5-806F-EE3E593D0B63}

---------- ldmsize 0 ----------

           1,110 Cylinders
             255 Tracks/Cylinder
              63 Sectors/Track
             512 Bytes/Sector
              12 MediaType
      17,832,150 Sectors (total)
   9,130,060,800 Bytes (total)
       8,916,075 KB
           8,707 MB
             8.5 GB

               0 StartingOffset
   9,132,374,016 PartitionLength
               0 HiddenSectors
               0 PartitionNumber
               0 PartitionType
               0 BootIndicator
               0 RecognizedPartition
               0 RewritePartition

              16 PartitionCount
        3137382d Signature

        Starting        Partition     Hidden       Total  Partition    Partition       Boot Recognized    Rewrite
  Offset (bytes)   Length (bytes)    Sectors     Sectors     Number   Type (HEX)  Indicator  Partition  Partition

          32,256    2,146,765,824         63   4,192,902          0         0x07          1          1          0
   2,146,798,080    6,267,663,360  4,192,965  12,241,530          1         0x05          0          0          0
               0                0          0           0          2         0x00          0          0          0
               0                0          0           0          3         0x00          0          0          0
   2,146,830,336    2,146,765,824         63   4,192,902          4         0x07          0          1          0
   4,293,596,160    2,146,798,080  4,192,965   4,192,965          5         0x05          0          0          0
               0                0          0           0          6         0x00          0          0          0
               0                0          0           0          7         0x00          0          0          0
   4,293,628,416    2,146,765,824         63   4,192,902          8         0x07          0          1          0
   6,440,394,240    1,974,067,200  8,385,930   3,855,600          9         0x05          0          0          0
               0                0          0           0         10         0x00          0          0          0
               0                0          0           0         11         0x00          0          0          0
   6,440,426,496    1,974,034,944         63   3,855,537         12         0x07          0          1          0
               0                0          0           0         13         0x00          0          0          0
               0                0          0           0         14         0x00          0          0          0
               0                0          0           0         15         0x00          0          0          0

   9,130,060,800 Bytes (17832150 sectors) Geometric size
   9,132,374,016 Bytes (17836668 sectors) True size (measured)
   9,132,374,016 Bytes (17836668 sectors) Reported size (Partition0)
               0 Bytes (       0 sectors) missing/wasted

---------- kernel list ----------

Basic-info: version=21 maxspecio=512 maxio=512 maxkio=2048
Ktrans-state: dg=0.0 pendtid=0.0 state=UNKNOWN
#
# Kmem-regions:
#
id 0: (size=100)
id 1: (size=0)
#
# Disks: (cnt: 1)
#
Disk Harddisk0: dm= dgiid=0.0 darid=0.1026 dmrid=0.0
  kflag=()
  sflag=()
  vflag=(autoconfig|offline)
  publen=9223372036854775807 privlen=9223372036854775807 maxiosize=64
  type=ntdisk info=
#
# Devices: (cnt: 0)
#
#
# Groups: (cnt: 1)
#
Group NULLDG: iid=0.0 id=
  diskset=00000000-0000-0000-0000-000000000000
  configtid=0.0 logsize=0
  kflag=()
  vflag=(created|notempdb|noautoreimport|secondary)
# Group-Objects: (cnt: 0)
# End-group: NULLDG

---------- query -ht ----------

---------- query -l ----------

---------- disk header Harddisk0 ----------

dmdiag: ERROR: scan operation failed:
    Format error in disk private region

---------- disk config Harddisk0 ----------

dmdiag: ERROR: scan operation failed:
    Format error in disk private region

---------- disk klog Harddisk0 ----------

dmdiag: ERROR: scan operation failed:
    Format error in disk private region

---------- disk partitions Harddisk0 ----------

Device:     Harddisk0
Size:       17836668 blocks 8709.31 Megabytes
Parameters: Signature=825702445 mediatype=12
Geometry:   geometry=1110/255/63 sectorsize=512 endingblocks=4518
 Partition1: Type=7 Extent=63,4192902 Hidden=63 Flags=boot,recognized
 Extended:   Type=5 Extent=4192965,12241530 Hidden=4192965 Flags=
 Partition2: Type=7 Extent=4193028,4192902 Hidden=63 Flags=recognized
 Extended:   Type=5 Extent=8385930,4192965 Hidden=4192965 Flags=
 Partition3: Type=7 Extent=8385993,4192902 Hidden=63 Flags=recognized
 Extended:   Type=5 Extent=12578895,3855600 Hidden=8385930 Flags=
 Partition4: Type=7 Extent=12578958,3855537 Hidden=63 Flags=recognized

Note

  • If you want to see your output one screen at a time, type the following at the command line:

    dmdiag |more


Efsinfo.exe: Encrypting File System Information

Overview | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool displays information about files that are encrypted with Encrypting File System (EFS) on NTFS partitions.

The user can also encrypt or decrypt a file by using the command-line tool cipher, included with the Windows XP Professional operating system.

Corresponding UI

There is no corresponding user interface for EFSInfo.

Concepts

EFS is a feature of Windows that enables users to encrypt and decrypt files. Using EFS, users can protect files from unauthorized access to their sensitive data, including from a stolen laptop or external disk drive. Folders themselves are not encrypted, but are marked so that files that are created within them will be encrypted.

In EFS, users work with encrypted files just as they do with any other files, and the encryption is transparent. If the EFS user is the same person who encrypted the file or folder, then the system decrypts the file or folder when the user accesses it later. However, unauthorized users are prevented from access to encrypted files or folders.

For more information on EFS, see Encrypting File System overview in the Help and Support Center. For more information on NTFS, see NTFS: Getting Started in the Help and Support Center.

System Requirements

The following are the system requirements for EFSInfo:

  • Windows XP Professional

File required

  • Efsinfo.exe


EFSInfo Syntax
Overview | Syntax | Examples | Related Tools Open Command Prompt

EFSInfo uses the following syntax:

One Step efsinfo [/u] [/r] [/c] [/i] [/y] [/s: Dir] [Pathname [...]] [/?]

Parameters

/u
Displays encryption information about the files and folders in the current folder. This is the default.
/r
Displays recovery agent information.
/c
Displays certificate thumbnail information.
/i
Continues performing the specified operation even after errors have occurred. By default, EFSInfo stops when an error is encountered.
/y
Displays the current Encrypting File System (EFS) certificate thumbnail on the local computer. The files specified might not be on this computer. If no items are returned, there are no encrypted files on the system.
/s: Dir
Performs the specified operation on directories in the given directory and all subdirectories.
Pathname [...]
Specifies the path of one or more files or directories for which to display encryption information.
/?
Displays command-line help.

Notes

  • When EFSInfo is run without parameters, it displays encryption information about the files and folders in the current folder.
  • If no encrypted files or folders have been created on this computer, then EFSInfo returns no information.


EFSInfo Examples
Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Display Current EFS Certificate

If you want to display the current EFS certificate, type the following in the command window:

efsinfo /y

Information similar to the following output is displayed in the command window:

Your current EFS certificate thumbnail information about the computer named A-LOLAG2 is:

  BAAF 99CB 2B76 C49C E49C 6B17 C404 1030 E6BD BF3D


Filever.exe: File Version
Overview | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool examines the version resource structure of a file, or a directory of files, on either a local or remote computer and displays information on the versions of executable files such as .exe files and dynamic-link libraries (DLLs).

FileVer is useful in determining the exact binary build of an installed component. Executable files typically have their file date and time modified to make them easy to identify as part of a major release; but hotfixes and Service Packs do not always follow this convention.

By identifying the actual version information, it is possible to track where a fix came from. This may be useful for customers who are requested by support personnel to identify hotfixes installed on their computers.

Note

  • FileVer may not work against localized binaries.

Corresponding UI

There is no corresponding user interface for FileVer.

Concepts

For more information about comparing binary builds, see the Knowledge Base article Comparing Binary Images of Same Project Builds (http://www.microsoft.com/) or Using Binary Version Compatibility (http://www.microsoft.com/).

System Requirements

The following are the system requirements for FileVer:

  • Windows XP Professional

File required

  • Filever.exe


FileVer Syntax
Overview | Syntax | Examples | Related Tools Open Command Prompt

One Step filever [/s] [/v] [/e] [/x] [/b] [/a] [/d] [[drive:][path][filename]]

Parameters

/s
Displays files in specified directory and all subdirectories.
/v
Lists verbose version information if available.
/e
Lists executables only.
/x
Displays short names generated for non-8.3 file names.
/b
Uses bare format (no dir listing).
/a
Specifies not to display file attributes.
/d
Specifies not to display file date and time.
/a
Specifies not to display file attributes.


FileVer Examples
Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Determine the Version of Internet Explorer

Some applications are not able to correctly determine the version number of various types of upgraded files. FileVer determines the version numbers of applications by examining the header information in the upgraded file. In this example, to determine the version number of Microsoft Internet Explorer, append the path environment variable to include the Windows XP Professional Support Tools directory.

path= %PATH%;c:\program files\support tools

Change directories to the Internet Explorer directory:

cd c:\program files\internet explorer

Then, run FileVer by typing the following:

filever \v iexplore.exe

FileVer displays version information about Microsoft Internet Explorer similar to the following:

--a-- W32i   APP ENU      6.0.2484.0 shp     91,136 05-29-2001 iexplore.exe
        Language        0x0409 (English (United States))
        CharSet         0x04b0 Unicode
        OleSelfRegister Disabled
        CompanyName     Microsoft Corporation
        FileDescription Internet Explorer
        InternalName    iexplore
        OriginalFilenam IEXPLORE.EXE
        ProductName     Microsoft« Windows« Operating System
        ProductVersion  6.00.2484.0000
        FileVersion     6.00.2484.0000 (main.010529-2005)
        LegalCopyright  ¬ Microsoft Corporation. All rights reserved.

        VS_FIXEDFILEINFO:
        Signature:      feef04bd
        Struc Ver:      00010000
        FileVer:        00060000:09b40000 (6.0:2484.0)
        ProdVer:        00060000:09b40000 (6.0:2484.0)
        FlagMask:       0000003f
        Flags:          00000000
        OS:             00040004 NT Win32
        FileType:       00000001 App
        SubType:        00000000
        FileDate:       00000000:00000000


Ftonline.exe: Fault Tolerant Disk Mounter

Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool allows an administrator to mount and recover files from a fault tolerant disk created in a previous version of Windows. This tool is useful if you failed to upgrade your disks to dynamic disks, or failed to backup your data before installing Windows XP Professional.

Notes

  • You must run FTOnline from the command window.
  • FTOnline only mounts the disks as Read-Only to allow recovery of data. This allows you to backup your data, recreate the fault tolerant volumes, and restore your data.
  • Disks mounted with FTOnline are not persistent. The disks will not be remounted when the computer is restarted.

Corresponding UI

There is no corresponding user interface for FTOnline.

Concepts

Fault tolerant volumes on basic disks are no longer supported in Windows XP Professional.

Fault tolerant volumes are disks that use some type of RAID configuration to increase either performance or reliability. Windows XP supports Disk Striping (RAID-0), Disk Mirroring (RAID-1), and Disk Striping with Parity (RAID-5).

A basic disk is a physical disk with primary and extended partitions. These disks are accessible from earlier versions of Windows.

System Requirements

The following are the system requirements for FTOnline:

  • Windows XP Professional

File Required

  • Ftonline.exe


FTOnline Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This is a recovery tool for use in an emergency situation, and should not be used on a regular basis. Its purpose is to allow emergency recovery of data if Windows XP Professional is installed on a computer that did not have its data backed up. Since Windows 2000 supports dynamic disks, you should upgrade your fault tolerant volumes to dynamic disks before installing Windows XP Professional. However, because Windows NT 4.0 does not support dynamic disks, you will need to backup your data before upgrading from Windows NT 4.0.


FTOnline Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

FTOnline uses the following syntax:

One Step ftonline DriveLetter

Parameters

DriveLetter
Specifies the drive letter of the volume that needs to be mounted.

Examples

See Example: Mount an Inaccessible Fault Tolerant Disk.


FTOnline Examples
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Example: Mount an Inaccessible Fault Tolerant Disk

In this example, you install Windows XP Professional and discover that a mirrored partition containing company data is assigned a letter, but is inaccesible. You look in Disk Administrator and see that it is labeled e:. To recover the data, type the folowing:

ftonline e:

This mounts the disk as a Read-Only volume, enabling you to back up the data. Once you back up the information, delete the volumes and recreate them as dynamic volumes, then restore the data from the backup.


Dhcploc.exe: DHCP Server Locator Utility
Overview | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool displays the DHCP servers active on the subnet. If it detects any unauthorized DHCP servers, it beeps and sends out alert messages. It also displays packets that it detects from DHCP servers; you can specify whether to display packets from all DHCP servers or only from unauthorized servers.

You can also use this tool to determine which DHCP servers are available to a DHCP client and to detect unauthorized DHCP servers on a subnet.

Important

  • DHCPLoc should not be run from a DHCP server. The tool listens for DHCP servers by taking DHCP packets off the IP stack. However, it has no means to reintroduce DHCP packets to the stack. This means that if you run this tool on a DHCP server, it pre-empts DHCP requests and the DHCP server appears not to respond.

Corresponding UI

There is no corresponding user interface for DHCPLoc.

Concepts

Dynamic Host Configuration Protocol (DHCP) is a TCP/IP standard for simplifying management of host IP configuration. The DHCP standards provide for the use of DHCP servers as a way to manage dynamic allocation of IP addresses and other related configuration details to DHCP-enabled clients on your network.

For more information on DHCP, see Concepts in the Help and Support Center.

System Requirements

The following are the system requirements for Dhcploc:

  • Windows XP Professional

File required

  • Dhcploc.exe


DHCPLoc Syntax
Overview | Syntax | Examples | Related Tools Open Command Prompt

DHCPLoc uses the following syntax:

One Step dhcploc [/p] [/a:"AlertNameList"] [/i: AlertInterval] ComputerIPAddress [ValidDHCPServerList]

Parameters

/p:
Suppresses display of detected packets from any of the authorized DHCP servers specified in ValidDHCPServerList.
/a:"AlertNameList"
Sends alert messages to the names in AlertNameList if any unauthorized DHCP servers are found.
/i: AlertInterval
Specifies the alert frequency in seconds.
ComputerIPAddress
Specifies the IP address of the computer from which you are running Dhcploc. If the computer has multiple adapters, you must specify the IP address of the adapter that is connected to the subnet you want to test.
ValidDHCPServerList
Specifies the IP addresses of any number of authorized DHCP servers. The tool does not send alerts when it detects packets from the servers in this list; however, it displays those packets unless you specify the /p option.


DHCPLoc Examples
Overview | Syntax | Examples | Related Tools Open Command Prompt

Example: Sample DHCPLoc Output

The output of DHCPLoc is formatted as follows, where "***" indicates a packet from an unauthorized server:

Time (IP) IPAddress OfferedPacketType (S) ServerIPAddress [***]

Sample output:

17:34:58 (IP)0.0.0.0        NACK      (S)11.11.31.84         ***

17:36:38 (IP)11.101.190.130 OFFER     (S)11.101.12.226      ***

17:36:38 (IP)11.101.196.231 ACK       (S)11.101.13.53

17:36:53 (IP)11.101.196.231 ACK       (S)11.101.13.53

17:37:05 (IP)11.101.196.234 OFFER     (S)11.101.13.53

17:37:05 (IP)11.101.193.232 OFFER     (S)11.101.12.198

17:37:06 (IP)11.101.190.132 OFFER     (S)11.101.12.226       ***


Dnscmd.exe: DNS Server Troubleshooting Tool
Overview | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool assists administrators in Domain Name System (DNS) management.

DNSCmd displays and changes the properties of DNS servers, zones, and resource records. It manually modifies these properties, creates and deletes zones and resource records, and forces replication events between DNS server physical memory and DNS databases and data files. Some operations of this tool work at the DNS server-level while others work at the zone-level.

Note

  • DNSCmd enhances the functionality of and replaces Dnsstat.exe, a tool included in some versions of the Windows NT Resource Kit.

Corresponding UI

To manually view and manage DNS by using the DNS Server snap-in in Windows

  1. Click Start, point to Programs and then Administrative Tools.
  2. Click DNS.
  3. For information about how to use DNS, right-click DNS, and then click Help.
Open DNS Server snap-in now.

Concepts

DNS resolves computer names to IP addresses so that users can refer to computers by name rather than by a series of numbers.

For more information about DNS, see DNS or Concepts in Microsoft Management Console Help.

System Requirements

DNSCmd runs on a source computer and acts on a target computer. The target computer can be the same computer as the source computer or it can be a different computer.

Source Computer Requirements

The following are the system requirements for the source computer:

  • Dnscmd.exe
  • User's membership in the Administrators or Server Operators group on the target computer. Both the user account and the server computer must be members of the same domain or reside within trusted domains.

Target Computer Requirements

The following is required for a target computer:

  • DNS service installed

File Required

  • Dnscmd.exe


DNSCmd Syntax
Overview | Syntax | Examples | Related Tools Open Command Prompt

DNSCmd uses the following general syntax:

One Step dnscmd ServerName /Operation [Parameter] [Arguments]

Operations

Dnscmd ageallrecords

Sets the current time on a timestamp to resource records at a specified zone or node on a DNS server.

Syntax

One Step dnscmd ServerName /ageallrecords ZoneName[/ NodeName]|[/tree]|[/f]

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone.
/ NodeName
Specifies a specific node in the zone.
/tree
Specifies that all child nodes also receive the timestamp.
/f
Executes the command without asking for confirmation.

Remarks

  • The ageallrecords operation is for backward compatibility between the current version of DNS and previous releases in which aging and scavenging were not supported. It adds a timestamp with the current time to records that do not have one and sets the current time on records that do have a timestamp.
  • Scavenging of records does not occur unless the records are timestamped. NS (name server), SOA (Start of Authority), and WINS records are not included in the scavenging process and are not timestamped even when the ageallrecords operation is run.
  • This command fails unless scavenging is enabled for the DNS server and the zone. For information on how to enable scavenging for the zone, see the aging parameter under Zone-Level Syntax in the config operation in this document.
  • The addition of a timestamp to DNS records makes them incompatible with non-Windows 2000 DNS servers. A timestamp you add by using the ageallrecords operation cannot be reversed.
  • If none of the optional fields are specified, the command returns all records at the specified node. If a value is specified for at least one of the optional fields, then DNSCmd enumerates only records corresponding to the value or values specified in the optional field or fields.

Dnscmd clearcache

Clears the DNS cache memory of resource records in the specified DNS server.

Syntax

One Step dnscmd [ServerName] /clearcache

Parameter

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.

Sample usage

dnscmd reskit.com /clearcache

Dnscmd config

Allows the user to change values in the registry for the DNS server and individual zones. Accepts server-level and zone-level settings.

Caution

  • Do not edit the registry directly unless you have no alternative. The registry editor bypasses standard safeguards, allowing settings that can degrade performance, damage your system, or even require you to reinstall Windows. You can safely alter most registry settings by using the programs in Control Panel or Microsoft Management Console (MMC). If you must edit the registry directly, back it up first. Read the Registry Editor Help for more information.

Server-Level Syntax

One Step dnscmd [ServerName] /config parameter [value]

Parameters

ServerName
Specifies the DNS server the administrator is planning to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
/addressanswerlimit [0|5-28]
Specifies the maximum number of host records that a DNS server can send in response to a query. The value can be zero (0) or set between 5 and 28 records. The default value is zero (0).
/bindsecondaries [0|1]
Changes the format of the zone transfer so that it can achieve maximum compression and efficiency. However, this efficient format is incompatible with earlier versions of BIND.
Value | Description
0 | Uses maximum compression. Compatible with BIND versions 4.9.4 and later only.
1 | Sends only one resource record per message to non-Microsoft DNS servers. Compatible with BIND versions earlier than 4.9.4. This is the default setting.
/bootmethod [0|1|2|3]
Determines the source from which the DNS server gets its configuration information.
Value | Description
0 | No source.
1 | Loads from the BIND file that is located in the DNS directory; by default, %systemroot% \System32\DNS..
2 | Loads from the registry.
3 | Loads from Active Directory and the registry. This is the default setting.
/defaultagingstate [0|1]
Determines whether the DNS scavenging feature is enabled by default on newly created zones.
Value | Description
0 | Disables scavenging. This is the default setting.
1 | Enables scavenging.
/defaultnorefreshinterval [0x1-0xFFFFFFFF|0xA8]
Sets a period of time in which no refreshes are accepted for dynamically updated records. This value is inherited automatically by zones on the server. To change the default, enter a value between 0x1 and 0xFFFFFFFF. The default value from the server is 0xA8.
/defaultrefreshinterval [0x1-0xFFFFFFFF|0xA8]
Sets a period of time that is allowed for dynamic updates to DNS records. This value is inherited automatically by zones on the server. To change the default, enter a value between 0x1 and 0xFFFFFFFF. The default value from the server is 0xA8.
/disableautoreversezones [0|1]
Enables or disables the automatic creation of reverse lookup zones.
Value | Description
0 | Enables creation of auto-reverse zones. This is the default setting.
1 | Disables creation of auto-reverse zones.
/eventloglevel [0|1|2|4]
Determines which events are logged in the DNS server log in Event Viewer.
Value | Description
0 | Logs no events.
1 | Logs only errors.
2 | Logs only errors and warnings.
4 | Logs errors, warnings, and informational events. This is the default setting.
/forwarddelegations [0|1]
Determines how a query for a delegated subzone is handled by the DNS server. These queries can either be sent to the subzone referred to in the query or be sent to the list of forwarders named for the DNS server. Entries in the setting are used only when forwarding is enabled.
Value | Description
0 | Automatically sends queries referring to delegated subzones to the appropriate subzone. This is the default setting.
1 | Forwards queries referring to the delegated subzone to the existing forwarders.
/forwardingtimeout [0x1-0xFFFFFFFF|0x5]
Determines how many seconds a DNS server waits for a forwarder to respond before trying another. The range is 0x1 through 0xFFFFFFFF. The default value is 0x5, which is 5 seconds.
/isslave [0|1]
Determines how the DNS server responds when forwarded queries receive no response.
Value | Description
0 | Not a slave. If the forwarder does not respond, the server attempts to resolve the query itself. This is the default setting.
1 | A slave. If the forwarder does not respond, the server terminates the search and sends a failure to the resolver.
/localnetpriority [0|1]
Determines the order in which host records are returned when the server has multiple host records for the same name.
Value | Description
0 | Returns the records in the order in which they are listed in the DNS database.
1 | Returns the records that have similar IP network addresses first. This is the default setting.
/logfilemaxsize [0x10000-0xFFFFFFFF|0x400000]
Specifies the maximum size in bytes of the Dns.log file. When the file reaches its maximum, DNS overwrites the oldest events. Settings range from 0x10000 through 0xFFFFFFFF. The default size is 0x400000, which is 4 MB.
/logfilepath [path+LogFileName]
Specifies the path of the Dns.log file. The default path is %systemroot% \System32\Dns\Dns.log. A different path can be specified by using the format path+LogfileName.
/loglevel [EventType]
Determines which type of events are recorded in the Dns.log file. Each of the types of events is represented by a hexadecimal number. If you want more than one event in the log, use hexadecimal addition to add the values, then enter the sum.
Value | Description
0x0 | The DNS server does not create a log. This is the default entry.
0x10 | Logs queries.
0x10 | Logs notifications.
0x20 | Logs updates.
0xFE | Logs non-query.
0x100 | Logs question transactions.
0x200 | Logs answers.
0x1000 | Logs send packets.
0x2000 | Logs receive packets.
0x4000 | Logs UDP packets.
0x8000 | Logs TCP packets.
0xFFFF | Logs all packets.
0x10000 | Logs Active Directory write transactions.
0x20000 | Logs Active Directory update transactions.
0x1000000 | Logs full packets.
0x80000000 | Logs write-through transactions.
/maxcachesize
Specifies the maximum size of the DNS server’s memory cache.
/maxcachettl [0x1-0xFFFFFFFF|0x15180]
Determines how many seconds a record is saved in cache. The setting can be from 0x0 to 0xFFFFFFFF. If the 0x0 setting is used, then the DNS server does not cache records. The default setting is 0x15180 (86,400 seconds or 1 day).
/maxnegativecachettl [0x1-0xFFFFFFFF|0x15180]
Specifies how many seconds an entry that records a negative answer to a query remains stored in the DNS cache. The default setting is 900 seconds.
/namecheckflag [0|1|2|3]
Specifies which character standard is used when allowing DNS names.
Value | Description
0 | Uses ANSI characters that comply with IETF Requests For Comment (RFC).
1 | Uses ANSI characters that do not necessarily comply with IETF RFCs.
2 | Uses multibyte UTF8 characters. This is the default setting.
3 | Uses all characters.
/norecursion [0|1]
Determines whether a DNS server performs recursive name resolution.
Value | Description
0 | DNS server performs recursive resolution if it is requested in a query. This is the default setting.
1 | DNS server does not perform recursive resolution.
/recursionretry [0x1-0xFFFFFFFF|0x3]
Determines the number of seconds a DNS server waits before again trying to contact a remote server. The settings range from 0x1 through 0xFFFFFFFF. The default setting is 0x3 (3 seconds). This value should be increased when recursion occurs over a slow WAN link.
/recursiontimeout [0x1-0xFFFFFFFF|0xF]
Determines the number of seconds a DNS server waits before discontinuing attempts to contact a remote server. The settings range from 0x1 through 0xFFFFFFFF. The default setting is 0xF (15 seconds). This value should be increased when recursion occurs over a slow WAN link.
/roundrobin [0|1]
Determines the order in which host records are returned when a server has multiple host records for the same name.
Value | Description
0 | DNS server does not use round robin; instead, it returns the first record to every query.
1 | DNS server rotates among the records that it returns from the top to the bottom of the list of matching records. This is the default setting.
/rpcprotocol [0x0|0x1|0x2|0x4|0xFFFFFFFF]
Specifies the protocol that RPC uses when making a connection from the DNS server.
Value | Description
0x0 | Disables RPC for DNS.
0x1 | Uses TCP/IP.
0x2 | Uses named pipes.
0x4 | Uses LPC.
0xFFFFFFFF | All protocols. This is the default setting.
/scavenginginterval [0x0-0xFFFFFFFF|0x0]
Determines whether the scavenging feature for the DNS server is enabled, and sets the number of hours between scavenging cycles. The settings range from 0x0 through 0xFFFFFFFF. The default setting is 0x0, which disables scavenging for the DNS server. A setting greater than 0x0 enables scavenging for the server and sets the number of hours between scavenging cycles.
/secureresponses [0|1]
Determines whether DNS filters records that are saved in a cache.
Value | Description
0 | Saves all responses to name queries to a cache. This is the default setting.
1 | Saves only the records that belong to the same DNS subtree to cache.
/sendport [0x0-0xFFFFFFFF|0x0]
Specifies the port number that DNS uses to send recursive queries to other DNS servers. The settings range from 0x0 through 0xFFFFFFFF. The default setting is 0x0, which means the port number is randomly selected.
/strictfileparsing [0|1]
Determines a DNS server's behavior when it encounters an erroneous record while loading a zone.
Value | Description
0 | Continues to load even if the server encounters an erroneous record. The error is recorded in the DNS log. This is the default setting.
1 | Stops loading and records the error in the DNS log.
/updateoptions RecordValue
Prohibits dynamic updates of specified types of records. The settings range from 0x0 through 0x80000000. If you want more than one record type prohibited in the log, use hexadecimal addition to add the values, then enter the sum.
Value | Description
0x0 | Does not restrict any record types.
0x1 | Excludes SOA (Start of Authority) records.
0x2 | Excludes NS (name server) records.
0x4 | Excludes delegation NS records.
0x8 | Excludes server host records.
0x100 | On secure dynamic update, excludes SOA records.
0x200 | On secure dynamic update, excludes root NS records.
0x30F | On standard dynamic update, excludes NS, SOA, and server host records. On secure dynamic update, excludes root NS and SOA records. Allows delegations and server host updates.
0x400 | On secure dynamic update, excludes delegation NS records.
0x800 | On secure dynamic update, excludes server host records.
0x1000000 | Excludes DS per records.
0x80000000 | Disables DNS dynamic update.
/writeauthorityns [0|1]
Determines when the DNS server writes name server (NS) records in the Authority section of a response.
Value | Description
0 | Writes NS records in the Authority section of referrals only. This setting complies with RFC 1034, Domain names—concepts and facilities, and with RFC 2181, Clarifications to the DNS Specification. This is the default setting.
1 | Writes NS records in the Authority section of all successful authoritative responses.
/xfrconnecttimeout [0x0-0xFFFFFFFF|0x1E]
Determines the number of seconds a primary DNS server waits for a transfer response from its secondary. The settings range from 0x0 through 0xFFFFFFFF. The default value is 0x1E (30 seconds). After the timeout value expires, the connection is terminated.
/logipfilterlist IPaddress
Specifies which packets are logged in the debug log file. The entries are a list of IP addresses. Only packets going to and from the IP addresses in the list are logged.
/dspollinginterval
Specifies how often the DNS server polls Active Directory for changes in Active Directory-integrated zones. The default value is 300 seconds.
/enablednssec 0|1
Enables or disables DNSSEC.
Value | Description
0 | Disables DNSSEC.
1 | Enables DNSSEC.
/enableednsprobes 0|1
Enables or disables EDnsProbes.
Value | Description
0 | Disables active support for EDnsProbes.
1 | Enables active support for EDnsProbes.
/ednscachetimeout
Specifies the number of seconds that EDns information is cached.
/disablensrecordsautocreation 0|1
Specifies whether the DNS server automatically creates NS records for zones that it hosts.
Value | Description
0 | Automatically creates NS records for zones that it hosts.
1 | Does not automatically create NS records for zones that it hosts.

Zone-Level Syntax

One Step dnscmd /config parameter ZoneName [value]

Parameters

/aging
Enables or disables scavenging in a specific zone.
/allownsrecordsautocreation
Overrides the DNS server's NS record autocreation setting.
/allowupdate
Determines whether the specified zone accepts dynamic updates.
/refreshinterval
Sets a time interval for a zone during which refreshes can dynamically update DNS records in a specified zone.
/norefreshinterval
Sets a time interval for a zone during which no refreshes can dynamically update DNS records in a specified zone.
/securesecondaries
Determines which secondary servers can receive zone updates from the master for this zone.
/forwardertimeout
Determines how many seconds a DNS zone waits for a forwarder to respond before trying another. This value overrides the value set at the server level.
/forwarderslave
Overrides the DNS server /isslave setting.

Remarks

  • The zone name needs to be specified only for zone-level parameters.

Dnscmd createbuiltindirectorypartition

Creates a DNS application directory partition. By default a default directory partition for DNS is created at the forest and domain levels. Use this operation to create default DNS application directory partitions that were deleted or never created. With no argument, this operation creates a built-in DNS directory partition for the domain.

Syntax

One Step dnscmd [ServerName] /createdirectoryparition [/forest] [/alldomains]

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
/forest
Creates a DNS directory partition for the forest.
/alldomains
Creates DNS partitions for all domains in the forest.

Dnscmd createdirectorypartition

Creates a DNS application directory partition. By default a default directory partition for DNS is created at the forest and domain levels. This operation creates additional DNS application directory partitions.

Syntax

One Step dnscmd [ServerName] /createdirectoryparition FQDNofDP

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
FQDNofDP
The fully qualified domain name of the DNS application directory partition that will be created.

Dnscmd deletedirectorypartition

Removes an existing DNS application directory partition.

Syntax

One Step dnscmd [ServerName] /deletedirectoryparition FQDNofDP

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
FQDNofDP
The fully qualified domain name of the DNS application directory partition that will be removed.

Dnscmd enlistdirectorypartition

Adds the DNS server to the specified directory partition's replica set.

Syntax

One Step dnscmd [ServerName] /enlistdirectoryparition FQDNofDP

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
FQDNofDP
The fully qualified domain name of the DNS application directory partition.

Dnscmd enumrecords

Lists the resource records of a specified node in a DNS zone.

Syntax

One Step dnscmd [ServerName] /enumrecords ZoneName NodeName [/type RRType RRData] [/authority] [/glue] [/additional] {[/node |/child |[/startchild ChildName]]} {[/continue |/detail]}

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone to which the record belongs.
NodeName
Specifies the name of the node of the record.
/authority /glue /additional {[/node | /child | [/startchild ChildName]}
Filters or adds information to the record display.
Value | Description
/authority | Includes authoritative data.
/glue | Includes glue data.
/additional | Includes all additional information about the records listed.
/node | Lists only the records of the specified node.
/child | Lists only the records of a specified child.
/startchild ChildName | Begins the list at the specified child.
/continue|/detail
Specifies how the returned data is displayed.
Value | Description
/continue | Lists only the records with their type and data.
/detail | Lists all information about the records.

Sample Usage

dnscmd /enumrecords reskit.com test /additional

Dnscmd enumzones

Lists zones that exist on the specified DNS server.

Syntax

One Step dnscmd [ServerName] /enumzones [/primary|/secondary|/stub|/cache|/auto-created] [/forward|/reverse]

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
/primary|/secondary|/stub|/cache|/auto-created
Filters the types of zones to display.
Value | Description
/primary | Lists all zones that are either standard primary or Active Directory-integrated.
/secondary | Lists all standard secondary zones.
/stub | Lists all stub zones.
/cache | Lists only the zones that are loaded into cache.
/auto-created | Lists the zones that were created automatically during the DNS server installation.
/forward|/reverse
Specifies an additional filter of the types of zones to display.
Value | Description
/forward | Lists forward lookup zones.
/reverse | Lists reverse lookup zones.

Remarks

  • The enumzones operation parameters act as filters on the list of zones. If no filters are specified, then a complete list of zones is returned. When a filter is used, only the zones that meet that filter's criteria are included in the returned list of zones.

Examples

See Example 2: Display a Complete List of Zones on a DNS Server or Example 3: Display a List of Auto-Created Zones on a DNS Server.

Dnscmd info

Displays settings from the DNS section of the registry, HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters, of the specified server.

Syntax

One Step dnscmd [ServerName] /info [Setting]

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
Setting
Any setting returned by the info operation can be individually specified. If a setting is not specified, then all settings are returned.

Remarks

  • This operation displays registry settings that are at the DNS server level. To display zone-level registry settings, use the zoneinfo operation. To see a list of settings that can be displayed with this operation, refer to the config operation Help.
  • If you do not specify a value for the parameter when you use the config operation, the parameter's current value is reset to the default value.

Examples

See Example 4: Display the IsSlave Setting from a DNS Server or Example 5: Display the RecursionTimeout Setting from a DNS Server.

Dnscmd nodedelete

Deletes all records for a specified host.

Syntax

One Step dnscmd [ServerName] /nodedelete ZoneName NodeName [/tree] [/f]

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone.
NodeName
Specifies the host name of node to delete.
/tree
Specifies to delete all of the child records.
/f
Executes the command without asking for confirmation.

Sample Usage

DNSCmd reskit.com /NodeDelete test.reskit.com node /Tree
DNSCmd reskit.com /NodeDelete test.reskit.com host /F

Dnscmd recordadd

Adds a record to a specified zone in a DNS server.

Syntax

One Step dnscmd [ServerName] /recorddelete ZoneName NodeName RRType RRData

Parameters

ServerName
Specifies the DNS server the administrator is planning to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the zone in which the record resides.
NodeName
Specifies a specific node in the zone.
RRType
Specifies the type of record to be added.
RRData
Specifies the type of data that is expected when using a certain data type.

Note

  • When you add a record, make sure you use the correct data type and data format. For a list of resource record types and the appropriate datatypes, see Resource Records Reference.

Sample Usage

dnscmd reskit.com /recordadd test A 10.0.0.5
dnscmd /recordadd reskit.com test MX 10 mailserver.reskit.com

Dnscmd recorddelete

Deletes a resource record from a specified zone.

Syntax

One Step dnscmd ServerName /recorddelete ZoneName NodeName RRType RRData [/f]

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the zone in which the record resides.
NodeName
Specifies the name of the host.
RRType
Specifies the type of record to be deleted.
RRData
Specifies the type of data that is expected when using a certain data type.
/f
Executes the command without asking for confirmation.

Note

  • Because nodes can have more than one resource record, this command requires you to be very specific about the type of record that you want to delete.

    If you specify a data type and do not specify a type of resource record data, then all records with that specific data type for the specified node are deleted. For a list of resource record types and the appropriate data types, see Resource Records Reference.

Sample Usage

DNSCmd /RecordDelete reskit.com test MX 10 mailserver.reskit.com

Dnscmd resetforwarders

Selects or resets IP address(es) to which the DNS server forwards DNS queries when it cannot solve them locally.

Syntax

One Step dnscmd [ServerName] /resetforwarders [IPAddress] [,IPAddress][,...] [/timeout TimeOut] [/slave|/noslave]

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
IPAddress
Lists the IP address(es) to which the DNS server forwards unresolved queries.
/timeout TimeOut
Sets the number of seconds that the DNS server waits for a response from the forwarder. By default, this value is 5 seconds.
/slave|/noslave
Determines whether the DNS server performs its own iterative queries if the forwarder fails to resolve a query.
Value | Description
/slave | Prevents the DNS server from performing its own iterative queries if the forwarder fails to resolve a query.
/noslave | Allows the DNS server to perform its own iterative queries if the forwarder fails to resolve a query. This is the default setting.

Remarks

  • By default, a DNS server performs iterative queries when it cannot resolve a query.
  • Setting IP addresses by using the resetforwarders operation causes the DNS server to perform recursive queries to the DNS servers at the specified IP addresses. If the forwarders do not resolve the query, the DNS server can then perform its own iterative queries.
  • If the /slave parameter is used, the DNS server does not perform its own iterative queries. This means the DNS server forwards unresolved queries only to the DNS servers in the list and does not try iterative queries if the forwarders do not resolve it. It is more efficient to set one IP address as a forwarder for a DNS server. The resetforwarders operation can be used for internal servers in a network to forward their unresolved queries to one DNS server that has an external connection.
  • Listing a forwarder’s IP address twice causes the DNS server to try to forward to that server twice.

Sample Usage

dnscmd reskit.com /resetforwarders 10.0.0.1 /timeout 7 /slave
dnscmd reskit.com /resetforwarders /noslave

Dnscmd resetlistenaddresses

Specifies the IP addresses on a server that listen for DNS client requests.

Syntax

One Step dnscmd [ServerName] /resetlistenaddresses [ListenAddress]

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ListenAddress
Specifies an IP address on the DNS server that listens for DNS client requests. If no listen address is specified, then all IP addresses on the server listen for client requests.

Remarks

  • By default, all IP addresses on a DNS server listen for client DNS requests.

Sample Usage

dnscmd reskit.com /resetlistenaddresses 10.0.0.1

Dnscmd startscavenging

Notifies a DNS server to attempt an immediate search for stale resource records in a specified DNS server.

Syntax

One Step dnscmd [ServerName] /startscavenging

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.

Remarks

  • Successful completion of this command triggers an immediate start to a scavenge.
  • Although the command to start the scavenge appears to complete successfully, the scavenge does not start unless the following preconditions are met:
    • Scavenging is enabled for both the server and the zone.
    • The zone is started.
    • The resource records have a timestamp.
  • For information on how to enable scavenging for the server, see the scavenginginterval parameter under Server-Level Syntax in the config operation in this document.
  • For information on how to enable scavenging for the zone, see the aging parameter under Zone-Level Syntax in the config operation in this document.
  • For information on how to start a zone that is paused, see the zoneresume operation in this document.
  • For information on how to check resource records for a timestamp, see the ageallrecords operation in this document.
  • If the scavenge fails, no warning message displays.

Sample Usage

dnscmd reskit.com /startscavenging

Dnscmd statistics

Displays or clears data for a specified DNS server.

Syntax

One Step dnscmd [ServerName] /statistics [StatID] [/clear]

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
StatID
Specifies which statistic or combination of statistics displays. An identification number is used to specify a statistic. If no statistic ID is specified, all statistics display.

The following table lists numbers that can be specified and the corresponding statistic that lists:

Value | Description
00000001 | Time
00000002 | Query
00000004 | Query2
00000008 | Recurse
00000010 | Master
00000020 | Secondary
00000040 | Wins
00000100 | Update
00000200 | SkwanSec
00000400 | Ds
00010000 | Memory
00100000 | PacketMem
00040000 | Dbase
00080000 | Records
00200000 | NbstatMem
/clear
Resets the specified statistics counter to zero.

Remarks

  • The statistics operation displays counters that begin on the DNS server when it is started or resumed.

Examples

See Example 7: Display Time Statistics for a DNS Server or Example 8: Display NbstatMem Statistics for a DNS Server.

Dnscmd unenlistdirectorypartitions

Removes the DNS server from the specified directory partition's replica set.

Syntax

One Step dnscmd [ServerName] /unenlistdirectoryparition FQDNofDP

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
/FQDNofDP
The fully qualified domain name of the DNS application directory partition that will be removed.

Dnscmd writebackfiles

Checks DNS server memory for changes and writes them to persistent storage.

Syntax

One Step dnscmd [ServerName] /writebackfiles [ZoneName]

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone to be updated.

Remarks

  • The writebackfiles operation updates all dirty zones or a specified zone. A zone is dirty when there are changes in memory that have not yet been written to persistent storage. This is a server-level operation that checks all zones. One zone can be specified in this operation or the zonewriteback operation can be used.

Sample Usage

dnscmd reskit.com /writebackfiles

Dnscmd zoneadd

Adds a zone to the DNS server.

Syntax

One Step dnscmd [ServerName] /zoneadd ZoneName ZoneType {[/dsprimary |/primary /file FileName|/secondary MasterIPaddress [, MasterIPaddress...][|/stub MasterIPaddress [, MasterIPaddress...] [/file FileName]|dsstub MasterIPaddress [, MasterIPaddress...] /forwarder|/dsforwarder} [/dp FQDN| [/domain|/enterprise|/legacy]]

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone.
ZoneType
Specifies the type of zone to create. Each type has different required parameters.
/dsprimary |/primary|/secondary|/stub|/dsstub /forwarder|/dsforwarder
Creates a specific type of zone.
Value | Description
/dsprimary | Creates an Active Directory-integrated zone.
/primary /file FileName | Creates a standard primary zone.
/secondary MasterIPaddress [, MasterIPaddress... | Creates a standard secondary zone.
/stub MasterIPaddress [, MasterIPaddress... /file FileName | Creates a file-backed stub zone.
/dsstub MasterIPaddress [, MasterIPaddress... | Creates an Active Directory-integrated stub zone.
/forwarder MasterIPaddress [, MasterIPaddress... /file FileName | Specifies that the zone created forwards unresolved queries to another DNS server.
/dsforwarder | Specifies that the active directory-integrated zone created forwards unresolved queries to another DNS server.
/dp FQDN|[/domain|/enterprise|/legacy]
Specifies the directory partition on which to store the zone.
Value | Description
FQDN | Specifies fully qualified domain name of the directory partition.
/domain | Stores the zone on the domain directory partition.
/enterprise | Stores the zone on the enterprise directory partition.
/legacy | Stores the zone on a legacy directory partition.

Remarks

  • Specifying a zone type of /forwarder or /dsforwarder creates a zone that performs conditional forwarding.

Sample Usage

dnscmd reskit.com /zoneadd test.reskit.com /dsprimary
dnscmd reskit.com /zoneadd secondtest.reskit.com /secondary 10.0.0.2

Dnscmd zonedelete

Deletes a specified zone.

Syntax

One Step dnscmd [ServerName] /zonedelete ZoneName [/dsdel] [/f]

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone to be deleted.
/dsdel
Deletes the zone from Active Directory.
/f
Executes the command without asking for confirmation.

Examples

See Example 9: Delete a Zone from a DNS Server.

Dnscmd zoneexport

Creates a text file that lists the resource records of a specified zone.

Syntax

One Step dnscmd [ServerName] /zoneexport ZoneName ZoneExportFile

Parameters

ServerName
Specifies the DNS server the administrator is planning to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone.
ZoneExportFile
Specifies the name of the file to create.

Remarks

  • The zoneexport operation creates a file of resource records for an Active Directory-integrated zone for troubleshooting purposes. By default, the file created by this operation is placed in the DNS directory, which is by default the %systemroot% /System32/Dns directory.

Examples

See Example 10: Export Zone Resource Records List to a File.

Dnscmd zoneinfo

Displays settings from the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\Zones\Zonename section of the registry of the specified zone.

Syntax

One Step dnscmd [ServerName] /zoneinfo ZoneName [Setting]

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone.
Setting
Any setting returned with the zoneinfo operation can be individually specified. If a setting is not specified, then all settings are returned.

Remarks

  • The zoneinfo operation displays registry settings that are at the DNS zone level found at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\Zones\Zonename.
  • To display server-level registry settings, use the info operation.
  • To see a list of settings that can be displayed with this operation, refer to the config operation.

Examples

See Example 11: Display RefreshInterval Setting from the Registry or Example 12: Display Aging Setting from the Registry.

Dnscmd zonepause

Pauses the specified zone, which then ignores query requests.

Syntax

One Step dnscmd [ServerName] /zonepause ZoneName

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone to be paused.

Remarks

  • To resume a zone and make it available after it has been paused, use the zoneresume operation.

Sample Usage

dnscmd reskit.com /zonepause test.reskit.com

Dnscmd zoneprint

Lists the records in a zone.

Syntax

One Step dnscmd [ServerName] /zoneprint ZoneName

Parameters

ServerName
Specifies the DNS server the administrator is planning to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Identifies the zone on which the type will be changed.

Dnscmd zoneresettype

Changes the type of the zone.

Syntax

One Step dnscmd [ServerName] /zoneresettype ZoneName {[/primary /file FileName]|[/secondary MasterIPaddress MasterIPaddress /file FileName ]|[ /stub MasterIPaddress MasterIPaddress /file FileName ]|[ /dsstub MasterIPaddress MasterIPaddress ]| /dsprimary]} [/forwarder] MasterIPaddress MasterIPaddress [/overwrite_mem|/overwrite_ds]

Parameters

ServerName
Specifies the DNS server the administrator is planning to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Identifies the zone on which the type will be changed.
property
Specifies the type to which the zone changes and information that may be required to change the zone type, such as file name for primary zones or master IP address for secondary zones.
/primary /file FileName]|[/secondary MasterIPaddress MasterIPaddress /file FileName ]|[ /stub MasterIPaddress MasterIPaddress /file FileName ]|[ /dsstub MasterIPaddress MasterIPaddress ]| /dsprimary| [/forwarder MasterIPaddress MasterIPaddress]
Specifies that one type of zone be changed to another type.
Value | Description
/primary | Changes the existing zone to a standard primary zone.
/secondary | Changes the existing zone to a standard secondary zone.
/stub | Changes the existing zone to a standard stub zone.
/dsstub | Changes the existing zone to an Active Directory-integrated stub zone.
/dsprimary | Changes the existing zone to an Active Directory-integrated primary zone.
/forwarder | Changes the existing zone to one that forwards queries when it cannot resolve them locally.
/overwrite_mem|/overwrite_ds
Specifies how to overwrite existing data.
Value | Description
/overwrite_mem | Overwrites DNS data from data in Active Directory.
/overwrite_ds | Overwrites existing data in Active Directory.

Remarks

  • Setting the zone type as /dsforwarder creates a zone that performs conditional forwarding.

Sample Usage

dnscmd reskit.com /zoneresettype test.reskit.com /primary /file test.reskit.com.dns
dnscmd reskit.com /zoneresettype second.reskit.com /secondary 10.0.0.2

Dnscmd zonerefresh

Forces a secondary DNS zone to update from the master.

Syntax

One Step dnscmd ServerName /zonerefresh ZoneName

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone to be refreshed.

Remarks

  • The zonerefresh operation forces a check of the version number in the master's SOA record. If the version number on the master is higher than the secondary's version number, then a zone transfer is initiated, updating the secondary server. If the version number is the same, no zone transfer occurs. This check occurs by default every 15 minutes.

Sample Usage

dnscmd reskit.com /zonerefresh test.reskit.com

Dnscmd zonereload

Copies zone information from its source.

Syntax

One Step dnscmd ServerName /zonereload ZoneName

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone to be reloaded.

Remarks

  • If the zone is Active Directory-integrated, then it reloads from Active Directory.
  • If the zone is a standard file-backed zone, then it reloads from a file.

Sample Usage

dnscmd reskit.com /zonereload test.reskit.com

Dnscmd zoneresetmasters

Resets the IP addresses of the master server that provides zone transfer information to a secondary zone.

Syntax

One Step dnscmd ServerName /zoneresetmasters ZoneName [/local] [ServerIPs]

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone to be reloaded.
/local
Sets a local master list. Used for Ds-integrated zones.
ServerIPs
The IP addresses of the master server(s)of the secondary zone. Enter this value as IPaddress [,IPaddress...].

Remarks

  • This value is originally set when the secondary zone is created. Use the zoneresetmasters operation on the secondary server. It has no effect if it is set on the master DNS server.

Sample Usage

dnscmd reskit.com /zoneresetmasters test.reskit.com 10.0.0.1
dnscmd reskit.com /zoneresetmasters test.reskit.com /local

Dnscmd zoneresetscavengeservers

Changes the IP address(es) of the server(s) that can scavenge the specified zone.

Syntax

One Step dnscmd [ServerName] /zoneresetscavengeservers ZoneName[: ServerIPs]

Parameters

ServerName
Specifies the DNS server the administrator is planning to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Identifies the zone to scavenge.
ServerIPs
Lists the IP address(es) of the server(s) that can perform the scavenge. If this parameter is omitted, then all servers hosting this zone can scavenge it.

Remarks

  • By default, all servers hosting a zone can scavenge that zone.
  • If a zone is hosted on more than one DNS server, this operation can be used to reduce the number of times a zone is scavenged.
  • Scavenging must be enabled on the DNS server and zone affected by this operation.

Sample Usage

dnscmd reskit.com test.reskit.com /zoneresetscavengeservers 10.0.0.1 10.0.0.2

Dnscmd zoneresetsecondaries

Specifies a list of IP addresses to which a master server responds when asked for a zone transfer.

Syntax

One Step dnscmd [ServerName] /zoneresetsecondaries ZoneName {/noxfr|/nonsecure|/securens|/securelist SecurityIPAddresses} {/nonotify|/notify|/notifylist NotifyIPAddresses}

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone to have its secondaries reset.
/noxfr|/nonsecure|/securens|/securelist SecurityIPAddresses
Specifies whether only some or all of the secondary servers requesting an update get one.
Value | Description
/noxfr | Specifies that no zone transfers are allowed.
/nonsecure | Specifies that all zone transfer requests are granted.
/securens | Specifies that only the server listed in the NS record for the zone is granted a transfer.
/securelist | Specifies that zone transfers are granted only to the list of servers. This parameter must be followed by an IP address or addresses that the master server uses.
SecurityIPAddresses | Lists the IP addresses that receive zone transfers from the master server. This parameter is used only with the /securelist parameter.
/nonotify|/notify|/notifylist NotifyIPAddresses
Specifies a change notification is sent only to certain secondary servers.
Value | Description
/nonotify | Specifies that no change notifications are sent to secondary servers.
/notify | Specifies that change notifications are sent to all secondary servers.
/notifylist | Specifies that change notifications are sent to only the list of servers. This command must be followed by an IP address or addresses that the master server uses.
NotifyIPAddresses | Specifies the IP address(es) of the secondary server(s) to which change notifications are sent. This list is used only with the /notifylist parameter.

Remarks

  • Use the zoneresetsecondaries operation on the master server to set how it responds to zone transfer requests from secondary servers.

Sample Usage

dnscmd reskit.com /zoneresetsecondaries test.reskit.com /noxfr /nonotify
dnscmd reskit.com /zoneresetsecondaries test.reskit.com /securelist 11.0.0.2

Dnscmd zoneresume

Starts a specified zone that was previously paused.

Syntax

One Step dnscmd ServerName /zoneresume ZoneName

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone to resume.

Remarks

  • This operation is used to undo the zonepause operation.

Sample Usage

dnscmd reskit.com /zoneresume test.reskit.com

Dnscmd zoneupdatefromds

Updates the specified directory-integrated zone from Active Directory.

Syntax

One Step dnscmd ServerName /zoneupdatefromds ZoneName

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone to update.

Remarks

  • Active Directory-integrated zones perform this update by default every 5 minutes.

Sample Usage

dnscmd reskit.com /zoneupdatefromds

Dnscmd zonewriteback

Checks DNS server memory for changes relevant to a specified zone and writes them to persistent storage.

Syntax

One Step dnscmd ServerName /zonewriteback ZoneName

Parameters

ServerName
Specifies the DNS server the administrator plans to manage, represented by local computer syntax, IP address, FQDN, or Host name. If omitted, the local server is used.
ZoneName
Specifies the name of the zone to update.

Remarks

  • This is a zone-level operation. All zones on a DNS server can be updated with the writebackfiles operation.

Sample Usage

dnscmd reskit.com /zonewriteback test.reskit.com

Dnscmd zonechangedirectorypartition

One Step dnscmd [ServerName] /zonechangedirectoryparition /ZoneName] { [/NewPartitionName] | [zonetype] }

/ZoneName
FQDN of the current directory partition on which the zone resides.
/NewPartitionName
FQDN of the directory partition that the zone will be moved to.
/domain|/forest|/legacy
Specifies the type of directory partition that the zone will be moved to.
ZoneType | Description
/domain | Move the zone to the built-in domain directory parition..
/forest | Move the zone to the built-in forest directory partition.
/legacy | Move the zone to the directory partition created for downlevel domain controllers. These directory partitions are not needed when in native mode.


DNSCmd Examples
Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Set the Current Time on a Timestamp to Resource Records

To set the current time on a timestamp to resource records, type:

dnscmd reskit.com /ageallrecords test.reskit.com

The following question is displayed:

Are you sure you want to force aging on node?

Type y to apply the time. Output similar to the following displays:

DNS Server reskit.com forced aging on records at root of zone test.reskit.com:
     Status = 0 (0x00000000)
Command completed successfully.

Example 2: Display a Complete List of Zones on a DNS Server

To see a complete list of zones on your DNS server, type:

dnscmd reskit.com /enumzones

Results similar to the following output display:

Enumerated zone list:
     Zone Count = 6.

.                             0 DS            Up=0
0.0.10.in-addr.arpa           0 DS   Rev      Up=1
0.in-addr.arpa                1 file Rev Auto Up=0
255.in-addr.arpa              1 file Rev Auto Up=0
reskit.com                    1 DS            Up=0
test.reskit.com               1 file          Up=1

Command completed successfully.

Example 3: Display a List of Auto-Created Zones on a DNS Server

To display a list of autocreated zones that are also reverse lookup zones on the DNS server, type:

dnscmd reskit.com /enumzones /auto-created /reverse

Results similar to the following output display:

Enumerated zone list:
     Zone Count = 2.
0.in-addr.arpa                1 file Rev Auto Up=0
255.in-addr.arpa              1 file Rev Auto Up=0

Command completed successfully.

Example 4: Display the IsSlave Setting from a DNS Server

If you want to display the IsSlave setting from a DNS server, type:

dnscmd reskit.com /info isslave

Results similar to the following output display:

Query result:
Dword: 0 (00000000)
Command completed successfully.

Example 5: Display the RecursionTimeout Setting from a DNS Server

To display the RecursionTimeout setting from a DNS server, type:

dnscmd reskit.com /info recursiontimeout

Results similar to the following output display:

Query result:
Dword: 15 (0000000F)
Command completed successfully.

Example 6: Delete the Records from a Node

To delete the records in a node, type:

dnscmd reskit.com /nodedelete test.reskit.com node /tree

Results similar to the following output display:

Are you sure you want to delete node's subtree? y

DNS Server reskit.com deleted node at node.test.reskit.com:
     Status = 0 (0x00000000)
Command completed successfully.

To delete the records in a node using the host, type:

dnscmd reskit.com /NodeDelete test.reskit.com host /F

Results similar to the following output display:

DNS Server reskit.com deleted node at host.test.reskit.com:
     Status = 0 (0x00000000)
Command completed successfully.

Example 7: Display Time Statistics for a DNS Server

To display time statistics for a DNS server, type:

dnscmd reskit.com /statistics 00000001

Results similar to the following output display:

DNS Server reskit.com statistics:

DNS Server Time Statistics:
Server start time 3/7/2001 1:07:31 PM
Seconds since start 8482
Stats last cleared 3/7/2001 1:07:31 PM
Seconds since start 8482

Command completed successfully.

Example 8: Display NbstatMem Statistics for a DNS Server

To display NbstatMem statistics for a DNS server, type:

DNSCmd reskit.com /Statistics 00200000

Results similar to the following output display:

DNS Server reskit.com statistics:

NBStat Memory Usage:
NBStat Buffers:
     Alloc = 0
     Free = 0
     NetAllocs = 0
     Memory = 0
     Used = 0
     Returned = 0
     InUse = 0
     InFreeList = 0

Command completed successfully.

Example 9: Delete a Zone from a DNS Server

To delete the test.reskit.com zone from a server, type:

dnscmd reskit.com /zonedelete test.reskit.com

The following question is displayed:

Are you sure you want to ZoneDelete? (y/n)

Type y to apply the time.

Results similar to the following output display:

DNS Server reskit.com deleted zone test.reskit.com:
        Status = 0 (0x00000000)
Command completed successfully.

Example 10: Export Zone Resource Records List to a File

To export the resource record list from the test.reskit.com zone on the reskit.com DNS server, type:

dnscmd reskit.com /zoneexport test.reskit.com test.reskit.com.dns

Results similar to the following output display:

DNS Server reskit.com exported zone
     test.reskit.com to file
C:\Windows\System32\DNS\test.reskit.com.dns
Command completed successfully.

Example 11: Display RefreshInterval Setting from the Registry

To display the values in the RefreshInterval entry in the registry, type:

dnscmd reskit.com /zoneinfo test.reskit.com refreshinterval

Results similar to the following output display:

Zone query result:
Dword: 168 (000000A8)
Command completed successfully.

Example 12: Display Aging Setting from the Registry

To display the values in the Aging entry in the registry, type:

dnscmd reskit.com /zoneinfo test.reskit.com aging

Results similar to the following output display:

Zone query result:
Dword: 0 (00000000)
Command completed successfully.


Getsid.exe: Get Security ID
Overview | Syntax | Related Tools Open Command Prompt

This a command-line tool compares the user security IDs (SIDs) of two accounts.

You can use it to compare account SIDs between a primary domain controller and backup domain controller when you suspect user database corruption.

Corresponding UI

There is no corresponding user interface for GetSID.

Concepts

For more information about security in Windows XP, see Security Model or Security and Active Directory under Security in Help and Support Services.

System Requirements

The following are the system requirements for GetSID:

  • Windows XP Professional
  • User's membership in the Administrators group.

File Required

  • Getsid.exe


GetSID Syntax
Overview | Syntax | Related Tools Run Tool

GetSID uses the following syntax:

One Step getsid \\Server1Account \\Server2Account

Parameters

\\Server1Account
Specifies the name of the server on which the accounts are found, and Account is the account SID).
\\Server2Account
Specifies the name of the server on which the accounts are found, and Account is the account SID).


Netcap.exe: Network Monitor Capture Utility
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool allows a system administrator to monitor packets on a LAN and write the information to a log file. NetCap uses the Network Monitor Driver to sniff packets on the local segment that fit its filter criteria.

Notes

  • You must run NetCap from the command window.
  • If the Network Monitor Driver is not installed, NetCap installs it the first time the tool is run. To remove the driver, use netcap /remove.

Corresponding UI

This tool provides a command-line interface for much of the functionality of NetMon.

Concepts

NetCap helps you capture frames directly from the network traffic data stream and examine them. You can use this information to analyze ongoing patterns of use and diagnose specific network problems.

Frames (also known as packets) are packages of information transmitted as a single unit over a network. Every frame follows the same basic organization and contains the following:

  • Control information such as synchronizing characters
  • Source and destination addresses
  • Protocol information
  • An error-checking value
  • A variable amount of data

System Requirements

The following are the system requirements for NetCap:

  • Windows XP Professional, or Windows 2000 Professional or Server, or Windows NT 4.0

Files Required

  • Netcap.exe


NetCap Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

How The Network Monitor Driver Works

Network Monitor tracks the network data stream, which consists of all of the information transferred over a network at any given time. Before transmission, the networking software divides this information into smaller segments, called frames (packets). Each frame contains the following information:

  • The source address of the computer that sent the message
  • The destination address of the computer that receives the frame
  • Header information of each protocol used to send the frame
  • The data (or a portion of it) being sent to the destination computer

All frames on a network segment pass through every computer connected to that segment. However, the network card typically passes on only the frames addressed to it, as the destination computer, to the networking software. The Windows XP Professional version of Network Monitor can copy frames originating from or sent to the local computer to a temporary capture file. The process by which Network Monitor copies frames is referred to as data capture.

The amount of information that the Network Monitor Driver can capture is limited only by the amount of memory available on your system. However, you usually need to capture only a small subset of the frames traveling on your network. To isolate a subset of frames, you can design a capture filter, which functions like a database query to isolate the information that you specify. You can filter frames on the basis of source and destination addresses, protocols, protocol properties, and pattern offset.

If you want a running capture to respond to specific conditions as soon as the Network Monitor detects them, you can design a capture trigger. When the Network Monitor detects a particular set of conditions on the network, this capture trigger performs a specified action, such as starting an executable file.

Note

  • When used with a network adapter that supports promiscuous mode, the full version of Network Monitor (available with Microsoft Systems Management Server version 2.0) can capture all the frames it detects.

The Network Data Stream

Network Monitor monitors the network data stream, which consists of all information transferred over a network at any given time. Prior to transmission, this information is divided by the network software into smaller pieces, called frames or packets.

Frames, whether broadcast, multicast, or directed, are made up of several different pieces that can be analyzed separately. Some of these pieces contain data that Network Monitor can use to troubleshoot networking problems. For example, by examining the destination address, it can be determined whether the frame was a broadcast frame, indicating all hosts had to receive and process this frame, or a directed frame sent to a specific host. By analyzing frames, you can determine the exact cause of the frame, which helps determine whether the service generating these types of frames can be optimized.


NetCap Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

NetCap uses the following syntax:

One Step netcap [/b:Number] [/t Type Buffer HexadecimalOffset HexadecimalPattern] [/f: FilterFile] [/c: CapturePath] [/n: Number] [/k: HH:MM:SS] [/tcf: FolderName]

/b:Number
Specifies the buffer size in megabytes. Number can be from 1 to 1000. The default is 1 MB.
/T Type Buffer HexadecimalOffset HexadecimalPattern
Specifies to use a trigger to determine when to stop capturing. If the trigger is omitted, NetCap captures until the buffer is full, then stops. The /t /n option continues to capture until the spacebar is pressed, using the buffer as a queue.
Type
B = Buffer
P = Pattern
BP = Buffer then pattern
PB = Pattern then buffer
N = No trigger
Buffer
Percent buffer size. Options are 25, 50, 75, and 100. It is used with B, BP, PB, but not P.
HexadecimalOffset
Hexadecimal offset from start of frame used with P, BP, PB, but not B.
HexadecimalPattern
Hexadecimal pattern to match used with P, BP, PB, but not B. The pattern must be an even number of hexadecimal digits.
/c: CapturePath
Temporarily moves the capture path to CapturePath. This can be any valid local or remote path. If /c is not specified, the capture path remains in the default temporary capture folder.
/f: FilterFile
Specifies a Network Monitor 2.x-generated capture filter (*.cf).
/l: HH:MM:SS
Specifies to capture for the given amount of time (max 99:99:99).

Note

  • This option overrides the default 100 percent trigger, unless /t Type is also specified.
/tcf: FolderName
Sets the default temporary capture folder. The path must be on a fixed local hard drive. Once set, you only need to use the option again to change the directory.
/remove
Removes the NetCap instance of the Network Monitor driver.
/n: Number
Specifies which NIC to use based on the NIC index number for this computer.

Examples

See Example 1: Capture Network Packets for 3 Minutes, Example 2: Monitoring With a Trigger, and Example 3: Remove the Network Monitor Driver.


NetCap Examples
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Capture Network Packets for 3 Minutes

In this example, you monitor your network port for three minutes and capture the information to the C:\Temp folder. Type the following at the command prompt:

netcap /c:c:\temp /l:00:03:00

NetCap displays the following result:

Total frames captured: 229

Capture file name: c:\temp\7D16111E39FA.cap

Example 2: Monitoring with a Trigger

In this example, you want to monitor with a trigger defining when to stop. You want to look for a certain pattern, and when found keep listening until the trigger is halfway into the buffer. You have previously defined a filter restricting the monitoring to a suspicious host. Type the following at the command prompt:

NetCap /B:20 /N:2 /T BP 50 0a ff1f /F:d:\IPFilter.CF

NetCap produces the following output:

Total frames captured: 85220

Capture file name: c:\temp\7D234C233A3B.cap

Example 3: Remove the Network Monitor Driver

In this example, you want to remove the Network Monitor Driver that NetCap has installed. Type the following at the command prompt:

netcap /remove

NetCap produces the following output:

The NetCap.exe instance of the Network Monitor driver successfully removed.


Netdiag.exe: Network Connectivity Tester
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This command-line diagnostic tool helps to isolate networking and connectivity problems, by performing a series of tests to determine the state of your network client, and whether it is functional. These tests, and the key network status information they expose, give network administrators and support personnel a more direct means of identifying and isolating network problems. Moreover, because this tool does not require that parameters or switches be specified, support personnel and network administrators can focus on analyzing the output, rather than on training users how to use the tool.

Notes

  • You must run NetDiag from the command window.
  • TCP/IP must be bound to one or more adapters before using this tool. In most cases, this will already be done.

Corresponding UI

There is no corresponding user interface for NetDiag.

Concepts

The TCP/IP protocol stack is the primary communications protocol used in networks today. In order to access the Internet, you need to be using TCP/IP.

System Requirements

The following are the system requirements for NetDiag:

  • Windows XP Professional

Files Required

  • Netdiag.exe


NetDiag Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Features

  • Ships as a Windows Management Instrumentation (WMI) Source Provider dynamic-link library (DLL), so MSINFO can be used as a GUI entry point.
  • Gathers static network information and tests network driver, protocol driver, send/receive capability, and well-known target accessibility.
  • Receives input, and returns output, that can be leveraged by other applications and services.
  • Can be used by network administrators in conjunction with the Scheduler Service, to generate reports at regularly scheduled intervals.

Test Switches

The following test switches are available in NetDiag:

Network adapter

netdiag /test:Bindings

1. Enumerate network adapter configuration details for all installed network adapters, including network adapter description, physical address, and resources in use.

2. Verify LAN and WAN adapter driver status - initialized or error.

3. Sense if network adapter is attached to the network (NDIS Autosense).

WAN

netdiag /test:WAN

1. COM port in use and settings: data bits, stop bits, parity, baud rate, error checking, compression, LCP extensions, Unimodem support.

2. Sense if WAN link is up.

Bindings

netdiag /test:Bindings

1. Enumerate all network bindings, including binding failures.

Winsock

netdiag /test:Winsock

1. Enumerate Winsock layered service providers, including minimum and maximum version supported, vendor description, maximum number of sockets, and maximum UDP datagram size.

2. Ping Web Proxy Server, if present.

General TCP/IP

netdiag /test:IPConfig

1. Configuration information: IP address, subnet mask, default gateway, autoconfiguration enabled, DHCP enabled, LMHOSTS enabled, host name, DNS servers, DNS domain, WINS servers, node type, NetBIOS scope ID, IP address forwarding (routing) enabled, WINS proxy enabled, NetBIOS resolution (enabled, disabled, by way of DHCP), DNS for Windows name resolution, DHCP class ID, IP address security.

netdiag /test:DefGw

2. Enumerate Configured Default Gateways. Ping current default gateway address if present. If current default gateway is not reachable, then ping each gateway in the gateway list until success is achieved, or until the end of the list is reached.

DHCP

1. DHCP lease obtained, lease expires.

2. If Automatic Private IP Addressing (APIPA) address is in use, then broadcast to determine if DHCP server is available, including time information to indicate how long it took to get a response.

NETBT

netdiag /test:Netstat

1. Enumerate local and remote name cache (for example, nbtstat -c and nbtstat -n).

DNS Server

netdiag /test:DNS

1. Ping DNS server.

2. If server is not available, then log target address, status code and description.

3. Try next server, per search order, until the end of the list is reached.

4. Query DNS server on Port 53 for SOA record.

WINS Server

netdiag /test:WINS

1. Ping WINS server.

2. Test whether registration of a unique or group name specific to this diagnostic is successful.

3. Test whether name query of the above name is successful.

4. If server is not available, then log target address, status code and description.

5. Try next server, per search order.

IPX protocol

netdiag /test:IPX

1. Get frame type, network ID, packetburst enabled, source routing enabled, RouterMTU.

Routing

netdiag /test:Route

1. Enumerate static routes and report if they are persistent. Note that this test will return "N/A" on Windows 95 and Windows 98 platforms because it does not apply.

Netware

netdiag /test:Netware

1. Tree or bindery login, default context if tree login, server attached to on startup (get nearest server reply information).

Distributed systems

1. RPC Tests - Perform an RPC bind and ack.

netdiag /test:DsGetDC

2. Find domain controller in your domain: domain controller name, IP address, domain name, domain GUID, tree name, domain controller site name, our site name, flags.

3. Find PDC (Primary Domain Controller) in your domain: domain controller name, IP address, domain GUID, domain name, tree name, domain controller site name, our site name, flags.

4. Find Windows domain controller in your domain: domain controller name, IP address, domain GUID, domain name, tree name, domain controller site name, our site name, flags.

netdiag /test:DcList

5. List of domain controllers in domain.

netdiag /test:Trust

6. Trust Relationship Test - Enumerate NTLM and Kerberos Trusts.

netdiag /test:Kerberos

7. Kerberos Test: Cached Tickets including server name, end time, and renew time. Note that this test will return "N/A" on Windows 95/98 and Windows NT 4.0 platforms because it does not apply.

netdiag /test:Ldap

8. LDAP Test Un-Authenticated LDAP call - Current time, server name, subschemaSubentry, settings. Note that this test will return "N/A" on Windows 95 and Windows NT 4.0 platforms because it does not apply.

9. NTLM Authenticated LDAP call.

10. Authenticated LDAP call.

11. IPSEC Test - Is IPSEC enabled?, Enumerate IPSEC policy settings. Note that this test will return "N/A" on Windows 95, Windows 98, and Windows NT 4.0 platforms because it does not apply.


NetDiag Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

NetDiag uses the following syntax:

One Step netdiag [/q] [/v] [/l] [/debug] [/d: DomainName] [/fix] [/DcAccountEnum] [/test: testname] [/skip: testname]

Parameters

/q
Specifies quiet output (errors only).
/v
Specifies verbose output.
/l
Sends output to Netdiag.log. Log file is created in the same directory where netdiag.exe was run.
/debug
Specifies even more verbose output; may take a few minutes to complete.
/d: DomainName
Finds a domain controller in the specified domain.
/fix
Fixes minor problems.
/DcAccountEnum
Enumerates domain controller computer accounts.
/test: TestName
Execute only listed test or tests. TCP/IP must be bound to one or more adapters before running any of the tests. Non-skippable tests will still be run. Valid tests are:
  • Autonet - Automatic Private IP Addressing (APIPA) address test
  • Bindings - Bindings test
  • Browser - Redir and Browser test
  • DcList - Domain controller list test
  • DefGw - Default gateway test
  • DNS - DNS test
  • DsGetDc - Domain controller discovery test
  • IpConfig - IP address configuration test
  • IpLoopBk - IP address loopback ping test
  • IPX - IPX test
  • Kerberos - Kerberos test
  • Ldap - LDAP test
  • Member - Domain membership test
  • Modem - Modem diagnostics test
  • NbtNm - NetBT name test
  • Ndis - Netcard queries test
  • NetBTTransports - NetBT transports test
  • Netstat - Netstat information test
  • Netware - Netware test
  • Route - Routing table test
  • Trust - Trust relationship test
  • WAN - WAN configuration test
  • WINS - WINS service test
  • Winsock - Winsock test
/skip: TestName
Skip the named test. Valid tests are:
  • Autonet - Automatic Private IP Addressing (APIPA) address test
  • Bindings - Bindings test
  • Browser - Redir and browser test
  • DcList - Domain controller list Test
  • DefGw - Default gateway Test
  • DNS - DNS Test
  • DsGetDc - Domain controller discovery test
  • IpConfig - IP address configuration test
  • IpLoopBk - IP address loopback ping test
  • IPX - IPX test
  • Kerberos - Kerberos test
  • Ldap - LDAP test
  • Modem - Modem diagnostics test
  • NbtNm - NetBT name test
  • Netstat - Netstat information test
  • Netware - Netware test
  • Route - Routing table test
  • Trust - Trust relationship test
  • WAN - WAN configuration test
  • WINS - WINS service test
  • Winsock - Winsock test


NetDiag Examples

Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Sample Scenario

This example is a scenario where you have a problem connecting to a network resource. Receiving only a "Network path not found" error message and no further assistance, you have no idea where to start troubleshooting the problem.

Assuming that the reason for the failure in this case is that the DNS server is down, the solution can be found easily with Network Connectivity Tester.

Sample NetDiag Output

C:\Program Files\Support Tools>netdiag

.......................................

    Computer Name: BDOVER
    DNS Host Name: bdover.reskita.microsoft.com
    System info : Windows 2000 Server (Build 2467)
    Processor : x86 Family 6 Model 6 Stepping 0, GenuineIntel
    List of installed hotfixes :
        Q147222

Netcard queries test . . . . . . . : Passed
    [WARNING] The net card 'Intel(R) PRO/100+ Management Adapter' may not be wor
king.

Per interface results:

    Adapter : Local Area Connection

        Netcard queries test . . . : Passed

        Host Name. . . . . . . . . : bdover
        IP Address . . . . . . . . : 10.10.1.51
        Subnet Mask. . . . . . . . : 255.255.255.0
        Default Gateway. . . . . . :
        Dns Servers. . . . . . . . : 10.10.1.77

        AutoConfiguration results. . . . . . : Passed

        Default gateway test . . . : Skipped
            [WARNING] No gateways defined for this adapter.

        NetBT name test. . . . . . : Passed

        WINS service test. . . . . : Skipped
            There are no WINS servers configured for this interface.

    Adapter : Local Area Connection 2

        Netcard queries test . . . : Failed
        NetCard Status:          DISCONNECTED
            Some tests will be skipped on this interface.

        Host Name. . . . . . . . . : bdover
        Autoconfiguration IP Address : 169.254.74.217
        Subnet Mask. . . . . . . . : 255.255.0.0
        Default Gateway. . . . . . :
        Dns Servers. . . . . . . . :

Global results:

Domain membership test . . . . . . : Passed

NetBT transports test. . . . . . . : Passed
    List of NetBt transports currently configured:
        NetBT_Tcpip_{A2D04C22-3BB8-4FA0-B7DA-414DC1DD08A7}
        NetBT_Tcpip_{56079E37-8246-4712-8B36-F503FF6F9873}
    2 NetBt transports currently configured.

Autonet address test . . . . . . . : Passed

IP loopback ping test. . . . . . . : Passed

Default gateway test . . . . . . . : Failed

    [FATAL] NO GATEWAYS ARE REACHABLE.
    You have no connectivity to other network segments.
    If you configured the IP protocol manually then
    you need to add at least one valid gateway.

NetBT name test. . . . . . . . . . : Passed

Winsock test . . . . . . . . . . . : Passed

DNS test . . . . . . . . . . . . . : Failed
          [WARNING] Cannot find a primary authoritative DNS server for the name
            'bdover.reskita.microsoft.com.'. [ERROR_TIMEOUT]
            The name 'bdover.reskita.microsoft.com.' may not be registered in DNS
.
       [WARNING] The DNS entries for this DC cannot be verified right now on DNS
 server 10.10.1.77, ERROR_TIMEOUT.
    [FATAL] No DNS servers have the DNS records for this DC registered.

Redir and Browser test . . . . . . : Passed
    List of NetBt transports currently bound to the Redir
        NetBT_Tcpip_{A2D04C22-3BB8-4FA0-B7DA-414DC1DD08A7}
        NetBT_Tcpip_{56079E37-8246-4712-8B36-F503FF6F9873}
    The redir is bound to 2 NetBt transports.

    List of NetBt transports currently bound to the browser
        NetBT_Tcpip_{A2D04C22-3BB8-4FA0-B7DA-414DC1DD08A7}
        NetBT_Tcpip_{56079E37-8246-4712-8B36-F503FF6F9873}
    The browser is bound to 2 NetBt transports.

DC discovery test. . . . . . . . . : Passed

DC list test . . . . . . . . . . . : Passed

Trust relationship test. . . . . . : Failed
    Secure channel for domain 'RESKITA' is to '\\a-dcp.reskita.microsoft.com'.
    [FATAL] Cannot set secure channel for domain 'RESKITA' to PDC emulator. [ERR
OR_NO_LOGON_SERVERS]

Kerberos test. . . . . . . . . . . : Passed

LDAP test. . . . . . . . . . . . . : Passed
    [WARNING] Failed to query SPN registration on DC 'a-dcp.reskita.microsoft.com'.
    [WARNING] Failed to query SPN registration on DC 'a-dc1.reskita.microsoft.com'.
    [WARNING] Failed to query SPN registration on DC 'a-dc3.reskita.microsoft.com'.

Bindings test. . . . . . . . . . . : Passed

WAN configuration test . . . . . . : Skipped
    No active remote access connections.

Modem diagnostics test . . . . . . : Passed

IP Security test . . . . . . . . . : Passed
    Service status  is: Started
    Service startup is: Automatic
    IPSec service is available, but no policy is assigned or active
    Note: run "ipseccmd /?" for more detailed information

The command completed successfully

When executed in this scenario, the tool shows that the network adapter protocol, bindings, and IP address tests succeed. The DNS ping test fails, and reports that the DNS server could not be contacted. With this information, the user knows that either the DNS server address is incorrect, or that the DNS server is not responding for some unknown reason. Since the DNS address is also displayed as output, it can easily be verified for correctness. With the problem isolated, a Network Administrator can perform additional troubleshooting to determine why the DNS server is down.


Netdom.exe: Windows 2000 Domain Manager

Netdom.exe: Windows Domain Manager
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This tool enables administrators to manage Windows 2000 domains and trust relationships from the command line.

You can use NetDom to:
  • Join a Windows XP Professional computer to a Windows NT 4.0 or Windows 2000 domain, and:
    • Provide an option to specify the organizational unit for the computer account.
    • Generate a random computer password for initial join.
  • Manage computer accounts for domain member workstations and member servers:
    • Add, Remove, Query.
    • Provide an option to specify the organizational unit for the computer account.
    • Provide an option to move an existing computer account for a member workstation from one domain to another and maintain the security descriptor on the computer account.
  • Establish one-way or two-way trust relationships between domains, including the following kinds of trust relationships:
    • From a Windows 2000 domain to an Windows NT 4.0 domain.
    • From a Windows 2000 domain to a Windows 2000 domain in another enterprise (an "uplevel" external trust).
    • Between two Windows 2000 domains in an enterprise (a shortcut trust).
    • The Windows 2000 half of an interoperable Kerberos realm.
  • Verify and/or reset the secure channel for the following configurations:
    • Member workstations and servers.
    • BDCs in a Windows NT 4.0 domain.
    • Specific Windows 2000 replicas.
  • Manage trust relationships between domains:
    • View all trust relationships.
    • Enumerate direct trust relationships.
    • Enumerate all (direct and indirect) trust relationships.

Note

  • You must run NetDom from the command window.

Corresponding UI

Much of the functionality of NetDom can be accessed from Active Directory Users and Computers, a Microsoft Management Console snap-in that is part of the Windows XP Professional operating system.

Note

  • You must install Adminpak.msi before you can see the Active Directory Users and Computers snap-in in Administrative Tools.

Concepts

A trust relationship is a defined affiliation between domains that enables pass-through authentication. Simply put, a one-way trust relationship between two domains means that one domain (the trusting domain) allows users who have accounts on the other domain (the trusted domain) to access its resources. The trusting domain, also known as a resource domain, may or may not have users of its own, but when a user tries to access a file or printer in its domain, it treats that user as one of its own. The trusted domain, also known as the account domain, does not recognize the users from the trusting domain; in fact, the trust relationship has little effect on the domain. The one-way trust relationship described here can be helpful in master domain models, but they are not the only kind of trusts. When two one-way trusts are established between domains, it's known as a two-way trust . In two-way trusts, each domain treats the users from the trusted (and trusting) domain as its own users.

System Requirements

The following are the system requirements for NetDom:

  • Windows XP Professional

Files Required

  • Netdom.exe


NetDom Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Using the /Verbose Parameter

By default, only the result of an operation is reported. For example, if you use the join operation you see output similar to the following:

success: mywksta joined to mycompany domain

If you specify the /verbose parameter, the output lists the success or failure of each transaction necessary to perform the operation. For example, this time when you use the join operation you see output similar to the following:

success: adding machine account for mywksta to mycompany domain
success: configuring lsa on mywksta
success: mywksta joined to mycompany domain

Using the /verbose parameter also causes NetDom to return a value signalling its success or failure in the overall operation. This return value is useful when using NetDom in a batch file or script.

Using the /Reboot Parameter

The /reboot parameter specifies that the computer being affected by the specified NetDom operation is shut down and automatically rebooted after that operation has completed. When you specify the /reboot parameter, the following message and a countdown timer are displayed on the workstation's screen prior to the restart:

The system is shutting down. Please save
all work in progress and logoff. Any unsaved changes
will be lost. This shutdown was initiated because the
domain which this machine belongs to was changed by
nnn.

The name of the administrator entered by using the /uo parameter is substituted for nnn.

The default delay before computer restart is 20 seconds.


NetDom Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

NetDom uses the following general syntax:

One Step netdom Command Object [/d: Domain] [Options]

Operations

Netdom add

Adds a workstation or server account to the domain.

Syntax

One Step netdom add Computer /d: Domain [/ud:[Domain\]User /pd:{Password|*}] [/s: Server] [/ou: OUPath] [/dc] [/verbose]

Parameters

Computer
Specifies the name of the computer to be added.
/d: Domain
Specifies the domain in which to create the account. If the parameter is omitted, then the domain that the current computer belongs to is used.
/ud:[Domain\]User
Specifies the user account that makes the connection with the domain in the /d parameter. If this parameter is omitted, the current user account is used.
/pd:{Password|*}
Specifies the password of the user account that is specified in the /ud parameter. Use * to be prompted for the password.
/s: Server
Specifies the name of a domain controller that performs the add.
/ou: OUPath
Specifies the organizational unit (OU) under which to create the account. This must be the full RFC 1779 distinguished name of the OU. If omitted, the account is created under the default OU for machine objects for that domain.
/dc
Specifies that a domain controller's machine account is to be created. This allows the computer accounts for new Windows NT 4.0 Backup Domain Controllers (BDCs) and new Windows 2000 domain controllers to be pre-created. If installing a new Windows NT 4.0 BDC into an existing Windows 2000 domain, the computer account must be pre-created. This option cannot be used with the /ou parameter.
/verbose
Specifies verbose output. By default, only the result of the operation is reported. If /verbose is specified, the output lists the success or failure of each transaction necessary to perform the operation as well as returning an error level based on the success (0) or failure (1) of the operation.

Remarks

  • To see the command-line usage for the add operation, type the following at the command line:

    netdom add /help

Sample Usage

netdom add /d:reskit.ms.com mywksta
netdom add /d:reskit.ms.com mynt4dc /dc

Netdom join

Joins a workstation or member server to a domain. The act of joining a computer to a domain creates an account for the computer on the domain, if it does not already exist.

Syntax

One Step join Computer /d: Domain [/ou: OUPath] [/ud:[Domain\]User /pd:{Password|*}] [/uo: User /po:{Password|*}] [/reboot[:Delay]] [/verbose]

Parameters

Computer
Specifies the name of the computer to be joined.
/d: Domain
Specifies the domain to which the account is joined. If the parameter is omitted, then the domain that the current computer belongs to is used.
/ou: OUPath
Specifies the organizational unit (OU) under which to create the account. This must be the full RFC 1779 distinguished name of the OU. If omitted, the account is created under the default OU for machine objects for that domain.
/ud:[Domain\]User
Specifies the user account that makes the connection with the domain in the /d parameter. If this parameter is omitted, the current user account is used.
/pd:{Password|*}
Specifies the password of the user account that is specified in the /ud parameter. Use * to be prompted for the password.
/uo: User
Specifies the user account that makes the connection with the computer to be joined. If this parameter is omitted, the current user account is used.
/po:{Password|*}
Specifies the password of the user account that is specified in the /uo parameter. Use * to be prompted for the password.
/reboot[:Delay]
Specifies that the computer is shut down and automatically rebooted after the join has completed. Delay is the number of seconds before automatic shutdown occurs. The default Delay value is 20 seconds.
/verbose
Specifies verbose output. By default, only the result of the operation is reported. If /verbose is specified, the output lists the success or failure of each transaction necessary to perform the operation as well as returning an error level based on the success (0) or failure (1) of the operation.

Remarks

  • When joining a computer running Windows NT 4.0 or earlier to the domain, the operation is not transacted. This means that a failure during the operation could leave the computer in an undetermined state with respect to the domain to which it should be joined.
  • To see the command-line usage for the join operation, type the following at the command line:

    • netdom join /help

Sample Usage

netdom join /d:reskit.ms.com mywksta

Netdom move

Moves a workstation or member server to a new domain. The act of moving a computer to a new domain creates an account for the computer on the domain, if it does not already exist.

One Step netdom move Computer /d: Domain [/ou: OUPath] [/ud:[Domain\]User /pd:{Password|*}] [/uo: User /po:{Password|*}] [/reboot[:Delay]] [/verbose]

Parameters

Computer
Specifies the name of the computer to be moved.
/d: Domain
Specifies the domain to which the account is moved. If the parameter is omitted, then the domain that the current computer belongs to is used.
/ou: OUPath
Specifies the organizational unit (OU) under which to create the account. This must be the full RFC 1779 distinguished name of the OU. If omitted, the account is created under the default OU for machine objects for that domain.
/ud:[Domain\]User
Specifies the user account that makes the connection with the domain in the /d parameter. If this parameter is omitted, the current user account is used.
/pd:{Password|*}
Specifies the password of the user account that is specified in the /ud parameter. Use * to be prompted for the password.
/uo: User
Specifies the user account to make the connection with the computer to be moved. If this parameter is omitted, the current user account is used.
/po:{Password|*}
Specifies the password of the user account that is specified in the /uo parameter. Use * to be prompted for the password.
/reboot[:Delay]
Specifies that the computer is shut down and automatically rebooted after the move has completed. Delay is the number of seconds before automatic shutdown occurs. The default Delay is 20 seconds.
/verbose
Specifies verbose output. By default, only the result of the operation is reported. If /verbose is specified, the output lists the success or failure of each transaction necessary to perform the operation as well as returning an error level based on the success (0) or failure (1) of the operation.

Remarks

  • When moving a computer running Windows NT 4.0 or earlier to the domain, the operation is not transacted. This means that a failure during the operation could leave the computer in an undetermined state with respect to the domain to which it should be moved.
  • When moving a computer to a new domain, the old computer account in the previous domain is not deleted. If the prior domain is a Windows 2000 domain, the old computer account is disabled.
  • To see the command-line usage for the move operation, type the following at the command line:

    netdom move /help

Sample Usage

netdom move /d:newdomain mywksta

Netdom query

Queries the domain for information such as membership and trust.

One Step netdom query /d: Domain [/s: Server] [/ud:[Domain\]User /pd:{Password|*}] [/verify] [/reset] [/direct] {WORKSTATION|SERVER|DC|OU|PDC|FSMO|TRUST} [/verbose]

Parameters

/d: Domain
Specifies the domain to query for the information. If the parameter is omitted, then the domain that the current computer belongs to is used.
/s: Server
Specifies the name of a domain controller to perform the query.
/ud:[Domain\]User
Specifies the user account that makes the connection with the domain in the /d parameter. If this parameter is omitted, the current user account is used.
/pd:{Password|*}
Specifies the password of the user account that is specified in the /ud parameter. Use * to be prompted for the password.
/verify
Specifies to verify the secure channel secrets for all enumerated memberships or trusts as well as displaying them. Unless the user is an enterprise administrator, it may not be possible to verify all secure channel secrets.
/reset
Specifies to resynchronize the secure channel secrets for all enumerated memberships or trusts (which are currently broken). The /reset parameter implies the /verify parameter. Unless the user is an enterprise administrator, it may not be possible to reset all enumerated trusts or memberships.
/direct
Indicates that the query for trust relationships should only return direct trust relationships rather than direct and indirect ralationships. This parameter is valid only when Domain is specified with the /d parameter.
WORKSTATION| SERVER|DC|OU|PDC|FSMO|TRUST
Specifies the type of list to generate.
Object | Description
WORKSTATION | Queries the domain for the list of workstations.
SERVER | Queries the domain for the list of servers.
DC | Queries the domain for the list of domain controllers.
OU | Queries the domain for the list of OUs under which the specified user can create a machine object.
PDC | Queries the domain for the current Primary Domain Controller.
FSMO | Queries the domain for the current list of FSMO owners.
TRUST | Queries the domain for the list of its trusts.
/verbose
Specifies verbose output. By default, only the result of the operation is reported. If /verbose is specified, the output lists the success or failure of each transaction necessary to perform the operation as well as returning an error level based on the success (0) or failure (1) of the operation.

Remarks

  • To see the command-line usage for the query operation, type the following at the command line:

    netdom query /help

Sample Usage

netdom query /d:reskit.ms.com DC

Netdom remove

Removes a workstation or server from the domain.

One Step netdom remove Computer /d: Domain [/ud:[Domain\]User /pd:{Password|*}] [/uo: User /po:{Password|*}] [/reboot[:Delay]] [/verbose]

Parameters

Computer
Specifies the name of the computer to be removed.
/d: Domain
Specifies the domain from which the account will be removed. If the parameter is omitted, then the domain that the current computer belongs to is used.
/ud:[Domain\]User
Specifies the user account that makes the connection with the domain in the /d parameter. If this parameter is omitted, the current user account is used.
/pd:{Password|*}
Specifies the password of the user account that is specified in the /ud parameter. Use * to be prompted for the password.
/uo: User
Specifies the user account to make the connection with the computer to be removed. If this parameter is omitted, the current user account is used.
/po:{Password|*}
Specifies the password of the user account that is specified in the /uo parameter. Use * to be prompted for the password.
/reboot[:Delay]
Specifies that the computer is shut down and automatically rebooted after the remove operation has completed. Delay is the number of seconds before automatic shutdown occurs. The default Delay is 20 seconds.
/verbose
Specifies verbose output. By default, only the result of the operation is reported. If /verbose is specified, the output lists the success or failure of each transaction necessary to perform the operation as well as returning an error level based on the success (0) or failure (1) of the operation.

Remarks

  • To see the command-line usage for the remove operation, type the following at the command line:

    netdom remove /help

Sample Usage

netdom remove /d:reskit.ms.com mywksta

Netdom rename

Renames a Windows NT 4.0 backup domain controller. This can assist in Windows NT 4.0 domain renaming efforts.

One Step netdom rename Computer [/d: Domain] [/reboot[:Delay]] [/verbose]

Parameters

Computer
Specifies the name of the backup domain controller to rename.
/d: Domain
Specifies the new name of the domain.
/reboot[:Delay]
Specifies that the computer is shut down and automatically rebooted after the rename operation has completed. Delay is the number of seconds before automatic shutdown occurs. The default Delay is 20 seconds.
/verbose
Specifies verbose output. By default, only the result of the operation is reported. If /verbose is specified, the output lists the success or failure of each transaction necessary to perform the operation as well as returning an error level based on the success (0) or failure (1) of the operation.

Remarks

  • To see the command-line usage for the rename operation, type the following at the command line:

    netdom rename /help

Sample Usage

netdom rename /d:newdomain BDC51

Netdom reset

Resets the secure connection between a workstation and a domain controller.

One Step netdom reset Computer /d: Domain [/s: Server] [/uo: User /po:{Password|*}] [/verbose]

Parameters

Computer
Specifies the name of the computer for which the connection will be reset.
/d: Domain
Specifies the domain with which to establish the secure connection. If the parameter is omitted, then the domain that the current computer belongs to is used.
/s: Server
Specifies the name of the domain controller to use to establish the secure connection.
/uo: User
Specifies the user account to make the connection with the computer to be reset. If this parameter is omitted, the current user account is used.
/po:{Password|*}
Specifies the password of the user account that is specified in the /uo parameter. Use * to be prompted for the password.
/verbose
Specifies verbose output. By default, only the result of the operation is reported. If /verbose is specified, the output lists the success or failure of each transaction necessary to perform the operation as well as returning an error level based on the success (0) or failure (1) of the operation.

Remarks

  • To see the command-line usage for the reset operation, type the following at the command line:

    netdom reset /help

Sample Usage

netdom reset /d:reskit.ms.com redmond

Netdom resetpwd

One Step netdom resetpwd /s: Server /ud:[Domain\]User /pd:{Password|*}] [/verbose]

Parameters

/s: Server
Specifies the name of the domain controller to use for setting the machine account password.
/ud:[Domain\]User
Specifies the user account that makes the connection with the domain in the /s parameter. This must be in Domain\User format. If this parameter is omitted, the current user account is used.
/pd:{Password|*}
Specifies the password of the user account that is specified in the /ud parameter. Use * to be prompted for the password.
/verbose
Specifies verbose output. By default, only the result of the operation is reported. If /verbose is specified, the output lists the success or failure of each transaction necessary to perform the operation as well as returning an error level based on the success (0) or failure (1) of the operation.

Remarks

  • To see the command-line usage for the resetpwd operation, type the following at the command line:

    netdom resetpwd /help

Netdom time

Verifies or resets and synchronizes time within a domain.

One Step netdom time Computer /d: Domain [/ud:[Domain\]User /pd:{Password|*}] [/uo: User /po:{Password|*}] [/verify] [/reset] [/synch] [WORKSTATION] [SERVER] [/verbose]

Parameters

Computer
Specifies the domain with which to verify/reset the time.
/d: Domain
Specifies the domain with which to verify/reset the time. If the parameter is omitted, then the domain that the current computer belongs to is used.
/ud:[Domain\]User
Specifies the user account that makes the connection with the domain in the /d parameter. If this parameter is omitted, the current user account is used.
/pd:{Password|*}
Specifies the password of the user account that is specified in the /ud parameter. Use * to be prompted for the password.
/uo: User
Specifies the user account that makes the connection with the machine to which the time operation will be performed. If this parameter is omitted, the current user account is used.
/po:{Password|*}
Specifies the password of the user account that is specified in the /uo parameter. Use * to be prompted for the password.
/verify
Displays the synchronization status of all domain controllers within the domain.
/reset
Synchronizes the clocks of those domain controllers which are not within the allowed skew range for the domain.
/synch
Specifies to automatically resynchronize a specified domain controller or all domain controllers that are out of synch.
WORKSTATION
Resets and/or verifies the time for all the workstations in a domain.
SERVER
Resets and/or verifies the time for all the domain controllers in a domain.
/verbose
Specifies verbose output. By default, only the result of the operation is reported. If /verbose is specified, the output lists the success or failure of each transaction necessary to perform the operation as well as returning an error level based on the success (0) or failure (1) of the operation.

Remarks

  • To see the command-line usage for the time operation, type the following at the command line:

    netdom time /help

Sample Usage

netdom time /d:masterdom resourcedom

Netdom trust

Establishes, verifies, or resets a trust relationship between domains.

One Step netdom trust TrustingDomainName /d: TrustedDomainName [/ud:[Domain\]User] [/pd:{Password|*}] [/uo: User] [/po:{Password|*}] [/verify] [/reset] [/passwordt: NewRealmTrustPassword] [/add [/realm]] [/remove [/force]] [/twoway] [/kerberos] [/transitive[:{YES|NO}]] [/verbose]

Parameters

TrustingDomainName
Specifies the name of the trusting domain.
/d: TrustedDomainName
Specifies the name of the trusted domain. If the parameter is omitted, then the domain that the current computer belongs to is used.
/uo: User
Specifies the user account that makes the connection with the trusting domain. If this parameter is omitted, the current user account is used.
/po:{Password|*}
Specifies the password of the user account that is specified in the /uo parameter. Use * to be prompted for the password.
/verify
Verifies the secure channel secrets upon which a specific trust is based.
/reset
Resets the trust secret between trusted domains or between the domain controller and the workstation.
/passwordt: NewRealmTrustPassword
Specifies a new trust password. This parameter is valid only with the /add parameter and only if one of the domains specified is a non-Windows Kerberos realm. The trust password is set on the Windows domain only, which means that credentials are not needed for the non-Windows domain.
/add
Specifies to create a trust.
/realm
Indicates that the trust is created to a non-Windows Kerberos realm. The /realm parameter is valid only with the /add and /passwordt parameters.
/remove
Specifies to break a trust.
/force
Removes both the trusted domain object and the cross-reference object for the specified domain from the forest. This is used to clean up decommissioned domains that are no longer in use and were not able to be removed by using the Active Directory Installation wizard. This can occur if the domain controller for that domain was disabled or damaged and there were no domain controllers or it was not possible to recover the domain controller from backup media. This parameter is valid only when the /remove parameter is specified.
/twoway
Specifies to establish a two-way trust relationship rather than a one-way trust relationship.
/kerberos
Specifies to exercise the Kerberos protocol between a workstation and a target domain. This parameter is valid only when the /verify parameter is specified.
/transitive[:{YES|NO}]
Specifies whether to set a transitive or nontransitive trust. This parameter is valid only for a non-Windows Kerberos realm. Non-Windows Kerberos trusts are created as nontransitive. If a value is omitted, then the current transitivity state is displayed.
Value | Description
YES | Sets the realm to a transitive trust.
NO | Sets the realm to a nontransitive trust.
/verbose
Specifies verbose output. By default, only the result of the operation is reported. If /verbose is specified, the output lists the success or failure of each transaction necessary to perform the operation as well as returning an error level based on the success (0) or failure (1) of the operation.

Remarks

  • To see the command-line usage for the trust operation, type the following at the command line:

    netdom trust /help

Sample Usage

netdom trust /d:masterdom resourcedom

Netdom verify

Verifies the secure connection between a workstation and a domain controller.

One Step netdom verify Computer /d: Domain [/uo: User /po:{Password|*}] [/verbose]

Parameters

Computer
Specifies the name of the computer whose secure connection is verified.
/d: Domain
Specifies the domain with which to verify the secure connection. If the parameter is omitted, then the domain that the current computer belongs to is used.
/uo: User
Specifies the domain with which to verify the secure connection. If this parameter is omitted, the current user account is used.
/po:{Password|*}
Specifies the password of the user account that is specified in the /uo parameter. Use * to be prompted for the password.
/verbose
Specifies verbose output. By default, only the result of the operation is reported. If /verbose is specified, the output lists the success or failure of each transaction necessary to perform the operation as well as returning an error level based on the success (0) or failure (1) of the operation.

Remarks

  • To see the command-line usage for the verify operation, type the following at the command line:

    netdom verify /help

Sample Usage

netdom verify /d:resourcedom yourwksta


NetDom Examples
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Workstation or member server sample usage

Add a workstation or member server to a domain

To add the workstation mywksta to the Windows NT 4.0 domain reskita, type the following at the command line:

netdom add /d:reskita mywksta /ud:mydomain\admin /pd:password

To add the workstation mywksta to the Windows 2000 domain devgroup.microsoft.com in the organizational unit (OU) Dsys/workstations, type the following at the command prompt:

netdom add/d:devgroup.microsoft.commywksta/OU:OU=Dsys,OU=Workstations,DC=microsoft,DC=com

Note

  • If the /ou parameter is not specified, the account is created in the Computers container.

Join a workstation or member server to a domain

To join mywksta to the devgroup.microsoft.com domain in the Dsys/workstations organizational unit, type the following at the command prompt:

netdom join/d:devgroup.microsoft.commywksta/OU:OU=Dsys,OU=Workstations,DC=microsoft,DC=com

Besides adding the computer account to the domain, the workstation is modified to contain the appropriate shared secret to complete the join operation.

Remove a workstation or member server from a domain

To remove mywksta from the mydomain domain and make the workstation a part of a workgroup, type the following at the command prompt:

netdom remove /d:mydomain mywksta /ud:mydomain\admin /pd:password

Move a workstation or member server from one domain to another

To move mywksta from its current domain into the mydomain domain, type the following at the command prompt:

netdom move /d:mydomain mywksta /ud:mydomain\admin /pd:password

If the destination is a Windows 2000 domain, the Security ID history (SIDHistory) for the workstation is updated, retaining the security permissions that the computer account had previously.

Reset the secure channel for a workstation, member server, or Windows NT 4.0 BDC

To reset the secure channel secret maintained between mywksta and devgroup.microsoft.com (regardless of OU), type the following at the command prompt:

netdom reset /d:devgroup.microsoft.com mywksta

To reset the secure channel between the Windows NT 4.0 PDC for Northamerica and the backup domain controller NABDC:

netdom reset /d:Northamerica NABDC

Force a secure channel session between a member and a specific domain controller

Members often establish secure channel sessions with nonlocal domain controllers. To force a secure channel session between a member and a specific domain controller, use the /server parameter with the reset operation:

netdom reset /d:devgroup.microsoft.com mywksta /Server:mylocalbdc

Verify a workstation or member server secure channel

To verify the secure channel secret maintained between mywksta and devgroup.microsoft.com, type the following at the command prompt:

netdom verify /d:devgroup.microsoft.com mywksta

Domain trust sample usage

Establish a trust relationship

When used with the trust operation, the /d: Domain parameter always refers to the trusted domain.

To set the Windows NT 4.0 resource domain USA-Chicago to trust the Windows NT 4.0 account domain Northamerica, type the following at the command prompt:

netdom trust /d:Northamerica USA-Chicago /add /Ud:Northamerica\admin /Pd:* /Uo:USA-Chicago\admin /Po:*
>Password for Northamerica\admin: xxxx

>Password for USA-Chicago\admin:yyyy

The user must have credentials for both domains. The /pd parameter can be used to specify the password for Northamerica\admin and the /po parameter can be used to specify the password for USA-Chicago\admin. If passwords are not provided on the command line, the user is prompted for both.

To use the /twoway parameter to specify a two-way trust, type the following at the command prompt:

netdom trust /d:marketing.microsoft.com engineering.microsoft.com /add /twoway /Uo:admin@engineering.microsoft.com /Ud:admin@marketing.microsoft.com

Establish a trust relationship with a non-Windows Kerberos realm

To establish a one-way trust where Northamerica trusts the non-Windows Kerberos realm ATHENA, type the following at the command prompt:

netdom trust /d:ATHENA Northamerica /add /PT:password /realm

The /d parameter specifies the trusted domain and the /realm parameter indicates that this is a non-Windows Kerberos realm. The order of the domains is not important. Credentials to the Windows 2000 domain can be supplied if needed. Note that verifying a specific trust relationship usually requires credentials, unless the user has domain administrator privileges on both domains.

To set the Kerberos realm ATHENA to trust the Northamerica domain, type the following at the command prompt:

netdom trust /d:Northamerica ATHENA /add

To make the trust two-way, you can specify the /twoway parameter.

To change the trust from ATHENA to Northamerica to transitive (non-Windows Kerberos trusts are created nontransitive), type the following at the command prompt:

netdom trust Northamerica /d:ATHENA /trans:yes

To display the transitive state, type the following at the command prompt:

netdom trust Northamerica /d:ATHENA /trans

The order of the two domains above is not important. Either can be the non-Windows Kerberos domain.

Break a trust relationship

To undo the trust that USA-Chicago has for Northamerica, type the following at the command prompt:

netdom trust /d:Northamerica USA-Chicago /remove

To break a two-way trust relationship, type the following at the command prompt:

netdom trust /d:marketing.microsoft.com Engineering.microsoft.com /remove /twoway /Uo:admin@engineering.microsoft.com /Ud:admin@marketing.microsoft.com

Verify a specific trust relationship

To verify the one-way trust that USA-Chicago has for Northamerica, type the following at the command prompt:

netdom trust /d:Northamerica USA-Chicago /verify

To verify a two-way trust between the Northamerica and Europe domains, type the following at the command prompt:

netdom trust /d:Northamerica EUROPE /verify /twoway

The /verify parameter checks that the appropriate shared secrets are synchronized between the two items involved in the trust.

Reset a specific trust relationship

To reset the secure channel for the one-way trust between Northamerica and USA-Chicago, type the following at the command prompt:

netdom trust /d:Northamerica USA-Chicago /Ud:Northamerica\admin /reset

The /reset parameter synchronizes the appropriate shared secrets if they are not already synchronized.

Verify Kerberos functionality

To verify Kerberos authentication between a workstation and a service located in the domain devgroup.microsoft.com, type the following at the command prompt:

netdom trust /d:devgroup.microsoft.com /verify /KERBEROS

When you use the netdom trust operation with the /verify /kerberos parameters, it seeks a session ticket for the Kerberos Admin service in the target domain. If successful, you can conclude that all Kerberos operations (for example KDC referrals) are operating correctly between the workstation and the target domain.

Note

  • The operation cannot be executed remotely. It must be run on the workstation being tested.

Domain Query Sample Usage

View domain membership

To list all the workstations in the domain Northamerica, type the following at the command prompt:

netdom query /d:Northamerica WORKSTATION

To list all of the servers in Northamerica, type the following at the command prompt:

netdom query /d:Northamerica SERVER

To list all the domain controllers in the domain Northamerica, type the following at the command prompt:

netdom query /d:Northamerica DC

To list all of the OUs in devgroup.microsoft.com, type the following at the command prompt:

netdom query /d:devgroup.microsoft.com OU

To list the PDC for Northamerica, type the following at the command prompt:

netdom query /d:Northamerica PDC

To list the current PDC emulator for devgroup.microsoft.com, type the following at the command prompt:

netdom query /d:devgroup.microsoft.com FSMO

Secure channel batch repair

You can use the query operation with the /verify and /reset parameters to perform these operations all together. The output of the query operation can be piped to the netdom verify or netdom reset operation.

To list all servers and verify secure channel secret, type the following at the command prompt:

netdom query /d:Northamerica SERVER /verify

To list all workstations and reset any unsynchronized secure channel secrets, type the following at the command prompt:

netdom query /d:Northamerica WORKSTATION /reset

View domain trusts

To view all the direct trust relationships for the domain Northamerica, type the following at the command prompt:

netdom query /d:Northamerica /Ud:Northamerica\admin DOMAIN /Direct

To view all the direct and indirect trust relationships for the domain Northamerica, type the following at the command prompt:

netdom query /d:Northamerica /Ud:Northamerica\admin DOMAIN

To view all trust relationships and check their status, type the following at the command prompt:

netdom query /d:devgroup.microsoft.com DOMAIN /verify

Domain Time Sample Usage

View domain controller time status

To verify the current time for all domain controllers in devgroup.microsoft.com, type the following at the command prompt:

netdom TIME /d:devgroup.microsoft.com

To verify the time for a specific server, type the following at the command prompt:

netdom TIME /d:devgroup.microsoft.com dc1.devgroup.microsoft.com

Synchronize time

To resynchronize a specified domain controller or all domain controllers that are out of synch, type the following at the command prompt:

netdom TIME /d:devgroup.microsoft.com /synch

To specify a domain controller, type the following at the command prompt:

netdom TIME /d:devgroup.microsoft.com dc1.devgroup.microsoft.com /synch

Rename the domain name for a Windows NT 4.0 BDC

Changing the name of a Windows NT 4.0 domain requires a series of complex processes:

  1. Rename the domain name on the Windows NT 4.0 PDC.
  2. Modify all Windows NT4.0 BDCs.
  3. Rejoin all members (workstations and servers).
  4. Delete and re-establish all trusts.

The following NetDom syntax is provided to support the modifications necessary to rejoin a BDC to the renamed domain (step 2 above):

netdom rename /d: NewDomainName BDCServer


Nltest.exe: NLTest
Overview | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool helps perform network administrative tasks. You can use NLTest to:

  • Get a list of primary domain controllers (PDCs).
  • Force a shutdown.
  • Query and check the status of trust.
  • Test trust relationships and the state of domain controller (DC) replication in a Windows domain.
  • Force a user-account database to synchronize on Windows NT 4.0 or earlier domain controllers. (Windows 2000 domain controllers use a completely different mechanism for maintaining user accounts.)

Notes

  • You must run NLTest from the command window.

Corresponding UI

There is no corresponding user interface for NLTest.

Concepts

When the word "trust" is used in the context of Windows, it describes a relationship between two Windows domains. Each domain takes the roles of either the trusting domain or the trusted domain. For any given trust relationship, there is a single discrete communication channel between each domain controller in the trusting domain and a domain controller in the trusted domain.

For example, if domain A trusts domain B, then B is the trusted domain and A is the trusting domain. In another example, suppose domain I trusts domain J and domain J trusts domain I. In this example, there are two distinct trust relationships between their domain controllers. Often this is called the "complete trust" mode, or a two-way trust. Yet for secure channel diagnosis, it is best to think of these as two separate secure channels between each domain controller in the trusting domain and a domain controller in the trusted domain.

Trust relationships are not transitive. For example, suppose domain X trusts domain Y, which in turn trusts domain Z. This does not imply domain X trusts domain Z. The reason for this is that the administrator in each domain must grant explicit permission on either side of the trust relationship.

Another form of trust relationship is sometimes referred to as an "implicit" trust. In a single domain model or in an environment where there are no "explicit" trust relationships between any two domains, the implicit trust relationship is active and functionally needed. This implicit trust exists between any Windows-based computer that is a member of a domain and a domain controller in its domain. Explicit trust relationships are established by using User Manager For Domains. Implicit trust relationships are established by becoming a member of a domain. Implicit trusts are also esablished between domains that are members of the same forest.

NLTest can be used to test the trust relationship between a Windows-based computer that is a member of a domain and a domain controller where its computer account resides. NLTest can also verify the trust between the BDCs in a domain and their PDC. In domains where an explicit trust has been defined, NLTest can test the trust relationship between all domain controllers in the trusting domain and a domain controller in the trusted domain.

These sessions of communication are called secure channels and are used to authenticate computer accounts. They also are used to authenticate user accounts when a remote user connects to a network resource and the user account exists in a trusted domain. This is called pass-through authentication, and it allows a Windows-based computer that has joined a domain to have access to the user account database in its domain and in any trusted domains.

For Windows XP Professional, NLTest no longer uses the Browser service to enumerate domain controllers. Rather, the /dclist option calls the DsGetDomainControllerInfo API to get the list from the directory service.

All of these trust relationships and domain synchronization can be monitored, tested, and verified by NLTest.

System Requirements

The following are the system requirements for NLTest:

  • Windows XP Professional

Files Required

  • Nltest.exe


NLTest Syntax
Overview | Syntax | Examples | Related Tools Open Command Prompt

NLTest uses the following syntax:

One Step nltest [Option1] [Option2] ...

Parameters

Option can be any of the following. (Parameters are not case -sensitive.)

/server: ServerName
Runs NLTest at the specified remote computer. If this parameter is not specified, the command is executed from the local computer.
/query
Queries the local server or the server specified in /server: ServerName for a healthy secure channel to a domain controller and for the status of directory service replication with the primary domain controller (PDC). This can help to determine the general status of the Netlogon service.
/repl
Forces partial synchronization of backup domain controller (BDC) of the local server or the server specified in /server: ServerName.
/sync
Forces a full, immediate synchronization of the BDC of the local server or the server specified in /server: ServerName.
/pdc_repl
Forces a UAS change message from the PDC of the local server or the server specified in /server: ServerName to all BDCs.
/sc_query: DomainName
Queries and verifies the secure channel in the specified domain for a local or remote Windows XP Professional-based computer. This can be executed for a PDC if an explicit trust relationship exists between two domains and the trusted domain is specified.
/sc_reset: DomainName
Resets the secure channel between the local or remote Windows XP Professional-based computers. This can be executed for a PDC if an explicit trust relationship exists between two domains and the trusted domain is specified.
/sc_verify: DomainName
Verifies the secure channel for DomainName on the server specified in /server: ServerName.
/sc_change_pwd: DomainName
Changes a secure channel password for DomainName (on ServerName, if specified with /server: ServerName).
/dclist: DomainName
Lists all domain controllers, PDC, and BDCs for DomainName.
/dcname: DomainName
Lists the primary domain controller for DomainName.
/dsgetdc: DomainName
Calls DsGetDcName /PDC /DS /DSP /GC /KDC /TIMESERV /GTIMESERV /NETBIOS /DNS /IP /FORCE /WRITABLE /AVOIDSELF /SITE:SiteName /ACCOUNT:AccountName /RET_DNS /RET_NETBIOS.
Each of these flags maps to a particular flag bit passed to DsGetDcName. For more information, see the DsGetDcName documentation in the Platform SDK.
/dnsgetdc: DomainName
Calls DsGetDcOpen /Next /Close /PDC /GC /KDC /WRITABLE /LDAPONLY /FORCE /SITESPEC.
/dsgetfti: DomainName
Calls DsGetForestTrustInformation /UPDATE_TDO.
/dsgetsite
Calls DsGetSiteName.
/dsgetsitecov
Calls DsGetDcSiteCoverage.
/parentdomain
Gets the name of the parent domain of this machine.
/dsderegdns: DnsHostName
Deregisters DNS host records /DOM: /DOMGUID: /DSAGUID:.
/dsgetsite
Calls DsGetSiteName.
/dsgetsitecov
Calls DsGetDcSiteCoverage.
/whowill: Domain/User
Queries the domain and indicates which domain controller has the account in its local user account database. This is useful in determining if a given domain controller contains the user account. If the user name specified is that of the currently logged on user, the user's current password is not sent to the domain controller. This helps to determine whether duplicate accounts exist across several domains.
/finduser: User
Queries explicit trusted domains for User. This is useful when determining what trusted domain controller or what trusted domain out of several trusted domains will authenticate a user's credentials when a domain name is not specified in the SMB packet. Many clients, such as Windows for Workgroups version 3.1 and the real-mode redirector in Windows 95, do not specify a domain name.
/transport_notify
Notifies Netlogon of a new transport.
/dbflag: HexadecimalFlags
Sets a new debug flag. For most purposes, use 0x2000FFFF as the value for HexadecimalFlags. The entry in the Windows XP registry for debug flags is HKLM\System\CurrentControlSet\Services\Netlogon\Parameters\DBFlag.
/user: UserName
Displays many of the attributes for the specified user account that are maintained in the user account database.

Note

  • This parameter does not work for Windows 2000 domain controllers. It does work for Windows NT 4.0 and earlier domain controllers, and for Windows 2000 and Windows NT 4.0 and earlier workstations and servers.
/time: HexadecimalLSL HexadecimalMSL
Converts Windows NT GMT time to ASCII.
HexadecimalLSL is a hexadecimal value for least significant longword. HexadecimalMSL is a hexadecimal value for most significant longword.
/logon_query
Queries the cumulative number of logon attempts at the console or over the network.
/parentdomain
Gets the name of the parent domain of this computer.
/domain_trusts
Queries for trusted domains (on ServerName, if specified with /server: ServerName) /PRIMARY /FOREST /DIRECT_OUT /DIRECT_IN /ALL_TRUSTS /V.
/dsregdns
Forces registration of all DC-specific DNS records.
/dsquerydns
Queries the status of the last update for all DC-specific DNS records.
/bdc_query: DomainName
Queries for a list of backup domain controllers in DomainName and displays their state of synchronization and replication status.
/sim_sync: DomainName MachineName
Simulates full synchronization replication.
/list_deltas: FileName
Displays the contents of the change log file FileName, which lists changes to the user account database. Netlogon.chg is the default name.
/cdigest: Message /domain: DomainName
Gets a client digest.
/sdigest: Message /rid: RID_In_Hexadecimal
Gets server digest.
/shutdown: Reason [Seconds]
Shuts down local computer or ServerName for Reason, a string, after Seconds, an integer. For a complete description, see the Platform SDK documentation for InitiateSystemShutdown.
/shutdown_abort
Terminates a system shutdown.
/?
Displays command-line help.

Examples

See Example 1: Verify DCs in a Domain, Example 2: Advanced Information About Users, Example 3: Verify Trust Relationship with a Specific Server, Example 4: Determine the PDC Emulator for a Domain, and Example 5: Show Trust Relationships for a Domain.


NLTest Examples
Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Verify DCs in a Domain

In this example, you have just added two DCs to a domain (a-dc2 and a-dc3) and you want to verify that they have actually been added. At the command prompt, type:

C:\Program Files\SupportTools>nltest /dclist:reskita

Output displays similar to the following:

Get list of DCs in domain 'reskita' from '\\A-DCP'.
    a-dcp.reskita.microsoft.com [PDC] [DS] Site: Default-First-Site
    a-dc3.reskita.microsoft.com       [DS] Site: Default-First-Site
    a-dc1.reskita.microsoft.com       [DS] Site: Default-First-Site
    a-dc2.reskita.microsoft.com       [DS] Site: Default-First-Site
The command completed successfully

You can see that the DCs were properly added and are functioning. You can also see that a-dcp is the PDC emulator for the domain.

Example 2: Advanced Information About Users

In this example, you want to find out detailed information about a certain user. At the command prompt, type:

C:\Program Files\SupportTools>nltest /user:"TestAdmin"

Output displays similar the following:

 User: TestAdmin
Rid: 0x3eb
Version: 0x10002
LastLogon: 2ee61c9a 01c0e947 = 5/30/2001 13:29:10
PasswordLastSet: 9dad5428 01c0e577 = 5/25/2001 17:05:47
AccountExpires: ffffffff 7fffffff = 9/13/30828 19:48:05
PrimaryGroupId: 0x201
UserAccountControl: 0x210
CountryCode: 0x0
CodePage: 0x0
BadPasswordCount: 0x0
LogonCount: 0x33
AdminCount: 0x1
SecurityDescriptor: 80140001 0000009c 000000ac 00000014 00000044 00300002 000000
02 0014c002 01050044 00000101 01000000 00000000 0014c002 000f07ff 00000101 05000
000 00000007 00580002 00000003 00240000 00020044 00000501 05000000 00000015 22cd
b7b4 7112b3f1 2b3be507 000003eb 00180000 000f07ff 00000201 05000000 00000020 000
00220 00140000 0002035b 00000101 01000000 00000000 00000201 05000000 00000020 00
000220 00000201 05000000 00000020 00000220
AccountName: Test Administrator
Groups: 00000201 00000007
LmOwfPassword: fb820c9c 5c7e7e09 ee58593b d959c681
NtOwfPassword: d82959cc 81a342ac df600c37 4e58a478
NtPasswordHistory: 00010001
LmPasswordHistory: 00010001
The command completed successfully

The detailed information provided can be used to troubleshoot many issues.

Example 3: Verify Trust Relationship with a Specific Server

In this example, you want to verify that the server a-dc1 has a valid trust relationship with the domain. At the command prompt, type:

C:\Program Files\SupportTools>nltest /query /server:a-dc1

Output displays similar to the following:

Flags: 0
Connection Status = 0 0x0 NERR_Success
The command completed successfully

You see that the command completed with NERR_Success status, so the trust relationship is valid and working.

Example 4: Determine the PDC Emulator for a Domain

In this example, you want to determine which DC in your domain the Windows NT 4.0-based computers are looking to as the PDC. At the command prompt, type:

C:\Program Files\SupportTools>nltest /dcname:reskita

Output displays similar to the following:

PDC for Domain reskita is \\A-DCP
The command completed successfully

You can see that a-dcp is the PDC emulator for your domain.

Example 5: Show Trust Relationships for a Domain

In this example, you want to view the established trust relationships for your domain. At the command prompt, type:

C:\Program Files\SupportTools>nltest /domain_trusts

Output displays similar to the following:

List of domain trusts:
    0: RESKITA reskita.microsoft.com (NT 5) (Forest Tree Root) (Primary Domain)
The command completed successfully

This example shows that one domain is trusting itself and no others.


PPTP Ping: Point to Point Tunneling Protocol Ping Utilities
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Pptpclnt.exe and Pptpsrv.exe are tools that work in unison to verify that the required protocol and port for Point-to-Point Tunneling Protocol (PPTP) are being routed from a PPTP client to a PPTP server or vice versa.

In order for a PPTP client to access a remote PPTP server, all routers in between the two hosts MUST allow traffic to pass through TCP port 1723 (PPTP) and must support protocol type 47. Protocol type 47 is the GRE (Generic Routing Encapsulation) protocol.

PPTP Ping runs on Windows XP Professional, Windows 2000, Windows NT, and Windows 98, but not on Windows 95.

Notes

  • You must run PPTP Ping from the command window.
  • This tool is not meant to test the functionality of a PPTP server or a PPTP client. It is meant to assure that the path between the two hosts goes through TCP port 1723 and uses the GRE protocol (type 47).

Corresponding UI

There is no corresponding user interface for PPTP Ping.

Concepts

Point-to-Point-Tunneling Protocol (PPTP) is a networking technology that supports multiprotocol virtual private networks (VPNs), enabling remote users to access corporate networks securely across the Microsoft Windows operating systems and other Point-to-Point Protocol (PPP)-enabled systems to dial into a local Internet service provider to connect securely to their corporate network through the Internet.

System Requirements

The following are the system requirements for PPTP Ping:

  • Windows XP Professional or Windows 2000 or Windows NT or Windows 98

Files Required

  • Pptpclnt.exe
  • Pptpsrv.exe


PPTP Ping Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

PPTP Ping runs on Windows XP Professional, Windows 2000, Windows NT, and Windows 98, but not on Windows 95. These notes give further information to help you with troubleshooting.

Cannot Connect to PPTP Server

The error message you receive helps to determine what part of the PPTP connection to troubleshoot. When PPTP filtering is enabled, you might receive one of the following error messages:

Error 678: There is no answer

Error 650: The Remote Access Server is not responding

If you receive one of these error messages, disable PPTP filtering and then attempt to ping the PPTP server. To disable PPTP filtering, type the following command on the PPTP server:

   net stop raspptpf

You should now be able to ping the PPTP server over the Internet. If you still receive one of these error messages, the problem might not be a PPTP problem. Until you get replies from the server, you need to troubleshoot this issue as a normal connectivity problem.

If pinging the PPTP server across the Internet successfully returns with replies, the ISP or internal corporate network might not allow Generic Routing Encapsulation (GRE) packets or PPTP packets to go across the firewall or router.

GRE packets are commonly used internally as messages between routers. For example, an ISP might use GRE to distribute routing messages between its sites. For security or other reasons, this ability can be turned off to the outside Internet. You can resolve this problem by ensuring that Protocol 47 is open at the router or firewall. This protocol is required for PPTP to work correctly. In addition to GRE Protocol 47, Port 1723 must be enabled at all routers or firewalls between the PPTP client and server.

An example of a GRE-blocked PPTP call in a trace is shown below. In this case, the ISP uses GRE internally, but does not allow the protocol to be sent to any outside interfaces.

1- 5.364   00 E8 TCP       ....S., len:

2- 5.614   E8 00 TCP       .A..S., len:

3- 5.614   00 E8 TCP       .A ., len: 0, seq: 168021101-168021101,
   ack:    460753,

4- 5.630   00 E8 TCP       .AP..., len: 156, seq: 168021101-168021256,
   ack:    460753,

5- 6.130   E8 00 TCP       .AP..., len:  156, seq:    460753-460908,
   ack:   168021257, win:

6- 6.145   00 E8 TCP       .AP..., len:  168, seq: 168021257-168021424,
   ack:    460909,

7- 6.520   E8 00 TCP       .AP..., len:   32, seq:    460909-460940,
   ack:    168021425, win:

8- 6.536   00 E8 TCP       .AP..., len:   24, seq: 168021425-168021448,
   ack:    460941,

9- 6.536   20 20 LCP       Config Req Packet, Ident = 0x00, Length = 17

10- 6.536  00 E8 LCP       Config Req Packet, Ident = 0x00, Length = 17

11- 6.833  E8 00 ICMP      Destination Unreachable: 198.140.211.122
   See frame 10

12- 6.942  E8 00 TCP       .A...., len:    0, seq:    460941-460941,
   ack:   168021449, win:

In frame 11, a reference states that the destination cannot be reached in frame 10. Looking closely at frame 10, you can see that this packet is actually a GRE packet:

+ FRAME: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP:  DOD Internet Protocol
+ IP: ID = 0xECB3; Proto = 0x2F; Len: 53
+ GRE: ..KS............ Length: 21, Call ID: 0  <<<--Shows that this is a
                                                     GRE packet.
+ PPP: Link Control Protocol Frame (0xC021)
+ LCP: Config Req Packet, Ident = 0x00, Length = 17

The IP address in the IP portion of this frame shows the IP address of the device that does not allow GRE packets past its interface.

Note

  • Some ISPs or corporate firewalls do not allow incoming or outgoing GRE packets. In this case, you see the same "Destination Host Unreachable" packets in the trace, but there are no packets that drill down to GRE.

Timeouts using PPTP

If you receive error 718, "the server has not responded," you might want to increase the number of attempts PPTP makes to transmit data.

You can make this change by editing the registry entry.

Caution

  • Do not edit the registry directly unless you have no alternative. The registry editor bypasses standard safeguards, allowing settings that can degrade performance, damage your system, or even require you to reinstall Windows. You can safely alter most registry settings by using the programs in Control Panel or Microsoft Management Console (MMC). If you must edit the registry directly, back it up first. Read the Registry Editor Help for more information.

To increase PPTP data retransmissions

  1. Run Registry Editor (Regedt32.exe).

  2. Go to the following key in the registry:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Paramters

  3. On the Edit menu, click Add Value and create the following entry. (If the entry already exists, double-click it to edit the value.)

    Value Name: PPTPTcpMaxDataRetransmissions

    Data Type: REG_DWORD

    Value range: 0 - 0xFFFFFFFF

    Default value: 9h

By default, this value is 9h. You might want to increase this value to 18h. It is not recommended to increase this value beyond 27h.

Dial the IP address and log on to PPTP server

After each computer can connect to its ISP and ping the PPTP server, test logging on to the PPTP server.

Set up a Dial-Up Networking phone book entry to dial the IP address of the PPTP server. When you set up the phone book entry, enter the server IP address in place of a phone number. Dial using RASPPTPM.

If Dial-Up Networking dials but does not connect to the PPTP server, try restarting the Remote Access Server service.

To restart the Remote Access Server service

  1. In Control Panel, double-click Services.

  2. Locate the Remote Access Server service. Stop the service and then start the service.

Confirm dial-in permissions

PPTP requires that the connecting user account have dial-in permissions. Use the Remote Access Admin tool to verify that the user account has the appropriate dial-in permissions.

If a domain is present, the user might need domain permissions to connect to certain resources on the network.

Troubleshooting protocol issues

PPTP can use the NetBEUI, IPX/SPX-compatible, and TCP/IP protocols. The NetBEUI protocol requires the least amount of configuration. Connecting to the PPTP server requires that the client and server have a network protocol in common. Once connected, the PPTP server can act as NetBIOS gateway to the rest of the local area network.

When you are using the TCP/IP protocol, each client needs a unique IP address. IP addresses can be statically assigned to clients, supplied from a pool of IP addresses, or from a DHCP server.

PPTP Ping can be useful in troubleshooting connectivity issues with TCP/IP.

Troubleshoot browsing issues

Avoid browsing My Network Places over a slow connection. Try connecting to the network resource directly.

To connect to a network resource directly

  1. Click Start, and then click Run.

  2. Type the following line, and then click OK:

    \\<server>\<share>

If you can connect using this method, the PPTP session is working properly and the issue is related to browsing.


PPTP Ping Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

PPTP Ping uses the following syntax:

One Step pptpsrv.exe

One Step pptpclnt.exe [ServerNameorIPaddress]

Parameters

ServerNameorIPaddress
Specifies the name or IP address of the server that is running PPTPSrv.


PPTP Ping Examples
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

The following sections cover testing your PPTP connection and sample output.

PPTP Ping runs on Windows XP Professional, Windows 2000, Windows NT, and Windows 98, but not on Windows 95.

Example: Test PPTP Connectivity

For this example, assume there is a PPTP server on site A and a PPTP client on site B. You want to test PPTP connectivity between site A and site B.

To test PPTP connectivity between site A and site B

  1. Run Pptpsrv.exe on a computer on site A. This does not have to be the PPTP server.

    2. Run Pptpsrv.exe

  2. Run Pptpclnt.exe [ServerNameorIPaddress] on site B.

    3. Open command prompt

  3. When prompted by Pptpclnt.exe, type some text to send to Pptpsrv.exe, and then click Enter.

    4. You see the text received at the host running Pptpsrv.exe. You then see five GRE packets sent from Pptpclnt.exe and received at Pptpsrv.exe.

  4. Repeat steps 1-3, this time running Pptpsrv.exe on a host on site B and Pptpclnt.exe on a host on site A. These can, of course, be the same hosts you just used.

Sample output: server side

pptpsrv

Now you must run pptpclnt.exe on remote machine

Waiting for inbound connection on TCP port 1723...
Inbound connection from client has completed successfully!

Data received from client:
---> abcdefghijklmnopqrstuvwxyz

Sending the message 'Reply from server' to the client

=====================================================
Connectivity test to TCP Port 1723 was successful!!!
Closing down socket...
=====================================================

Created socket for GRE protocol test

Listening on PROTOCOL 47 for incoming GRE packets...

Total GRE packets received = 1
Total GRE packets received = 2
Total GRE packets received = 3
Total GRE packets received = 4
Total GRE packets received = 5

======================================
GRE protocol test was successful!
======================================
Closing socket

Sample output: client side

pptpclnt jade

Initializing WinSock...
Obtaining host information...
Successfully resolved server's host information

======================================
Enter data to send to server (up to 255 chrs.), then hit enter:
-->abcdefghijklmnopqrstuvwxyz

Successfully connected to server using TCP port 1723 (PPTP)
Sending data to server jade.dns.microsoft.com

Waiting for a reply to the data which was just sent...
Received a reply.  Reply contains the following text:
---> Hello, there! This is a reply from the server.

=================================
Connectivity test to TCP Port 1723 was successful!!!
Closing down socket...
=================================

Creating a socket to test GRE protocol traffic...

Total GRE packets sent = 1
Total GRE packets sent = 2
Total GRE packets sent = 3
Total GRE packets sent = 4
Total GRE packets sent = 5

=====================================
Check server to see if the GRE packets were received successfully
=====================================
Closing down socket


Snmputilg.exe: SNMP Graphical Query Tool

Overview | Notes | Related Tools Run Tool

This GUI tool allows system administrators to obtain information from SNMP-manageable system on the network. You can use SNMPUtilG to perform the basic SNMP operations (such as GET, GET-NEXT, and SET) from a graphical interface. SNMPUtilG also supports saving SNMP data to the clipboard, as well as saving data to comma-delimited text files.

SNMPUtilG complements the Resource Kit command line tool SNMPUtil.

Caution

  • Although many object identifier values are read-only by default, you should use caution when using the SNMP SET command. Incorrect use of this tool might cause network name resolution or network connectivity problems, adversely impacting performance.

Corresponding UI

SNMPUtilG provides its own user interface.

Concepts

For more information on SNMP, see SNMP defined or Understanding SNMP in the Help and Support Center.

System Requirements

The following are the system requirements for SNMPUtilG:

  • Windows XP Professional
  • Administrator rights on the network

File Required

  • Snmputilg.exe


SNMPUtilG Notes
Overview | Notes | Related Tools Run Tool

Using SNMPUtilG

You can run SNMPUtilG from the Start menu (where it is called SNMP Query Utility), or from the command prompt or Run line (by typing snmputilg).

The tool starts with the loopback address 127.0.0.1, the object identifier .1.3.6.1.2.1, and the "public" community selected. These values can be changed to select another system by IP address, select another object identifier farther down the tree, or select another community as necessary.

If another system IP address is selected, then that system must be running the SNMP service. The target system must also be configured to allow access from the network address from which the tool is run. By default, Windows 2000 allows access from all other IP addresses.

If another community is selected, then the community must exist, and READ privileges must be granted to that community. You can verify and add communities using the SNMP Service. The ability to configure community permissions exists only in systems running Windows XP Professional, Windows 2000 or Windows NT version 4.0 Service Pack 4. The ability to restrict access by IP address exists in all versions of Windows XP, Windows 2000, and Windows NT.

The SNMP Function to Execute drop-down box is used to select the desired operation, followed by selecting the Execute Command button. Functions include:

  • GET the value of the current object identifier

  • GET the NEXT value after the current object identifier (this is the default)

  • GET the NEXT 20 values after the current object identifier

  • GET all values from object identifier down (WALK the tree)

  • WALK the tree from WINS values down

  • WALK the tree from DHCP values down

  • WALK the tree from LANMAN values down

  • WALK the tree from MIB-II down (Internet MIB)

The results are listed on the screen.

The results can be cleared, saved, or updated from the Context menu, which is selected by right-clicking. From the Context menu you can:

  • Copy one or more records to the clipboard

  • Clear contents of the list view now

  • Clear list view after executing each command

  • Requery the currently selected record

  • Dump all records to a comma-delimited text file

  • Edit (SET) the value of this object identifier

Caution

  • Even though many object identifier values are read-only by default, you should use caution when using the SNMP SET command. Incorrect use of this tool might cause network name resolution or network connectivity problems that can adversely impact performance.


Exctrlst.exe

Exctrlst.exe: Extensible Performance Counter List

Overview | Notes | UI | Examples | Related Tools Run Tool

Exctrlst lists all services and applications that provide registry-based performance counters on local and remote Windows 2000 and Windows XP Professional systems. It displays the names and locations of the dynamic link libraries (DLLs) that support performance counters, indicates disabled counters, and lets you enable and disable the performance counters for a service.

Unlike most performance tools, which load performance counters in order to collect data, Exctrlst displays information directly from the Performance subkeys in the registry (HKLM\SYSTEM\CurrentControlSet\Services\ServiceName\Performance. As a result, Exctrlst lists all registered performance DLLs, even those that do not load or operate properly.

Performance counter developers can use this tool to find the DLLs, basic functions, and indexes of performance counters provided by a service. Administrators can use this tool to determine which services have installed performance counters on the system and to identify counters that are disabled or do not load properly.

Exctrlst displays the following information about performance counters:

  • Services and applications that provide performance counters
  • Names and locations of performance counter DLLs
  • Enabled and disabled performance counters
  • Indexes of performance objects, counter names, and help text provided by the service
  • Names of the open, collect, and close procedure of each counter DLL
  • The highest index on the system used for performance counters and their help text.

Files required

  • Exctrlst.exe


Exctrlst.exe: Notes

Exctrlst Notes
Overview | Notes | UI | Examples | Related Tools Run Tool

Exctrlst Data Source

Exctrlst displays data directly from the Performance subkeys in the registry (HKLM\SYSTEM\CurrentControlSet\Services\ServiceName\Performance). A Performance subkey is created when a service, application, or device registers a performance DLL.

Exctrlst provides a complete list of all performance counter DLLs registered on the system, including counter DLLs that do not load or operate properly, and disabled counter DLLs. Exctrlst is often used with tools that attempt to load and run the performance counters, such as Showperf.exe, a Windows XP Support Tool. By comparing the list of all counter DLLs in Exctrlst with the list of operating counter DLLs in Showperf, you can detect counters that are not loading or operating properly.

Extensible Performance Counters

In Windows NT and earlier systems, Exctrlst only displayed information about extensible performance counters, that is, custom counters that are not built into the operating system. However, in Windows 2000 and Windows XP Professional, system counters and extensible counters are loaded and stored in the registry in the same way, and Exctrlst displays both types.

Performance Counters for a Service

Each performance counter DLL can support counters for one or more components and services. In the registry and, therefore, in Exctrlst, each DLLs is listed in the subkey of the service that installed it.

System Counters

System counters are the performance counters that are built into the operating system. These counters appear in Exctrlst and you can use Exctrlst to enable and disable the system counters. However, because system counter names and explain text are not stored and accessed through the registry, their indexes appear as 0x0 or N/A in Exctrlst.

In Windows XP Professional, system counters are defined in the following libraries and drivers.

Service | Library | Objects
PerfOS | PerfOs.dll | Cache, Memory, Object, Paging File, Processor, System
PerfDisk | PerfDisk.dll | LogicalDisk, PhysicalDisk
PerfNet | PerfNet.dll | Browser, Redirector, Server
PerfProc | PerfProc.dll | Job Object, Job Object Details, Process, Thread, Thread Details
Spooler | Winspool.drv | Print Queue
TapiSrv | TapiPerf.dll | Telephony
Tcpip | Perfctrs.dll | IP, ICMP, NBT Connection, Network Interface, TCP, UDP

WMI Performance Counters

Exctrlst lists all registry-based performance counter DLLs, including counter DLLs that are loaded by using the Windows Management Instrumentation High-Performance provider, Wbemperf.dll. However, because native WMI performance counters do not create Performance subkeys in the registry, Exctrlst cannot display information about these counters.

Monitoring Remote Computers

You can use Exctrlst to view the performance counters installed on remote computers. However, you must have permission to read the required files, you must have permission to read from the registry remotely, and the Remote Registry Service must be running on the remote computer. In order to enable or disable performance counters, you must also have permission to set values in the registry. For detailed instructions on configuring remote permissions, see Monitoring Remote Computers in the Windows XP Professional Resource Kit.

If Exctrlst cannot connect to a remote computer (for any reason), then it continues to monitor the computer that was monitoring before the new computer name was entered. The name in the Machine Name box reverts to the name of the previously monitored computer, but Exctrlst does not display an error message.

Disabled Performance Objects

You can use Exctrlst to determine whether the performance counters for a service are enabled or disabled, and to enable and disable the performance counters for a service.

The system disables performance counters automatically when the performance counter DLL for a service does not pass the reliability tests that the system runs when it loads a counter in System Monitor or another performance monitoring tool.

Typically, users disable counters during testing or to prevent a malfunctioning counter DLL from loading. After replacing or repairing a counter DLL, you can use Exctrlst to re-enable the counters.

To disable the performance objects for a service, the system adds the Disable Performance Counters registry entry to the Performance subkey for the service (HKLM\SYSTEM\CurrentControlSet\Services\ServiceName\Performance) and sets the value of the entry to 1.

To re-enable performance objects after the DLL is replaced or repaired, use Exctrlst, or set the value of the Disable Performance Counters registry entry to 0 or delete the entry.

For more information about the Disable Performance Counters registry entry, see the Registry Reference in the Windows XP Professional Resource Kit.

For more information

For information about counter types and for descriptions of the performance counters installed on Windows XP Professional, see the Performance Counter Reference at the Microsoft Resource Kits Web site (http://go.microsoft.com/fwlink/?LinkId=289).

For information about the run-time reliability tests for performance counters, and to customize the tests for your system, search for "Configuration Flags" in the Registry Reference at the Microsoft Resource Kits Web site (http://go.microsoft.com/fwlink/?LinkId=289).

For instructions on writing performance counter DLLs and loading performance counter data in the registry, see Adding Performance Counters in the Platform Software Development Kit (SDK) (http://go.microsoft.com/fwlink/?LinkId=1843).

For a list of performance counters that load and operate correctly, use Showperf, a Windows Support Tool.

To list the performance counters on a local or remote system from the command line, use Typeperf, a tool included in Windows XP Professional. Typeperf lists only the counters that are enabled and load and operate properly.

To see a graphic display of performance counter data, use System Monitor. To run System Monitor, at the command prompt or in the Run dialog box, type Perfmon.

Tip

Event Viewer is one of the most valuable tools for diagnosing problems with performance counters. When the system detects a serious error in a performance counter DLL, it disables the counter and records Event 1016 in the Application Log in Event Viewer. If a performance counter does not appear in System Monitor, or if it does not operate properly, check the Application log for events generated by Perflib.


Exctrlst.exe: Dialog Box Operation

Exctrlst User Interface
Overview | Notes | UI | Examples | Related Tools Run Tool

Exctrlst displays all registry-based performance counters installed on the system.

Exctrlst dialog box

Exctrlst dialog box

To run Exctrlst

  • At the command prompt or in the Run dialog box, type Exctrlst.

To configure Exctrlst

  1. Select a computer.

    2. The Machine Name box displays the name of the computer being monitored. The default is the local computer.

    To monitor a remote computer, delete the name in the Machine Name box, type the name of the remote computer (preceded by backslashes), and click Refresh.

  2. Select a sort order.

    3. Click a button in the Sort Order section to sort the items in the Extensible Performance Counters box.

    • Library File. Lists the performance DLLs installed on the system and the service that supports each DLL. The list is sorted in alphabetical order by service name.
    • Service. Lists the services that have installed performance DLLs and the name and location of the DLL for each service. The list is sorted in alphabetical order by the fully qualified path to the DLL.
    • Counter ID. Lists the services that have installed performance DLLs and the starting index for the performance object installed by the service. The list is sorted in numerical order by index.

      • This starting index is the location of the performance object in the performance registry (HKEY_PERFORMANCE_DATA). Each object is assigned a range of indices within which it stores the counter names and explain text for the object.

      Note

      • Performance objects that the system installs do not store their counter names in the performance registry. The index for these objects appears as 0x0 or N/A.
  3. Select a service or DLL.

    4. The Extensible Performance Counters box displays a list of all registry-based performance DLLs on the system.

    Clicking an item in the Extensible Performance Counters displays information about the item in the fields below the box.

  4. View, select or clear the Performance Counters Enabled check box.

    5. The Performance Counters Enabled check box indicates whether the performance counters for the service are enabled or disabled.

    • To disable all performance counters for a service, clear the check box, and then click Refresh.
    • To enable all performance counters for a service, select the check box, and then click Refresh.

    The system automatically disables all performance counters for a service if the performance DLL fail the system's run-time reliability tests for performance DLLs. For more information, see Disabled Performance Objects in Exctrlst Notes.

To interpret the Exctrlst display

The following tables list and describe the fields in the Exctrlst dialog box.

  • The system data in the upper section of the dialog box comes from the Perflib subkey in the registry.
    • Item | Description
Last System Counter ID | Displays the highest index used to store a counter name, as recorded by the Performance Library (Perflib). Must match the value of Last Counter Text ID. This field displays the value of the Last Counter registry entry (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Last Counter).
Last Counter Text ID | Displays the highest index actually used to store a counter name. This value is derived from the highest index used in the Counter registry entry (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\LanguageCode\Counter).
Last System Help ID | Displays the highest index used to store explain text for a counter, as recorded by the Performance Library (Perflib). Must match the value of Last Help Text ID. This field displays the value of the Last Help registry entry (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Last Help).
Last Help Text ID | Displays the highest index actually used to store explain text. This value is derived from the highest index used in the Help registry entry (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\LanguageCode\Help).
  • The DLL-specific data in the lower section of the dialog box comes from the Performance subkeys in the registry. This data changes when you select an item from the Extensible Performance Counters dialog box.
    • Item | Description
DLL Name | Displays the name and fully qualified path of the DLL that provides performance data for this service. If the system cannot find the DLL file in this path, the registry records an error in the Application Log in Event Viewer.
Open Procedure | Displays the name of the DLL function that initializes the performance collection features of the service. The open procedure must be exported by the DLL and it must return a successful status. Otherwise, the registry cannot collect performance data from this service. If this function is not found in the DLL or if it returns an error, the registry records an error in the Application Log in Event Viewer.
Collect Procedure | Displays the name of the DLL function that collects the performance data for the service. The registry calls the collect function when a performance tool, such as System Monitor, requests performance data. If this function cannot be found in the DLL, the registry records an error in the Application Log in Event Viewer.
Close Procedure | Displays the name of the DLL function that terminates and completes the performance data collection features of the service. The registry calls the close function when a performance tool, such as System Monitor, closes the registry interface. If this function cannot be found in the DLL, or if has a fault or causes an error, the registry records an error in the Application Log in Event Viewer.
Counter ID Range | Displays the range of index values that were assigned to the service to store counter names. The values shown here must match the indices actually used, as shown in the value of the Counter registry entry (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\LanguageCode\Counter). N/A is displayed for system counters, which do not store counter names in the registry. If the value is Not Found, then the counters were not installed properly and will not appear correctly in tools such as System Monitor.
Help ID Range | Displays the range of index values that were assigned to the service to store explain text for its counters. The values shown here must match the indices actually used, as shown in the value of the Help registry entry (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\LanguageCode\Help). N/A is displayed for system counters, which do not store explain text in the registry. If the value is Not Found, then the counters were not installed properly and will not appear correctly in tools such as System Monitor.


Exctrlst.exe: Examples

Exctrlst Examples
Overview | Notes | UI | Examples | Related Tools Run Tool
Example 1: Find the performance objects installed on a remote computer.
Example 2: Find a missing performance object.
Example 3: Re-enable performance counters.
Example 4: Find the performance objects for a service.

Example 1: Find the performance objects installed on a remote computer.

The following procedure uses Exctrlst to find the performance counter objects installed on a remote computer, RK-USER-16. You can use this procedure to determine whether the performance features are installed correctly on a user's system, and you can use the information as an indirect indication of whether a service is installed on the user's system.

In this case, a user is complaining that they cannot monitor the Terminal Services performance counters. You have verified that the counters do not appear in System Monitor.

  1. Start Event Viewer, connect to the RK-USER-16 computer, and search the Application Log for events recorded by Perflib. In this case, none of the events report a problem with the Terminal Services counters.
  2. Start Exctrlst.
  3. In the Machine Name box, type RK-USER-16 , and then click Refresh.
  4. In the Sort Order section, click Service.

The Extensible Performance Counter box now lists all of the performance counters installed on the remote computer. In this case, the Terminal Services service, TermService service and its DLL, perfts.dll, do not appear in the list. This indicates that Terminal Services performance counters are not installed on the user's computer.

Tip

  • You cannot copy or export a list from Exctrlst. However, you can use Regfind, a command-line tool in the Windows 2000 Server Resource Kit, to list all services that have installed performance counters on a system.

    At the command prompt, type:

    regfind "Performance" -n -p HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services > PerfServices.txt

    This command creates a file called PerfServices.txt with the names of all services that have Performance subkeys in the registry. It also lists occurrences of the Disable Performance Counters registry entry and its value.

Example 2: Find a missing performance object

The following procedure determines why the performance object for a fictitious service, Reskit, does not appear in System Monitor. This procedure compares performance object lists from Exctrlst and Showperf, a Windows Support Tool. Because Showperf only displays objects that load and run properly, objects that appear in Exctrlst but not in Showperf are likely to have errors.

  1. Check the Application Log in Event Viewer for events recorded by Perflib. When a counter DLL fails the system's reliability tests or does not install properly, Perflib records errors in the log.

    2. In this case, there are no events pertaining to the Reskit service.

  2. Use Exctrlst to verify that the counter is installed on the system.

    3. If a counter does not appear in the Exctrlst display, then it is not installed or properly registered in the system. In this case, the Reskit service is listed in Exctrlst, and its performance counter DLL, Reskit.dll, is listed in its proper location.

  3. Use Exctrlst to determine whether the counter DLL for the Reskit service is disabled.

    4. In this case, when you click the Reskit service item, the Performance Counters Enabled check box is checked, indicating that the Reskit service performance DLL passed the system's run-time reliability tests.

  4. Use Showperf to load the performance counters on the system. Then, look for the Reskit performance object in the Showperf Object drop-down list.

    5. In this case, the object does not appear in the list. This indicates that the Reskit performance DLL passed the basic reliability tests, but does not load properly in Showperf. This rare situation occurs when a DLL has a fault that is not evident in basic testing but appears later, such as when the service is stressed by high use or retrieves extreme data values not anticipated in the program design.

Counter DLLs might also be enabled but not load properly in Showperf because one or more of the run-time reliability tests have been turned off, or because the system is prevented from disabling performance counters that fail its tests. To check for this occurrence, find the value of the Configuration Flags registry entry (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Configuration Flags). The default value, which permits the system to disable faulty counters, is 0x10.

For information about the Configuration Flags registry entry, see the Registry Reference at the Microsoft Windows Resource Kits Web site (http://go.microsoft.com/fwlink/?LinkId=289).

Example 3: Re-enable performance counters

The following procedure re-enables the performance counter DLL for Reskit, a fictitious service.

To protect the performance monitoring capabilities of the system, the Performance Library (Perflib) tests all performance DLLs when they load and disables performance DLLs that fail its run-time reliability tests. In this case, when the system found that the Reskit performance DLL, Rkperf.dll, generated an exception, it disabled the DLL. The developer repaired Rkperf.dll, but it is still disabled in the system.

This procedures uses Exctrlst to re-enable the performance counters for the Reskit service.

  1. Start Exctrlst.
  2. In the Extensible Performance Counters list, click the Reskit service.
  3. Click to select the Performance Counters Enabled check box.
  4. Click Refresh.
  5. Use Showperf to verify that the counter DLL loads and runs properly.

    6. When Showperf starts, it attempts to load and run all installed performance counter DLLs. It lists the performance objects that successfully loaded and ran. In this case, the performance objects created by Rkperf.dll appear in Showperf, indicating that the DLL repair was successful and the Reskit performance objects and counters are enabled and ready for use.

Tip

  • You cannot copy or export a list of disabled performance DLLs from Exctrlst. However, you can use Regfind, a command-line tool in the Windows 2000 Server Resource Kit to list all instances of the Disable Performance Counters registry entry in the Services subkeys. When the value of this entry is 1, the performance DLL for the service, and the objects and counters it creates, are disabled.

    At the command prompt, type:

    regfind "Disable Performance Counters" -n -p HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services > Disabled.txt

    This command creates a file called Disabled.txt with the names of all services that have the registry entry. You can then search the file for entries with a value of 1.

Example 4: Find the performance objects for a service.

This procedure comprises one method for determining which performance objects are associated with a service.

  1. To list all performance counters that are enabled and operating properly on the system, use Typeperf, a tool included in Windows XP Professional. At the command prompt, type Typeperf /q > All.txt

    2. This command saves the performance counter list in the All.txt file.

  2. To disable the performance counters for the service, use Exctrlst.
  3. Run Typeperf again. At the command prompt, type Typeperf /q > No_Svc.txt

    4. This command saves the revised performance counter list in the No_Svc.txt file. This time, the disabled performance counters do not appear in the list.

  4. Use a comparison tool, such as Fc, to compare the output from the Typeperf runs. The counters that are missing from the No_Svc.txt file are those associated with the service.
  5. Use Exctrlst to re-enable the counters for use.


Pfmon.exe: Page Fault Monitor
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This command-line tool allows a developer or system administrator to monitor page faults that occur while an application is running. PFMon is especially useful to trace hard page faults. (You can easily resolve soft page faults with Virtual Memory Manager.) A sustained high rate of hard page faults might indicate a shortage of memory and can cause a disk bottleneck. Use PFMon to trace the source and number of page faults in a process and display the data in the command window, write it to a log file, or both.

Notes

  • You must run PFMon from the command window.
  • If you run PFMon on an existing process and close the command window, the process stops without giving the user an opportunity to save changes.

Corresponding UI

There is no corresponding user interface for PFMon.

Concepts

A page is a fixed amount of data. When you run a program, the microprocessor stores pages of data that it predicts you will need in main memory, also known as RAM. Pages of data that are not needed are left on your storage device, such as your hard disk.

A page fault occurs when a process refers to a virtual memory page that is not in the working set (the physical memory visible to the program) in main memory.

There are two kinds of page faults: soft and hard. A soft page fault occurs when a process refers to a virtual memory page that is not in the working set, but does not require that the page be retrieved from disk. This can happen when the page is on the standby list in main memory or when the page is being shared with another process. A hard page fault occurs when a virtual memory page is not found in main memory and must therefore be retrieved from disk.

Neither type of page fault is an error.

Hard page faults indicate that your program is reading from and writing to disk. A rise in the number hard page faults generated by a specific program increases the possibility of a disk bottleneck. PFMon helps you determine the number, type, and source of soft and hard page faults that your application generates.

System Requirements

The following are the system requirements for PFMon:

  • Windows XP Professional

Files Required

  • Pfmon.exe
  • Psapi.dll


PFMon Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Limiting Available Memory

An application might appear to generate a negligible number of hard page faults when it is run on a computer that has few other processes running and therefore ample available memory. The performance of the application might degrade, however, with other processes running and reduced amounts of available memory. To test this case, limit memory by using MAXMEM.

Using MAXMEM in Boot.ini

You can use the MAXMEM parameter in the Boot.ini file to set the maximum physical memory available to Windows XP Professional. Boot.ini is a hidden, read-only system file.

To make changes to Boot.ini

  1. To view boot.ini in the root directory:
    1. In Windows Explorer, on the Tools menu, click Folder Options, and then click the View tab.
    2. Clear Hide protected operating system files check box.
    3. Under Hidden files and folders, select Show hidden files and folders.
      4. Click OK.
  2. To remove the read-only attribute of Boot.ini:
    1. In the root directory, right-click Boot.ini.
    2. Clear Read-only.
      3. Click OK.
  3. To edit Boot.ini:
    1. Before making any changes, make a copy of Boot.ini.
    2. Open the Boot.ini file with Notepad.

      An example Boot.ini follows:

      [boot loader]
timeout=20
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
    3. Copy the boot option line (the line under [operating systems]) and paste it immediately below the existing line.
    4. To identify the option when your computer starts, type descriptive text within the quotation marks on the new line. For example:
      multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional 32MB" /fastdetect
    5. At the end of the line leave a space, and then type /MAXMEM= n (where n is the amount of memory in megabytes that you want to make available to Windows XP Professional).

      Caution: Do not set the amount below 32MB, or Windows XP might not start.

      For example:

      multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional 32MB"/fastdetect/maxmem=32
    6. Reboot your computer, and then choose the new option you created from the boot option lines. Check About Windows or Task Manager to ensure that the change you want is in effect.

    4. Note

    • MAXMEM works only on x86-based platforms. This information does not apply to RISC computers (DEC Alpha, MIPS, and Power PC) that store their boot options in ARC firmware.

Determining the Amount of Available Memory

  1. Open Task Manager.
  2. Select the Performance tab.
  3. Wait until the amount of available memory is at a minimum, and then run the application you want to test. Available memory is listed in the Physical Memory area.

Getting Symbols

To get debugging symbols with Dbghelp.dll, you must install the debugging symbols. Next, set the _NT_SYMBOLS_PATH environment variable to the symbol installation path.


PFMon Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

PFMon uses the following syntax:

One Step pfmon {/p pid|AppCommandLine} [/n | /l] [/c | /h] [/k | /K] [/d] [/?]

Parameters

/p pid
Attaches to an existing process ID (PID). When the command window is closed, the attached process is terminated. Do not use the /p parameter when specifying AppCommandName.
AppCommandLine
Specifies the command line of the application to monitor. If the application is not located in the current directory, you might need to enter the path along with the application name. Do not specify AppCommandName if you are using /p pid.

When you terminate the application specified by AppCommandLine, Pfmon displays a summary of the faults that occurred while executing the application.

/n
Writes faults as they occur in the running program to Pfmon.log, but does not display those faults in the command window.
/l
Writes faults as they occur in the running program to Pfmon.log.
/c
Displays only soft page faults and summary information.
/h
Displays only hard page faults and summary information.
/k
Displays page faults that occur in both the kernel mode and the user mode.
/K
Displays only those page faults that occur in the kernel mode.
/d
Displays the following tab-delimited information:
  • Page fault number
  • Page fault type—hard or soft
  • Pprogram counter's module
  • Symbol for program counter
  • Decimal value of program counter
  • Decimal value of program counter of the virtual address (VA) accessed
  • Symbol for virtual address (VA)
  • Value of virtual address (VA)
/?
Displays help about the tool syntax.

Examples

See Example 1: Monitor an Existing Process and Example 2: Monitor an Invoked Process.


PFMon Examples
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Monitor an Existing Process

In this example, system performance slows down while a certain application is running. You want to determine the number of hard page faults this existing process is generating. First, use Task Manager to determine the process identifier (PID) of the existing process. Then type the following in the command window, replacing 1640 with the PID you found in Task Manager:

pfmon -h -p 1640

Pfmon displays a list of hard page faults in the command window while the process is running. When you terminate the process, Pfmon displays summary information about the types of page faults that the process generated.

Your report might look similar to the following output. If it does, you can see that the process used in this sample did not generate a large number of hard page faults.

HARD: wdCommandDispatch+0x4fd1d : 307be774
HARD: 3018541a : 307d35ac
HARD: MsoFAddPruldepDependent+0x6b : 307a837c
HARD: MsoFAddPruldepDependent+0xdb : 307aab7c
HARD: 300fb83f : 30791030
HARD: 30136545 : 30794c60

HARD: wdCommandDispatch+0xa7c9a : 00125ac4
HARD: CoFreeAllLibraries+0x6861 : 03c99000

HARD: DsFreeNameResultW+0xa1e : 77bfe2fc
HARD: AccRewriteGetExplicitEntriesFromAcl+0x8370 : 69c07e00
HARD: CoFreeAllLibraries+0x6861 : 042c6000

                 Caused     78 faults had     75 Soft      6 Hard faulted VA's
           ntdll Caused     38 faults had     10 Soft      0 Hard faulted VA's
        advapi32 Caused      4 faults had      4 Soft      0 Hard faulted VA's
        kernel32 Caused      7 faults had      4 Soft      0 Hard faulted VA's
          rpcrt4 Caused      0 faults had      0 Soft      0 Hard faulted VA's
           gdi32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
          user32 Caused      8 faults had      6 Soft      0 Hard faulted VA's
                 Caused     45 faults had     16 Soft      0 Hard faulted VA's
           ole32 Caused     83 faults had      8 Soft      0 Hard faulted VA's
         shell32 Caused      4 faults had      0 Soft      0 Hard faulted VA's
         shlwapi Caused      4 faults had      0 Soft      0 Hard faulted VA's
        comctl32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
        winspool Caused      0 faults had      0 Soft      0 Hard faulted VA's
         clbcatq Caused      1 faults had      1 Soft      0 Hard faulted VA's
        oleaut32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
                 Caused      2 faults had      1 Soft      0 Hard faulted VA's
                 Caused      0 faults had      0 Soft      0 Hard faulted VA's
        MSVBVM60 Caused     10 faults had     10 Soft      0 Hard faulted VA's
             msi Caused      3 faults had      3 Soft      0 Hard faulted VA's
        MSAddnDr Caused      0 faults had      0 Soft      0 Hard faulted VA's
                 Caused      0 faults had      0 Soft      0 Hard faulted VA's
                 Caused      0 faults had      0 Soft      0 Hard faulted VA's
         version Caused      0 faults had      0 Soft      0 Hard faulted VA's
            lz32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
           cscui Caused      0 faults had      0 Soft      0 Hard faulted VA's
          cscdll Caused      0 faults had      0 Soft      0 Hard faulted VA's
                 Caused      2 faults had      2 Soft      0 Hard faulted VA's
        AgentMpx Caused      0 faults had      0 Soft      0 Hard faulted VA's
                 Caused      1 faults had      1 Soft      0 Hard faulted VA's
                 Caused      0 faults had      0 Soft      0 Hard faulted VA's
        linkinfo Caused      0 faults had      0 Soft      0 Hard faulted VA's
         ntshrui Caused      0 faults had      0 Soft      0 Hard faulted VA's
                 Caused      0 faults had      0 Soft      0 Hard faulted VA's
        netapi32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
         secur32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
          NetRap Caused      0 faults had      0 Soft      0 Hard faulted VA's
          samlib Caused      0 faults had      0 Soft      0 Hard faulted VA's
          ws2_32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
         ws2help Caused      0 faults had      0 Soft      0 Hard faulted VA's
         wldap32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
          dnsapi Caused      0 faults had      0 Soft      0 Hard faulted VA's
         wsock32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
        riched20 Caused      0 faults had      0 Soft      0 Hard faulted VA's
        unidrvui Caused      0 faults had      0 Soft      0 Hard faulted VA's
          unidrv Caused      0 faults had      0 Soft      0 Hard faulted VA's
           mscms Caused      0 faults had      0 Soft      0 Hard faulted VA's
           icm32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
         ntmarta Caused     11 faults had     12 Soft      1 Hard faulted VA's
         ntdsapi Caused      4 faults had      3 Soft      1 Hard faulted VA's

PFMON: Total Faults 305  (KM 141 UM 305 Soft 294, Hard 11, Code 127, Data 178)

Example 2: Monitor an Invoked Process

In this example, you suspect that an application you developed is generating a large number of hard page faults and is causing a disk bottleneck. Type the following to invoke your application (in this example it is Notepad) and specify that output data be written to the Pfmon.log file, not to the command window:

pfmon -h -n notepad

PFMon writes a list of hard page faults to the Pfmon.log file. When you close your application, summary information about the process is written to the log file, and the final line of the summary is also displayed in the command window.

Based on the small number of hard page faults in the sample output, you can see that your application is not generating a large number of hard page faults. You might try to rerun PFMon while limiting the amount of memory to see how your application behaves under those conditions. For instructions on how to limit memory, see Limiting Available Memory.

If the program continues to generate a low number of hard page faults after you limit memory, try using another tool to investigate other aspects of your application's behavior.

HARD: RtlTryEnterCriticalSection+0xf : NlsMbOemCodePageTag+0x00000034
HARD: ZwOpenProcessToken+0x166 : NlsAnsiCodePage+0x00000672
HARD: RtlAppendUnicodeToString+0x15e : modf+0x00003DE0
HARD: RtlGetControlSecurityDescriptor+0x4b : 0006ef54
HARD: SetWaitableTimer+0xa1 : 77edf060
HARD: SetWaitableTimer+0xa7 : 77ee0800
HARD: UserClientDllInitialize+0x48 : 77e694bc
HARD: RtlInitializeCriticalSectionAndSpinCount+0xb : 77f784f4
HARD: RpcBindingInqAuthInfoExW+0x2ab : 77da9038
HARD: RtlInitializeCriticalSectionAndSpinCount+0xb : 77e02134
HARD: RegCloseKey+0x2ee : 77e010fc
HARD: RtlInitializeCriticalSectionAndSpinCount+0xb : 77cb4034
HARD: ImageList_SetOverlayImage+0x1326 : 77bb6068
HARD: Ordinal211+0x151e : 776bc248
HARD: ftol+0xc3 : osplatform
HARD: control87+0x1d8 : iob+0x00001290
HARD: GetFileTitleA+0x381 : 76b5b1ac
HARD: InitializeDll+0x3c : 778182b8
HARD: 01004c4b : 0100885c
         notepad Caused      8 faults had     11 Soft      1 Hard faulted VA's
           ntdll Caused     97 faults had     48 Soft      2 Hard faulted VA's
        comdlg32 Caused      3 faults had      2 Soft      1 Hard faulted VA's
         shlwapi Caused      2 faults had      3 Soft      1 Hard faulted VA's
           gdi32 Caused     24 faults had     12 Soft      1 Hard faulted VA's
        kernel32 Caused     48 faults had     37 Soft      2 Hard faulted VA's
          user32 Caused     46 faults had     41 Soft      1 Hard faulted VA's
        advapi32 Caused      7 faults had      7 Soft      2 Hard faulted VA's
          rpcrt4 Caused      6 faults had      5 Soft      1 Hard faulted VA's
        comctl32 Caused      6 faults had      6 Soft      1 Hard faulted VA's
         shell32 Caused      6 faults had      6 Soft      1 Hard faulted VA's
                 Caused     10 faults had     11 Soft      3 Hard faulted VA's
        winspool Caused      4 faults had      3 Soft      1 Hard faulted VA's

PFMON: Total Faults 267  (KM 22 UM 267 Soft 248, Hard 19, Code 131, Data 136)


Pmon.exe: Process Resource Monitor
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

This command-line performance tool displays several measures of the processor and memory use of processes running on the system. The PMon display appears in the command window. It is updated automatically every few seconds and requires no configuration.

You can use PMon to measure paged and non-paged pool usage, and to identifying kernel mode memory leaks.

File required

  • Pmon.exe


PMon Notes
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

General Information

  • PMon collects its data from the same source as System Monitor. You can use either tool to monitor process performance.
  • The PMon output table updates automatically every few seconds. To monitor PMon output over time, copy the table to a Notepad file periodically. You cannot redirect PMon output.
  • To identify a process, PMon lists the process name in the Image Name column. Processes are named for the executable file (image file) that started the process.
  • To detect a memory leak, monitor the Commit values on the second row of the output display. Constantly increasing values over several hours indicate a probable leak. Also, monitor the Commit Charge column over time. The process with increasing Commit Charge values is likely to be the one that is leaking memory.

Output Table Reference

This table lists and describes the columns in the PMon output.

CPU | Displays the percentage of current processor use that is attributable to the process.
CpuTime | Displays the accumulated time that the processor has spent executing threads in the process since the process began.
MemUsage | Displays the current size of the working set of the process, in kilobytes.
Page Faults | Displays the cumulative total number of page faults generated by the process since it began. A page fault occurs when a process accesses virtual memory that is not currently located in physical memory and must be read from disk.
Flts Diff | Displays the change in the number of page faults for the process recorded since the last update.
Commit Charge | Displays the amount of virtual memory allocated to and reserved for the process, in kilobytes. This field has the same value as the Process\Private Bytes counter in System Monitor.
Usage NonP | Displays the amount of memory in the nonpaged pool used by the process, in kilobytes.
Usage Page | Displays the amount of memory in the paged pool used by the process, in kilobytes.
Pri | Displays the base priority of the process. The base priority, which is established by the program running in the process, determines the range within which the operating system can vary the dynamic priorities of the process threads. The dynamic priority determines the order in which threads run on the processor.
Hnd Cnt | Displays the number of open handles currently attributed to the process.
Thd Cnt | Displays the number of threads currently running in the process.
Image Name | Displays the name of the executable file that started the process.


PMon Syntax
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

To use PMon

  • To run PMon, at the command prompt, type pmon.
  • To quit PMon, press CTRL+C, ESC, or q.
  • To scroll up and down the list of currently running processes, press the UP ARROW and DOWN ARROW keys, respectively.
  • To update the display on demand, press any other key.


PMon Examples
Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Sample Output

The following display shows sample PMon output of a computer running Windows XP Professional.

 Memory:  130612K Avail:  28660K  PageFlts:   338 InRam Kernel: 1988K P:10868K
 Commit: 190684K/ 135668K Limit: 314732K Peak: 251772K  Pool N: 9000K P:12484K

                Mem  Mem   Page   Flts Commit  Usage   Pri  Hnd Thd  Image
CPU  CpuTime  Usage Diff   Faults Diff Charge NonP Page     Cnt Cnt  Name

              27348   28   917631    7                             File Cache
95  30:35:30     20    0        1    0      0    0    0  0    0  1 Idle Process
 0   0:01:39     24    0     9976    0     36    0    0  8  695 56 System
 0   0:00:00     44    0      736    0    212    0    5 11   28  4 smss.exe
 0   0:00:27   1788    0    14097    0   1816    5   51 13  564 11 csrss.exe
 0   0:00:22   3780    0    29807    0   8804   46   63 13  595 19 winlogon.exe
 0   0:00:25   1864    0    25678    0   4284   11   36  9  391 20 services.exe
 0   0:00:18   3096    0    10682    0   9076   11   41  9  450 28 lsass.exe
 0   0:00:01   1344    0     2934    0   1196   14   20  8  275  9 svchost.exe
 0   0:00:02   2280    0     7440    0   2340    6   23  8  202 19 svchost.exe
 0   0:03:41  14136    0  1619633    0  19512   37   92  8 1589 50 svchost.exe
 0   0:00:00    976    0     3461    0    748    2   14  8   76  6 svchost.exe
 0   0:02:30   2304    0     6611    0   2936   39   37  8  376 19 svchost.exe
 0   0:00:01    576    0     6409    0   2976    4   34  8  133 11 spoolsv.exe
 0   0:00:00    460    0     1823    0   1576   11   21  8  158 20 msdtc.exe
 0   0:05:44   2676    0     8358    0   5612   14   18  8  103 21 inojobsv.exe
 0   0:03:30   2376    0   586307    0   2896    8   34  8  331 18 cisvc.exe
 0   0:00:17    188    0    31233    0   1912    3   32  8  120  5 clisvcl.exe
 0   0:00:01   2156    0    12183    0   7660   46   66  8  568 37 inetinfo.exe
 0   0:00:00    736    0     2265    0    692    2   16  8   76  8 llssrv.exe
 0   0:00:00    148    0      582    0    300    1    9  8   31  2 svchost.exe
 0   0:00:02    968    0     9925    0   2728    5   20  8  187  5 snmp.exe
 0   0:00:00     52    0      648    0    564    2   16  8   41  3 dfssvc.exe
 0   0:00:00     60    0     1044    0    912    2   29  8   88  5 svchost.exe
 0   0:00:01    716    0     2618    0   1628    3   32  8  142  9 svchost.exe
 0   0:00:02   1004    0     3466    0   2752    5   28  8  246 18 dllhost.exe
 0   0:04:29    284   28   512534    7   3640    4   39  4  182  4 cidaemon.exe
 0   0:00:24    372    0    15924    0   2384    3   31  4  118  4 cidaemon.exe
 0   0:00:00    260    0     1081    0   2040    7   20  8  216 13 svchost.exe
 0   0:00:05    392    0    12480    0  10232    7   55  8  288 10 HelpSvc.exe
 0   0:00:08    508    0    15805    0   1452    4   28  8  191  5 SMSAPM32.exe
 0   0:00:03    248    0     2522    0    940    3   29 13  118 11 csrss.exe
 0   0:00:04   1680    0    10199    0   5080    9   48 13  298 15 winlogon.exe
 0   0:00:00    172    0      918    0    696    1   26  8   58  3 rdpclip.exe
 0   0:00:10   1720    0    10863    0   4912    6   48  8  243  8 explorer.exe
 0   0:00:00    656    0     1398    0   1160    2   26  8   38  2 realmon.exe
 0   0:01:15  10188    0    38586    0  12188   11  107  8  428 13 explorer.exe
 0   0:00:00    304    0     3431    0   1284    3   34  8   84  2 launch32.exe
 0   0:00:00   1436    0     1475    0    448    3   21  8   76  1 ctfmon.exe
 0   0:00:00    780    0      957    0   1204    2   27  8   48  2 realmon.exe
 0   0:00:00    156    0     7769    0   1132    2   31  8  120  4 SMSMon32.exe
 0   0:00:00   1376    0      346    0   1404    1   15  8   22  1 cmd.exe
 0   0:00:00    996    0      245    0    352    1    7 13    9  1 pmon.exe


Showperf.exe

Showperf.exe: Performance Data Block Dump Utility
Overview | Notes | UI | Examples | Related Tools Run Tool

ShowPerf loads and runs the dynamic-link libraries (DLLs) of installed performance counters on local and remote computers running Windows 2000 and Windows XP Professional, and displays unformatted data from the internal data buffers of counters that loaded successfully and are enabled on the system.

Administrators and performance counter developers can use this tool to identify counters that the system cannot load and counters that the system disables because the DLL fails the system's run-time reliability tests. They can also use Showperf to detect errors in the counter data retrieved from the performance registry.

Showperf displays the following data for counters that load successfully and are enabled on the system:

  • Performance objects and object instances that are enabled on the system. (Disabled objects do not appear.)
  • Index of the object in the performance registry (HKEY_PERFORMANCE_DATA).
  • Performance counters for each object.
  • Index of the counter in the performance registry (HKEY_PERFORMANCE_DATA).
  • Counter type of each performance counter.
  • Unformatted content of the data block for the performance counter.

File required

  • Showperf.exe


ShowPerf Notes
Overview | Notes | UI | Examples | Related Tools Run Tool

Concepts

Showperf generates its display by loading and running each performance DLL, extracting data from the performance registry, and displaying the contents of the data buffer for each performance counter. If a performance DLL does not load or run properly, the performance objects for the service do not appear in ShowPerf.

ShowPerf does not display performance objects and counters that the system disables because they fail the system's run-time reliability tests for performance counter DLLs. Because a faulty performance DLL can corrupt all performance data and prevent System Monitor and other tools from displaying any performance data, the system tests all DLLs on load. If a DLL fails the test, the system disables all performance counters associated with the service. These counters do not display in ShowPerf, in System Monitor, or in performance tools based on the System Monitor control.

You can use Exctrlst, a tool in the Windows XP Professional Support Tools folder, to get a complete list of the performance counters installed on the system. By comparing the list of all counters from Exctrlst to the list of operating counters from ShowPerf, you can find the counters that did not load properly or failed the reliability tests.

You can also examine the contents of the data buffers returned for each counter that loaded successfully. If the data is obviously wrong, either the counter has been assigned the wrong counter type or the DLL collection method is not working properly.

For more information

For information about counter types and for descriptions of the performance counters installed on Windows XP Professional, see the Performance Counter Reference at the Microsoft Windows XP Professional Resource Kits Web site (http://www.microsoft.com/).

For information about the run-time reliability tests for performance counters, and to customize the tests for your system, search for "Configuration Flags" in the Registry Reference at the Microsoft Windows XP Professional Resource Kits Web site (http://www.microsoft.com/).

To view all installed performance counters and to enable and disable performance counters, use Exctrlst, a Windows Support Tool.

To list the performance counters on a local or remote system from the command line, use Typeperf, a tool included in Windows XP Professional.

To see a graphic display of performance counter data, use System Monitor. To run System Monitor, at the command prompt or in the Run dialog box, type Perfmon.

Disabled Performance Objects

In Windows NT, defective or poorly constructed performance DLLs could disable the performance monitoring features of the operating system. To prevent this situation, in Windows 2000 and Windows XP Professional, the Performance Library tests the basic structures of each performance counter DLL when it loads. If the DLL fails these basic tests, the system disables the counter DLL.

Performance objects that are installed, but disabled, do not display in ShowPerf or in other tools that display performance counter data, such as System Monitor. If a performance object is missing from the ShowPerf list, the object might be disabled.

To disable the performance objects for a service, the system adds the Disable Performance Counters registry entry to the Performance subkey for the service (HKLM\SYSTEM\CurrentControlSet\Services\ServiceName\Performance) and sets the value of the entry to 1.

To re-enable performance objects after the DLL is replaced or repaired, use Exctrlst, or set the value of the Disable Performance Counters registry entry to 0 or delete the entry.

For more information about the Disable Performance Counters registry entry, see the Registry Reference in the Windows XP Professional Resource Kit.

Tips

Event Viewer is one of the most valuable tools for diagnosing problems with performance counters. When the system detects a serious error in a performance counter DLL, it disables the counter and records Event 1016 in the Application Log in Event Viewer. If a performance counter does not appear in System Monitor or if it does not operate properly, check the Application log for events generated by Perflib.

To list all services that have performance counters installed on the system, use Regfind, a command-line tool in the Windows 2000 Server Resource Kit.

At the command prompt, type:

regfind "Performance" -n -p HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

In response, Regfind lists all services that have a Performance subkey. This subkey indicates that the service has installed performance counters on the system.

To list services whose performance counters are disabled, use Regfind to search for the Disable Performance Counters registry entry.

At the command prompt, type:

regfind "Disable Performance Counters" -n -p HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

In response, Regfind lists all instances of the registry entry and its value. When the value of this entry is 1, all performance objects and counters for the service are disabled.


ShowPerf Notes

ShowPerf User Interface
Overview | Notes | UI | Examples | Related Tools Run Tool

ShowPerf dialog box

Showperf dialog box

To run ShowPerf

  • At the command prompt or in the Run dialog box, type Showperf.

To configure ShowPerf

  1. Select a computer.

    2. The Computer box displays the name of the computer being monitored. The default is the local computer.

    To monitor a remote computer, delete the name in the Computer box, type the name of the remote computer (preceded by backslashes), and click Refresh.

  2. Choose whether to load performance objects that use a significant amount of memory or processor time ("costly" objects). Objects are designated as "costly" by their developers.

    3. Select the Show "Costly" Objects ch box if you want Showperf to load these objects, or clear it if you don't want Showperf to load them. This box is cleared by default.

    After selecting or clearing this check box, click Refresh to make the change effective.

  3. Select a performance object.

    4. The Object box displays the performance object being monitored and its index in the performance registry. Typically, performance objects represent components of the operating system or its services.

    The Object drop-down list displays all performance objects enabled and operating on the system. If an object does not appear in the list, it might be faulty or disabled.

    When you select an object, its instances appear in the Instances list and its counters appear in the Counter display.

    To monitor a different performance object, select the object from the drop-down list.

    Note

    • The objects are listed in alphabetical order by service name, not object name.
  4. Select an instance of the performance object.

    5. The Instance box displays the instance of the performance object being monitored, or Total, which represents all instances of the object.

    The Instance list is used when the computer has more than one component of the same type. For example, when the computer has more than one disk drive and you monitor the PhysicalDisk object, the Instance box lists each drive.

    To monitor a different instance of the selected object, select an instance from the drop-down box.

To interpret the Counter display

The following table lists and describes the fields in the Counter display.

Item | Description
Index | The index of the counter in the performance registry. The index of a performance counter must be within the index range assigned to the performance object.
Counter Name | The name of the performance counter.
Counter Type | The counter type defines the method used to calculate, average, and display counter data. If a counter is not displaying the correct data, it might have the wrong counter type. For example, if a counter is displaying instantaneous values, instead of values per second, it might be of type Counter Rawcount instead of Counter Counter.
Counter Data | The current, unformatted content of the data block for the counter. Click Refresh to update the data.


ShowPerf Examples
Overview | Notes | UI | Examples | Related Tools Run Tool
Example 1: View the raw data for a performance counter.
Example 2: Find a missing performance object.

Example 1: View the raw data for a performance counter

The following procedure uses ShowPerf to examine the data retrieved from the performance registry for the % Usage counter of the Paging File performance object. In this case, the user doubts that the value shown in System Monitor, 18.56, is correct.

  1. From the Object box, select Paging File.
  2. From the Instance box, select \??\C:\pagefile.sys, the paging file on the system drive.

The data in the Counter box reveals the two elements that comprise the %Usage value, a raw fraction counter type in the numerator and a raw base counter type in the denominator. These counter elements have the following current value, as shown in the Counter Data column.

Index | Counter Name | Counter Type | Counter Data
702 | % Usage | Raw Fraction | 0x00002396 (9110)
702 | % Usage | Raw Base | 0x0000c000 (49152)

Using the decimal values shown in parentheses, the paging file consists of 49,152 KB of which 9,110 KB are used. This explains the data shown in System Monitor.

Clicking Refresh updates the data. However, the data for this counter does not change significantly.

If the data does not accurately reflect the size of the paging file or the bytes used, as determined by using other sources, then the paging file counter DLL must be corrected.

Note

  • To correctly interpret the data returned by a counter, consider the counter type. For example, for rate-based counters, the data block stores a value that increases over time. To calculate the rate, you must divide the change in values by the change in system time.

Example 2: Find a missing performance object

The following procedure determines why the performance object for a fictitious service, Reskit, does not appear in System Monitor:

  1. Check the Application Log in Event Viewer for events recorded by Perflib. When a counter DLL fails the system's reliability tests, Perflib records Event 1016 in the log.

    2. In this case, the event does not appear in the log.

  2. Use Exctrlst to list all performance counters installed on the system.

    3. If a counter does not appear in the Exctrlst display, then it is not installed or properly registered in the system.

    In this case, the Reskit service is listed in Exctrlst, and its performance counter DLL, Reskit.dll, is listed in its proper location.

  3. Use Exctrlst to determine whether the performance counter DLL for the Reskit service is disabled.

    4. In this case, the Performance Counters Enabled check box in Exctrlst is checked, indicating that the Reskit service performance DLL passed the system's run-time reliability tests.

  4. Use ShowPerf to load the performance counters on the system. Then, look for the Reskit performance object in the ShowPerf Object drop-down list.

    5. In this case, the object does not appear in the list. This indicates that the Reskit performance DLL passed the basic reliability tests, but does not load properly in ShowPerf. This rare situation occurs when a DLL has a fault that is not evident in basic testing but appears later, such as when the service is stressed by high use or retrives extreme data values not anticipated in the program design.

Counter DLLs might also be enabled but not load properly in ShowPerf because one or more of the run-time reliability tests have been turned off, or because the system is prevented from disabling performance counters that fail its tests. To check for this occurrence, find the value of the Configuration Flags registry entry (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Configuration Flags). The default value, which allows the system to disable faulty counters, is 0x10.

For information about the Configuration Flags registry entry, see the Registry Reference at the Microsoft Windows XP Professional Resource Kits Web site (http://www.microsoft.com/).


Glossary

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

A

access control

A security mechanism that determines which operations a user, group, service, or computer is authorized to perform on a computer or on a particular object, such as a file, printer, registry key, or directory service object.

See also: permission; registry; service

access control list (ACL)

A list of security protections that apply to an entire object, a set of the object's properties, or an individual property of an object. There are two types of access control lists: discretionary and system.

See also: security descriptor

ACL

See definition for: access control list (ACL)

Active Directory

The directory service that stores information about objects on a network and makes this information available to users and network administrators. Active Directory gives network users access to permitted resources anywhere on the network using a single logon process. It provides network administrators with an intuitive, hierarchical view of the network and a single point of administration for all network objects.

See also: directory service; service

active volume

The volume from which the computer starts up. The active volume must be a simple volume on a dynamic disk. You cannot mark an existing dynamic volume as the active volume, but you can upgrade a basic disk containing the active partition to a dynamic disk. Once the disk is upgraded to dynamic, the partition becomes a simple volume that is active.

See also: simple volume

ActiveX

A set of technologies that allows software components to interact with one another in a networked environment, regardless of the language in which the components were created.

American Standard Code for Information Interchange (ASCII)

A standard single-byte character encoding scheme used for text-based data. ASCII uses designated 7-bit or 8-bit number combinations to represent either 128 or 256 possible characters. Standard ASCII uses 7 bits to represent all uppercase and lowercase letters, the numbers 0 through 9, punctuation marks, and special control characters used in U.S. English. Most current x86-based systems support the use of extended (or "high") ASCII. Extended ASCII allows the eighth bit of each character to identify an additional 128 special symbol characters, foreign-language letters, and graphic symbols.

See also: Unicode

application programming interface (API)

A set of routines that an application uses to request and carry out lower-level services performed by a computer's operating system. These routines usually carry out maintenance tasks such as managing files and displaying information.

ASCII (American Standard Code for Information Interchange)

See definition for: American Standard Code for Information Interchange (ASCII)

B

basic input/output system (BIOS)

On x86-based computers, the set of essential software routines that test hardware at startup, start the operating system, and support the transfer of data among hardware devices. The BIOS is stored in read-only memory (ROM) so that it can be executed when you turn on the computer. Although critical to performance, the BIOS is usually invisible to computer users.

See also: Extensible Firmware Interface (EFI)

batch program

An ASCII (unformatted text) file that contains one or more operating system commands. A batch program's file name has a .cmd or .bat extension. When you type the file name at the command prompt, or when the batch program is run from another program, its commands are processed sequentially. Batch programs are also called batch files.

See also: American Standard Code for Information Interchange (ASCII)

BIOS

See definition for: basic input/output system (BIOS)

browser

Software that interprets the markup of files in HTML, formats them into Web pages, and displays them to the end user. Some browsers also permit end users to send and receive e-mail, read newsgroups, and play sound or video files embedded in Web documents.

C

CGI

See definition for: common gateway interface (CGI)

checked build

A version of Windows which consists of binaries that provide additional error checking, argument verification, and system debugging code. Much of the extra code in the checked binaries is in the form of ASSERT macros that test an expression. If the expression evaluates to FALSE, the macro generates a kernel debugger error message and breaks into the debugger. This lets you immediately determine the cause and location of the error.Because of the additional error checking code and debugging information, the checked binaries are larger and run slower than the free binaries. This can conceal synchronization or other timing-related problems, such as race conditions, that become apparent only in the free build.If you run the checked build of Windows NT without having enabled kernel debugging, unexpected system shutdowns can occur. This is because the additional checks in the checked build increase the likelihood of encountering a breakpoint.

cluster

In data storage, the smallest amount of disk space that can be allocated to hold a file. All file systems used by Windows organize hard disks based on clusters, which consist of one or more contiguous sectors. The smaller the cluster size, the more efficiently a disk stores information. If no cluster size is specified during formatting, Windows picks defaults based on the size of the volume. These defaults are selected to reduce the amount of space that is lost and the amount of fragmentation on the volume. A cluster is also called an allocation unit.

In computer networking, a group of independent computers that work together to provide a common set of services and present a single-system image to clients. The use of a cluster enhances the availability of the services and the scalability and manageability of the operating system that provides the services.

code page

A means of providing support for character sets and keyboard layouts for different countries or regions. A code page is a table that relates the binary character codes used by a program to keys on the keyboard or to characters on the display.

COM

See definition for: Component Object Model (COM)

common gateway interface (CGI)

A server-side interface for initiating software services. For example a set of interfaces that describe how a Web server communicates with software on the same computer. Any software can be a CGI program if it handles input and output according to the CGI standard.

Component Object Model (COM)

An object-based programming model designed to promote software interoperability; it allows two or more applications or components to easily cooperate with one another, even if they were written by different vendors, at different times, in different programming languages, or if they are running on different computers running different operating systems. COM is the foundation technology upon which broader technologies can be built. Object linking and embedding (OLE) technology and ActiveX are both built on top of COM.

Compression Control Protocol (CCP)

A protocol used in the negotiation process in a PPP connection. Compression Control Protocol is one type of Network Control Protocol (NCP). NCPs are used to establish and configure different network protocol parameters for IP, IPX, and NetBEUI.

See also: NetBEUI

console tree

The left pane in Microsoft Management Console (MMC) that displays the items contained in the console. By default it is the left pane of a console window, but it can be hidden. The items in the console tree and their hierarchical organization determine the capabilities of a console.

See also: Microsoft Management Console (MMC); namespace

credentials

A set of information that includes identification and proof of identification that is used to gain access to local and network resources. Examples of credentials are user names and passwords, smart cards, and certificates.

cyclical redundancy check (CRC)

A procedure used in checking for errors in data transmission. CRC error checking uses a complex calculation to generate a number based on the data transmitted. The sending device performs the calculation before transmission and sends its result to the receiving device. The receiving device repeats the same calculation after transmission. If both devices obtain the same result, it is assumed that the transmission was error-free. The procedure is known as a redundancy check because each transmission includes not only data but extra (redundant) error-checking values. Communications protocols such as XMODEM and Kermit use cyclical redundancy checking.

D

daemon

A networking program, usually associated with UNIX systems, that runs in the background performing tool functions such as housekeeping or maintenance without user intervention or awareness. Pronounced "demon."

DFS

See definition for: Distributed File System (DFS)

DHCP

See Dynamic Host Configuration Protocol.

dial-up connection

The connection to your network if you are using a device that uses the telephone network. This includes modems with a standard phone line, ISDN cards with high-speed ISDN lines, or X.25 networks.

If you are a typical user, you may have one or two dial-up connections, for example, to the Internet and to your corporate network. In a more complex server situation, multiple network modem connections might be used to implement advanced routing.

directory service

Both the directory information source and the service that make the information available and usable. A directory service enables the user to find an object given any one of its attributes.

distinguished name

A name that uniquely identifies an object by using the relative distinguished name for the object, plus the names of container objects and domains that contain the object. The distinguished name identifies the object as well as its location in a tree. Every object in Active Directory has a distinguished name. A typical distinguished name might be

CN=MyName,CN=Users,DC=Microsoft,DC=Com

This identifies the MyName user object in the microsoft.com domain.

See also: Active Directory; domain

Distributed File System (DFS)

A service that allows system administrators to organize distributed network shares into a logical namespace, enabling users to access files without specifying their physical location and providing load sharing across network shares.

DLL

See definition for: dynamic-link library (DLL)

DNS

See definition for: Domain Name System (DNS)

domain

A group of computers that are part of a network and share a common directory database. A domain is administered as a unit with common rules and procedures. Each domain has a unique name.

An Active Directory domain is a collection of computers defined by the administrator of a Windows network. These computers share a common directory database, security policies, and security relationships with other domains. An Active Directory domain provides access to the centralized user accounts and group accounts maintained by the domain administrator. An Active Directory forest is made up of one or more domains, each of which can span more than one physical location.

A DNS domain is any tree or subtree within the DNS namespace. Although the names for DNS domains often correspond to Active Directory domains, DNS domains should not be confused with Active Directory domains.

See also: Active Directory; Domain Name System (DNS)

domain controller

In a Windows domain environment, a computer running Active Directory that manages user access to a network, which includes logging on, authentication, and access to the directory and shared resources.

See also: Active Directory; shared resource

domain DFS

An implementation of DFS in which DFS topological information is stored in Active Directory. Because this information is made available on multiple domain controllers in the domain, domain DFS provides fault-tolerance for any distributed file system in the domain.

See also: fault tolerance

Domain Name System (DNS)

A hierarchical, distributed database that contains mappings of DNS domain names to various types of data, such as IP addresses. DNS enables the location of computers and services by user-friendly names, and it also enables the discovery of other information stored in the database.

See also: domain; service; Transmission Control Protocol/Internet Protocol (TCP/IP); IP address

Dynamic Host Configuration Protocol (DHCP)

A TCP/IP service protocol that offers dynamic leased configuration of host IP addresses and distributes other configuration parameters to eligible network clients. DHCP provides safe, reliable, and simple TCP/IP network configuration, prevents address conflicts, and helps conserve the use of client IP addresses on the network.

DHCP uses a client/server model where the DHCP server maintains centralized management of IP addresses that are used on the network. DHCP-supporting clients can then request and obtain lease of an IP address from a DHCP server as part of their network boot process.

See also: Transmission Control Protocol/Internet Protocol (TCP/IP); service; IP address

dynamic-link library (DLL)

An operating system feature that allows executable routines (generally serving a specific function or set of functions) to be stored separately as files with .dll extensions. These routines are loaded only when needed by the program that calls them.

See also: Resource DLL

E

EFI

See definition for: Extensible Firmware Interface (EFI)

environment variable

A string consisting of environment information, such as a drive, path, or file name, associated with a symbolic name that can be used by Windows. You use System in Control Panel or the set command from the command prompt to define environment variables.

See also: variable

Extensible Firmware Interface (EFI)

In computers with the Intel Itanium processor, the interface between a computer's firmware, hardware, and the operating system. The Extensible Firmware Interface (EFI) defines a new partition style called GUID partition table (GPT). EFI serves the same purpose for Itanium-based computers as the BIOS found in x86-based computers. However, it has expanded capabilities that provide a consistent way to start any compatible operating system and an easy way to add EFI drivers for new bootable devices without the need to update the computer's firmware.

See also: basic input/output system (BIOS)

F

FAT

See definition for: file allocation table (FAT)

FAT32

A derivative of the file allocation table (FAT) file system. FAT32 supports smaller cluster sizes and larger volumes than FAT, which results in more efficient space allocation on FAT32 volumes.

fault tolerance

The ability of computer hardware or software to ensure data integrity when hardware failures occur. Fault tolerant features appear in many server operating systems and include mirrored volumes, RAID-5 volumes, and server clusters.

See also: cluster; RAID-5 volume

file allocation table (FAT)

A file system used by MS-DOS and other Windows-based operating systems to organize and manage files. The file allocation table (FAT) is a data structure that Windows creates when you format a volume by using the FAT or FAT32 file systems. Windows stores information about each file in the FAT so that it can retrieve the file later.

See also: FAT32; NTFS file system

File Share resource

A file share accessible by a network path that is supported as a cluster resource by a Resource DLL.

See also: Resource DLL

File Transfer Protocol (FTP)

A member of the TCP/IP suite of protocols, used to copy files between two computers on the Internet. Both computers must support their respective FTP roles: one must be an FTP client and the other an FTP server.

See also: Transmission Control Protocol/Internet Protocol (TCP/IP)

filter

For Indexing Service, software that extracts content and property values from a document in order to index them.

For IPSec, a specification of IP traffic that provides the ability to trigger security negotiations for a communication based on the source, destination, and type of IP traffic.

Flexible Single Master Operations (FSMO)

Active Directory operations that are not permitted to occur at different places in the network at the same time. Each role controls another specific set of directory changes. For each role, only the domain controller holding that role can make the associated directory changes. For example, Active Directory performs schema updates to prevent conflicts in a single-master fashion. Only one domain controller in the entire forest, the domain controller holding the schema master role, accepts updates to schema objects. An administrator can shift the schema master role from one domain controller to another as the need arises, but at any moment only one domain controller holds the schema master role.

See also: domain controller; Active Directory

flow

A stream of data sent or received by a host. Also called network traffic.

forest

A collection of one or more Windows domains that share a common schema, configuration, and global catalog and are linked with two-way transitive trusts.

See also: domain; schema

frame

In synchronous communication, a package of information transmitted as a single unit from one device to another.

FSMO

See definition for: Flexible Single Master Operations (FSMO)

FTP

See definition for: File Transfer Protocol (FTP)

G

gateway

A device connected to multiple physical TCP/IP networks capable of routing or delivering IP packets between them. A gateway translates between different transport protocols or data formats (for example, IPX and IP) and is generally added to a network primarily for its translation ability.

In the context of interoperating with Novell NetWare networks, a gateway acts as a bridge between the server message block (SMB) protocol used by Windows networks and the NetWare core protocol (NCP) used by NetWare networks. A gateway is also called an IP router.

globally unique identifier (GUID)

A 16-byte value generated from the unique identifier on a device, the current date and time, and a sequence number. A GUID is used to identify a particular device or component.

graphical user interface (GUI)

A display format, like that of Windows, that represents a program's functions with graphic images such as buttons and icons. GUIs allow a user to perform operations and make choices by pointing and clicking with a mouse.

Group Policy

The Microsoft Management Console (MMC) snap-in that is used to edit Group Policy objects.

Group Policy object

A collection of Group Policy settings. Group Policy objects are essentially the documents created by the Group Policy snap-in, a Windows utility. Group Policy objects are stored at the domain level, and they affect users and computers contained in sites, domains, and organizational units. In addition, each Windows computer has exactly one group of settings stored locally, called the local Group Policy object.

See also: Group Policy

H

handle

In the user interface, an interface added to an object that facilitates moving, sizing, reshaping, or other functions pertaining to an object. In programming, a pointer to a pointer, that is, a token that lets a program access an identified resource.

hardware abstraction layer (HAL)

A thin layer of software provided by the hardware manufacturer that hides, or abstracts, hardware differences from higher layers of the operating system. By means of the filter provided by the HAL, different types of hardware look alike to the rest of the operating system. This allows the operating system to be portable from one hardware platform to another. The HAL also provides routines that allow a single device driver to support the same device on all platforms.

high performance file system (HPFS)

The file system designed for the OS/2 version 1.2 operating system.

hive

A section of the registry that appears as a file on your hard disk. The registry subtree is divided into hives (named for their resemblance to the cellular structure of a beehive). A hive is a discrete body of keys, subkeys, and values that is rooted at the top of the registry hierarchy. A hive is backed by a single file and a .log file, which are in the systemroot\System32\Config or the systemroot\Profiles\username folders.

By default, most hive files (Default, SAM, Security, and System) are stored in the systemroot\System32\Config folder. The systemroot\Profiles folder contains the user profile for each user of the computer. Because a hive is a file, it can be moved from one system to another. However, you must use the Registry Editor to edit the file.

See also: registry; key

Hosts file

A local text file in the same format as the 4.3 Berkeley Software Distribution (BSD) UNIX /etc/hosts file. This file maps host names to IP addresses, and it is stored in the \%Systemroot%\System32\Drivers\Etc folder.

HTML

See Hypertext Markup Language.

HTTP

See definition for: Hypertext Transfer Protocol (HTTP)

Hypertext Markup Language (HTML)

A simple markup language used to create hypertext documents that are portable from one platform to another. HTML files are simple ASCII text files with codes embedded (indicated by markup tags) to denote formatting and hypertext links.

See also: American Standard Code for Information Interchange (ASCII)

Hypertext Transfer Protocol (HTTP)

The protocol used to transfer information on the World Wide Web. An HTTP address (one kind of Uniform Resource Locator [URL]) takes the form: http://www.microsoft.com.

I

infrastructure master

The domain controller assigned to update group-to-user references whenever group memberships are changed, and to replicate these changes to any other domain controllers in the domain. At any time, there can be only one infrastructure master in a particular domain.

See also: domain controller

IntelliMirror

A set of directory-based change and configuration management features introduced in Windows 2000 and enhanced in Windows XP. When IntelliMirror is used in both the server and client, the users' data, applications, and settings follow them when they move to another computer.

Internet Server Application Programming Interface (ISAPI)

An application programming interface that resides on a server computer for initiating software services tuned for Windows operating systems.

IP address

A 32-bit address used to identify a node on an IP internetwork. Each node on the IP internetwork must be assigned a unique IP address, which is made up of the network ID, plus a unique host ID. This address is typically represented with the decimal value of each octet separated by a period (for example, 192.168.7.27). In this version of Windows, you can configure the IP address statically or dynamically through DHCP.

See also: Dynamic Host Configuration Protocol (DHCP)

IPX/SPX

Transport protocols used in Novell NetWare networks, which together correspond to the combination of TCP and IP in the TCP/IP protocol suite. Windows implements IPX through NWLink.

See also: NWLink; Transmission Control Protocol/Internet Protocol (TCP/IP)

ISAPI

See definition for: Internet Server Application Programming Interface (ISAPI)

J

There are no glossary terms that begin with this letter.

K

Kerberos V5 authentication protocol

An authentication mechanism used to verify user or host identity. The Kerberos V5 authentication protocol is the default authentication service for Windows 2000. Internet Protocol security (IPSec) and the QoS Admission Control Service use the Kerberos protocol for authentication.

See also: Key Distribution Center (KDC); ticket-granting service (TGS); ticket-granting ticket (TGT)

kernel

The core of layered architecture that manages the most basic operations of the operating system and the computer's processor. The kernel schedules different blocks of executing code, called threads, for the processor to keep it as busy as possible and coordinates multiple processors to optimize performance. The kernel also synchronizes activities among Executive-level subcomponents, such as I/O Manager and Process Manager, and handles hardware exceptions and other hardware-dependent functions. The kernel works closely with the hardware abstraction layer.

kernel mode

A highly privileged mode of operation where program code has direct access to all memory, including the address spaces of all user-mode processes and applications, and to hardware. Kernel mode is also known as supervisor mode, protected mode, or Ring 0.

key

In Registry Editor, a folder that appears in the left pane of the Registry Editor window. A key can contain subkeys and value entries. For example, Environment is a key of HKEY_CURRENT_USER.

In IP security (IPSec), a value used in combination with an algorithm to encrypt or decrypt data. Key settings for IP security are configurable to provide greater security.

Key Distribution Center (KDC)

A network service that supplies session tickets and temporary session keys used in the Kerberos V5 authentication protocol. In Windows 2000 and Windows XP, the KDC runs as a privileged process on all domain controllers.

See also: Kerberos V5 authentication protocol; ticket-granting service (TGS); ticket-granting ticket (TGT)

Korn shell (ksh)

A command shell which provides the following functionality: file input and output redirection; command-line editing using vi; command history; integer arithmetic; pattern matching and variable substitution; command name abbreviation (aliasing); built-in commands for writing shell programs.

ksh

See definition for: Korn shell (ksh)

L

LAN

See definition for: local area network (LAN)

local area network (LAN)

A communications network connecting a group of computers, printers, and other devices located within a relatively limited area (for example, a building). A LAN allows any connected device to interact with any other on the network.

See also: NetBIOS Extended User Interface (NetBEUI); network basic input/output system (NetBIOS); virtual local area network (VLAN)

Local Security Authority (LSA)

A protected subsystem that authenticates and logs users onto the local system. In addition, the LSA maintains information about all aspects of local security on a system (collectively known as the local security policy), and provides various services for translation between names and identifiers.

M

MAC

See definition for: media access control

Management Information Base (MIB)

A set of objects that represent various types of information about a device, used by Simple Network Management Protocol (SNMP) to manage the device. Because different network management services are used for different types of devices and protocols, each service has its own set of objects.

See also: service; Simple Network Management Protocol (SNMP)

master boot record (MBR)

The first sector on a hard disk, which starts the process of booting the computer. The MBR contains the partition table for the disk and a small amount of executable code called the master boot code.

MBR

See Master Boot Record.

media access control

A sublayer of the IEEE 802 specifications that defines network access methods and framing.

Message Authentication Code (MAC)

An algorithm that ensures the quality of a block of data.

MIB

See Management Information Base.

Microsoft Management Console (MMC)

A framework for hosting administrative tools, called consoles. A console may contain tools, folders or other containers, World Wide Web pages, and other administrative items. These items are displayed in the left pane of the console, called a console tree. A console has one or more windows that can provide views of the console tree.

The main MMC window provides commands and tools for authoring consoles. The authoring features of MMC and the console tree itself may be hidden when a console is in User Mode.

See also: console tree; snap-in

mirror

One of the two volumes that make up a mirrored volume. Each mirror of a mirrored volume resides on a different disk. If one mirror becomes unavailable (due to a disk failure, for example), Windows can use the remaining mirror to gain access to the volume's data.

See also: fault tolerance

mixed mode

The default domain mode setting on Windows 2000 domain controllers. Mixed mode allows Windows NT backup domain controllers to co-exist in a Windows 2000 domain. Mixed mode does not support the universal and nested group enhancements of Windows 2000. You can change the domain mode setting to native mode when all Windows NT domain controllers are removed from a domain.

MMC

See Microsoft Management Console.

N

namespace

A set of unique names for resources or items used in a shared computing environment.

For Microsoft Management Console (MMC), the namespace is represented by the console tree, which displays all of the snap-ins and resources that are accessible to a console.

For Domain Name System (DNS), namespace is the vertical or hierarchical structure of the domain name tree. For example, each domain label, such as host1 or example, used in a fully qualified domain name, such as host1.example.microsoft.com, indicates a branch in the domain namespace tree.

native mode

The condition in which all domain controllers in the domain have been upgraded to Windows 2000 and an administrator has enabled native mode operation (through Active Directory Users and Computers).

NetBEUI

See definition for: NetBIOS Extended User Interface (NetBEUI)

NetBIOS

See network basic input/output system.

NetBIOS Extended User Interface (NetBEUI)

A network protocol native to Microsoft Networking. It is usually used in small, department-size local area networks (LANs) of 1 to 200 clients. It can use Token Ring source routing as its only method of routing. It is the Microsoft implementation of the NetBIOS standard.

See also: Compression Control Protocol (CCP); local area network (LAN); network basic input/output system (NetBIOS); protocol

network basic input/output system (NetBIOS)

An application programming interface (API) that can be used by programs on a local area network (LAN). NetBIOS provides programs with a uniform set of commands for requesting the lower-level services required to manage names, conduct sessions, and send datagrams between nodes on a network.

See also: application programming interface (API); basic input/output system (BIOS); local area network (LAN); service

notification area

The area on the taskbar to the right of the taskbar buttons. The notification area displays the time and can also contain shortcuts that provide quick access to programs, such as Volume Control and Power Options. Other shortcuts can appear temporarily, providing information about the status of activities. For example, the printer shortcut icon appears after a document has been sent to the printer and disappears when printing is complete.

NTFS file system

An advanced file system that provides performance, security, reliability, and advanced features that are not found in any version of FAT. For example, NTFS guarantees volume consistency by using standard transaction logging and recovery techniques. If a system fails, NTFS uses its log file and checkpoint information to restore the consistency of the file system. In Windows 2000 and Windows XP, NTFS also provides advanced features such as file and folder permissions, encryption, disk quotas, and compression.

See also: FAT32; file allocation table (FAT)

NTLM authentication protocol

A challenge/response authentication protocol. The NTLM authentication protocol was the default for network authentication in Windows NT version 4.0 and earlier and Windows Millennium Edition and earlier. The protocol continues to be supported in Windows 2000 and Windows XP but no longer is the default.

NWLink

An implementation of the Internetwork Packet Exchange (IPX), Sequenced Packet Exchange (SPX), and NetBIOS protocols used in Novell networks. NWLink is a standard network protocol that supports routing and can support NetWare client-server applications, where NetWare-aware Sockets-based applications communicate with IPX/SPX Sockets-based applications.

See also: IPX/SPX; network basic input/output system (NetBIOS); Routing Information Protocol over IPX (RIPX)

O

object linking and embedding (OLE)

A method for sharing information among applications. Linking an object, such as a graphic, from one document to another inserts a reference to the object into the second document. Any changes you make in the object in the first document will also be made in the second document. Embedding an object inserts a copy of an object from one document into another document. Changes you make in the object in the first document will not be updated in the second unless the embedded object is explicitly updated.

ODBC

See definition for: open database connectivity (ODBC)

open database connectivity (ODBC)

An application programming interface (API) that enables database applications to access data from a variety of existing data sources.

organizational unit

An Active Directory container object used within domains. An organizational unit is a logical container into which users, groups, computers, and other organizational units are placed. It can contain objects only from its parent domain. An organizational unit is the smallest scope to which a Group Policy object can be linked, or over which administrative authority can be delegated.

See also: Active Directory; Group Policy object

orphan

A member of a mirrored volume or a RAID-5 volume that has failed due to a severe cause, such as a loss of power or a complete hard-disk head failure. When this happens, the fault-tolerant driver determines that it can no longer use the orphaned member and directs all new reads and writes to the remaining members of the fault-tolerant volume.

See also: fault tolerance; RAID-5 volume

P

packet

An Open Systems Interconnection (OSI) network layer transmission unit that consists of binary information representing both data and a header containing an identification number, source and destination addresses, and error-control data.

packet header

In network protocol communications, a specially reserved field of a defined bit length that is attached to the front of a packet for carry and transfer of control information. When the packet arrives at its destination, the field is then detached and discarded as the packet is processed and disassembled in a corresponding reverse order for each protocol layer.

See also: packet

page fault

The interrupt that occurs when software attempts to read from or write to a virtual memory location that is marked not present.

In Task Manager, page fault is the number of times data has to be retrieved from disk for a process because it was not found in memory. The page fault value accumulates from the time the process started.

parity

A calculated value that is used to reconstruct data after a failure. RAID-5 volumes stripe data and parity intermittently across a set of disks. When a disk fails, some server operating systems use the parity information together with the data on good disks to recreate the data on the failed disk.

See also: fault tolerance; RAID-5 volume

parity bit

In asynchronous communications, an extra bit used in checking for errors in groups of data bits transferred within or between computer systems. In modem-to-modem communications, a parity bit is often used to check the accuracy with which each character is transmitted.

See also: parity

partition

A portion of a physical disk that functions as though it were a physically separate disk. After you create a partition, you must format it and assign it a drive letter before you can store data on it.

On basic disks, partitions are known as basic volumes, which include primary partitions and logical drives. On dynamic disks, partitions are known as dynamic volumes, which include simple, striped, spanned, mirrored, and RAID-5 volumes.

partition table

An area of the Master Boot Record that the computer uses to determine how to access the disk. The partition table can contain up to four partitions for each physical disk.

path

A sequence of directory (or folder) names that specifies the location of a directory, file, or folder within the Windows directory tree. Each directory name and file name within the path must be preceded by a backslash (\). For example, to specify the path of a file named Readme.doc located in the Windows directory on drive C, type C:\Windows\Readme.doc.

PCMCIA device

A removable device, approximately the size of a credit card, that can be plugged into a PCMCIA slot in a portable computer. PCMCIA devices can include modems, network adapters, and hard disk drives.

Some PCMCIA cards can be connected to and disconnected from your computer without restarting it. Before you remove the PCMCIA card, however, you should use the Add Hardware Wizard to notify Windows that you are doing so. Windows will then notify you when you can remove the device.

Performance Monitor

A Windows NT administrative tool that monitors performance on local or remote computers. Performance Monitor is replaced by the Performance console in Windows 2000.

permission

A rule associated with an object to regulate which users can gain access to the object and in what manner. Permissions are granted or denied by the object's owner.

POP

See definition for: Post Office Protocol

Portable Operating System Interface for UNIX (POSIX)

An Institute of Electrical and Electronics Engineers (IEEE) standard that defines a set of operating-system services. Programs that adhere to the POSIX standard can be easily ported from one system to another. POSIX was based on UNIX system services, but it was created in a way that allows it to be implemented by other operating systems.

See also: service

POSIX

See definition for: Portable Operating System Interface for UNIX (POSIX)

Post Office Protocol

A maildrop service that allows a client to retrieve mail that the server is holding for it. The most recent implementation is Version 3, or POP3.

primary domain controller (PDC)

In a Windows NT Server 4.0 or earlier domain, the computer running Windows NT Server that authenticates domain logons and maintains the directory database for a domain. The PDC tracks changes made to accounts of all computers on a domain. It is the only computer to receive these changes directly. A domain has only one PDC. In this version of Windows, one of the domain controllers in each domain is identified as the PDC for compatibility with Windows NT 4.0 and earlier versions of Windows NT.

See also: mixed mode

printer

A device that puts text or images on paper or other print media. Examples are laser printers or dot-matrix printers.

process

An operating system object that consists of an executable program, a set of virtual memory addresses, and one or more threads. When a program runs, a Windows 2000 process is created.

protocol

A set of rules and conventions for sending information over a network. These rules govern the content, format, timing, sequencing, and error control of messages exchanged among network devices.

Q

Quality of Service (QoS)

A set of quality assurance standards and mechanisms for data transmission, implemented in this version of Windows.

R

RAID-5 volume

A fault-tolerant volume with data and parity striped intermittently across three or more physical disks. Parity is a calculated value that is used to reconstruct data after a failure. If a portion of a physical disk fails, Windows recreates the data that was on the failed portion from the remaining data and parity. You can create RAID-5 volumes only on dynamic disks, and you cannot mirror or extend RAID-5 volumes.

See also: fault tolerance; parity

RAS

See definition for: Remote Access Service (RAS)

reduced instruction set computing

A type of microprocessor design that focuses on rapid and efficient processing of a relatively small set of instructions. RISC architecture limits the number of instructions that are built into the microprocessor, but optimizes each so it can be carried out very rapidly{bmct emdash.bmp}usually within a single clock cycle.

Redundant Array of Independent Disks (RAID)

A method used to standardize and categorize fault-tolerant disk systems. RAID levels provide various mixes of performance, reliability, and cost. Some servers provide three of the RAID levels: Level 0 (striping), Level 1 (mirroring), and Level 5 (RAID-5).

registry

A database repository for information about a computer's configuration. The registry contains information that Windows continually references during operation, such as:

  • Profiles for each user.
  • The programs installed on the computer and the types of documents each can create.
  • Property settings for folders and program icons.
  • What hardware exists on the system.
  • Which ports are being used.

The registry is organized hierarchically as a tree and is made up of keys and their subkeys, hives, and value entries.

See also: hive; key

relative ID (RID)

The part of a security ID (SID) that uniquely identifies an account or group within a domain.

See also: domain; forest; security ID (SID)

remote access

Part of the integrated Routing and Remote Access service that provides remote networking for telecommuters, mobile workers, and system administrators who monitor and manage servers at multiple branch offices. Users with a computer running Windows and Network Connections can dial in to remotely access their networks for services such as file and printer sharing, electronic mail, scheduling, and SQL database access.

See also: service

Remote Access Service (RAS)

A Windows NT 4.0 service that provides remote networking for telecommuters, mobile workers, and system administrators who monitor and manage servers at multiple offices.

remote procedure call (RPC)

A message-passing facility that allows a distributed application to call services that are available on various computers on a network. Used during remote administration of computers.

See also: service

remote procedure call (RPC) service

The RPC subsystem for Windows NT and Windows 2000. The RPC subsystem includes the endpoint mapper and other RPC services.

reparse points

NTFS file system objects that have a definable attribute containing user-controlled data and are used to extend functionality in the input/output (I/O) subsystem.

replication

The process of copying data from a data store or file system to multiple computers to synchronize the data. Active Directory provides multimaster replication of the directory between domain controllers within a given domain. The replicas of the directory on each domain controller are writable. This allows updates to be applied to any replica of a given domain. The replication service automatically copies the changes from a given replica to all other replicas.

See also: Active Directory

Request for Comments (RFC)

An official document of the Internet Engineering Task Force (IETF) that specifies the details for protocols included in the TCP/IP family.

See also: protocol; Transmission Control Protocol/Internet Protocol (TCP/IP)

resource

Generally, any part of a computer system or network, such as a disk drive, printer, or memory, that can be allotted to a running program or a process.

For Device Manager, any of four system components that control how the devices on a computer work. These four system resources are interrupt request (IRQ) lines, direct memory access (DMA) channels, input/output (I/O) ports, and memory addresses.

For server clusters, a physical or logical entity that is capable of being managed by a cluster, brought online and taken offline, and moved between nodes. A resource can be owned only by a single node at any point in time.

See also: resource

Resource DLL

A dynamic-link library (DLL) containing an implementation of the Resource application programming interface (API) for a specific type of resource. The Resource DLL is loaded into the address space of its Resource Monitor.

See also: application programming interface (API); dynamic-link library (DLL)

Resource Reservation Protocol (RSVP)

A signaling protocol that allows the sender and receiver in a communication to set up a reserved highway for data transmission with a specified quality of service.

ring transition

A ring transition or kernel-mode transition occurs when user-mode processes use application program interfaces (APIs) to switch their threads from user mode to kernel mode.

RISC

See definition for: reduced instruction set computing

router

In a Windows environment, hardware that helps LANs and WANs achieve interoperability and connectivity, and can link LANs that have different network topologies (such as Ethernet and Token Ring). Routers match packet headers to a LAN segment and choose the best path for the packet, optimizing network performance.

In the Macintosh environment, routers are necessary for computers on different physical networks to communicate with each other. Routers maintain a map of the physical networks on a Macintosh internet (network) and forward data received from one physical network to other physical networks. Computers running the Server version of Windows with AppleTalk network integration can act as routers, and you can also use other routing hardware on a network with AppleTalk network integration.

See also: local area network (LAN); packet header; Routing Information Protocol over IPX (RIPX); static routes; wide area network (WAN)

Routing Information Protocol over IPX (RIPX)

A protocol used by routers to exchange information between routers on an IPX network and by hosts to determine the best router to use when forwarding IPX traffic to a remote IPX network.

See also: NWLink; protocol; router

RPC

See remote procedure call.

RPC service

See definition for: remote procedure call (RPC) service

S

SAM

See Security Accounts Manager.

schema

A description of the object classes and attributes stored in Active Directory. For each object class, the schema defines the attributes an object class must have, the additional attributes it may have, and the object class that can be its parent.

The Active Directory schema can be updated dynamically. For example, an application can extend the schema with new attributes and classes and use the extensions immediately. Schema updates are accomplished by creating or modifying the schema objects stored in Active Directory. Like every object in Active Directory, schema objects have an access control list, so only authorized users may alter the schema.

See also: access control list (ACL); Active Directory

script

A type of program consisting of a set of instructions to an application or tool program. A script usually expresses instructions by using the application's or tool's rules and syntax, combined with simple control structures such as loops and if/then expressions. "Batch program" is often used interchangeably with "script" in the Windows environment.

SCSI

See definition for: small computer system interface (SCSI)

secondary master

An authoritative DNS server for a zone that is used as a source for replication of the zone to other servers. Secondary masters update their zone data only by transferring zone data from other DNS servers. They do not have the ability to perform zone updates.

Security Accounts Manager (SAM)

A Windows service used during the logon process. SAM maintains user account information, including groups to which a user belongs.

See also: service

security descriptor

A data structure that contains security information associated with a protected object. Security descriptors include information about who owns the object, who can access it and in what way, and what types of access will be audited.

See also: permission

security ID (SID)

A data structure of variable length that identifies user, group, and computer accounts. Every account on a network is issued a unique SID when the account is first created. Internal processes in Windows refer to an account's SID rather than the account's user or group name.

Server Message Block (SMB)

A file-sharing protocol designed to allow networked computers to transparently access files that reside on remote systems over a variety of networks. The SMB protocol defines a series of commands that pass information between computers. SMB uses four message types: session control, file, printer, and message.

service

A program, routine, or process that performs a specific system function to support other programs, particularly at a low (close to the hardware) level. When services are provided over a network, they can be published in Active Directory, facilitating service-centric administration and usage. Some examples of services are the Security Accounts Manager service, File Replication service, and Routing and Remote Access service.

sh

See shell (sh).

share

To make resources, such as folders and printers, available to others.

See also: resource

shared resource

Any device, data, or program that is used by more than one other device or program. For Windows, shared resources refer to any resource that is made available to network users, such as folders, files, printers, and named pipes. A shared resource can also refer to a resource on a server that is available to network users.

See also: resource

shell (sh)

A command-line POSIX tool that contains a large subset of Korn shell functionality (though no variable arrays).

Simple Mail Transfer Protocol (SMTP)

A member of the TCP/IP suite of protocols that governs the exchange of electronic mail between message transfer agents.

See also: protocol; Transmission Control Protocol/Internet Protocol (TCP/IP)

Simple Network Management Protocol (SNMP)

A network protocol used to manage TCP/IP networks. In Windows, the SNMP service is used to provide status information about a host on a TCP/IP network.

See also: protocol; service; Transmission Control Protocol/Internet Protocol (TCP/IP)

simple volume

A dynamic volume made up of disk space from a single dynamic disk. A simple volume can consist of a single region on a disk or multiple regions of the same disk that are linked together. You can extend a simple volume within the same disk or onto additional disks. If you extend a simple volume across multiple disks, it becomes a spanned volume. You can create simple volumes only on dynamic disks. Simple volumes are not fault tolerant, but you can mirror them to create mirrored volumes.

See also: fault tolerance; spanned volume

small computer system interface (SCSI)

A standard high-speed parallel interface defined by the American National Standards Institute (ANSI). A SCSI interface is used for connecting microcomputers to peripheral devices such as hard disks and printers, and to other computers and local area networks (LANs).

See also: local area network (LAN)

SMB

See definition for: Server Message Block (SMB)

SMTP

See definition for: Simple Mail Transfer Protocol (SMTP)

snap-in

A type of tool you can add to a console supported by Microsoft Management Console (MMC). A stand-alone snap-in can be added by itself; an extension snap-in can only be added to extend the function of another snap-in.

See also: Microsoft Management Console (MMC)

spanned volume

A dynamic volume consisting of disk space on more than one physical disk. You can increase the size of a spanned volume by extending it onto additional dynamic disks. You can create spanned volumes only on dynamic disks. Spanned volumes are not fault tolerant and cannot be mirrored.

See also: fault tolerance; simple volume

SQL

See definition for: structured query language (SQL)

standard error (STDERR)

In UNIX, the defined receiver of error messages about a process. By default, the standard error goes to the terminal.

standard input (STDIN)

In UNIX, the defined source of input for a process. By default, standard input comes from the terminal.

standard output (STDOUT)

In UNIX, the defined receiver for output from a process. By default, the standard output goes to the terminal.

static routes

Routes in the routing table that are permanent. Static routes are manually configured by a network administrator. They change only if the network administrator changes them. If the routing protocol is configured to support auto-static routes (automatically added static routes), then the router can issue a request to a protocol to get an update of routing information on a specific interface. The results of such an update are then converted and kept as static routes.

See also: protocol; router

structured query language (SQL)

A widely accepted standard database sublanguage used in querying, updating, and managing relational databases.

subnet mask

A 32-bit value that enables the recipient of IP packets to distinguish the network ID and host ID portions of the IP address. Typically, subnet masks use the format 255.x.x.x.

system tray

See definition for: notification area

T

TCP

Transmission Control Protocol.

TCP/IP

See definition for: Transmission Control Protocol/Internet Protocol (TCP/IP)

TDI

See Transport Driver Interface.

Telephony API (TAPI)

An application programming interface (API) used by communications programs to work with telephony and network services. Communications programs like HyperTerminal and Phone Dialer use TAPI to dial, answer, and route telephone calls on conventional telephony devices, including PBXs, modems, and fax machines. TAPI 3.0 also provides Internet Protocol (IP) telephony support, which Phone Dialer and other programs use to transmit, route, and control real-time audio and video signals over IP-based networks such as the Internet.

See also: application programming interface (API); service

Telnet

A terminal-emulation protocol that is widely used on the Internet to log on to network computers. Telnet also refers to the application that uses the Telnet protocol for users who log on from remote locations.

See also: protocol

thread

A type of object within a process that runs program instructions. Using multiple threads allows concurrent operations within a process and enables one process to run different parts of its program on different processors simultaneously. A thread has its own set of registers, its own kernel stack, a thread environment block, and a user stack in the address space of its process.

ticket

A set of identification data for a security principle, issued by a domain controller for purposes of user authentication. Two forms of tickets in Windows are ticket-granting tickets (TGTs) and service tickets.

See also: domain controller; ticket-granting ticket (TGT)

ticket-granting service (TGS)

A Kerberos V5 service provided by the Kerberos V5 Key Distribution Center (KDC) service that issues service tickets that allow users to authenticate to services in a domain.

See also: Kerberos V5 authentication protocol; Key Distribution Center (KDC); ticket-granting ticket (TGT)

ticket-granting ticket (TGT)

A credential issued to a user by the Kerberos Key Distribution Center (KDC) when the user logs on. The user must present the TGT to the KDC when requesting session tickets for services. Because a TGT is normally valid for the life of the user's logon session, it is sometimes called a user ticket.

See also: Kerberos V5 authentication protocol; Key Distribution Center (KDC); ticket-granting service (TGS)

touch

Command-line POSIX tool which changes the modification date of files.

Transmission Control Protocol/Internet Protocol (TCP/IP)

A set of networking protocols widely used on the Internet that provides communications across interconnected networks of computers with diverse hardware architectures and various operating systems. TCP/IP includes standards for how computers communicate and conventions for connecting networks and routing traffic.

See also: protocol

Transport Driver Interface (TDI)

In the Windows NT and Windows 2000 networking model, a common interface for network layer components. The TDI is not a single program, but a protocol specification to which the upper bounds of transport protocol device drivers are written. It allows software components above and below the transport layer to be mixed and matched without reprogramming.

transport protocol

A protocol that defines how data should be presented to the next receiving layer in the Windows NT and Windows 2000 networking model and packages the data accordingly. The transport protocol passes data to the network adapter driver through the Network Driver Interface Specification (NDIS) interface and to the redirector through the Transport Driver Interface (TDI).

trust relationship

A logical relationship established between domains to allow pass-through authentication, in which a trusting domain honors the logon authentications of a trusted domain. User accounts and global groups defined in a trusted domain can be given rights and permissions in a trusting domain, even though the user accounts or groups don't exist in the trusting domain's directory.

See also: permission; domain

tunnel server

A server or router that terminates tunnels and forwards traffic to the hosts on the target network.

See also: router

U

Unicode

A character encoding standard developed by the Unicode Consortium that represents almost all of the written languages of the world. The Unicode character repertoire has multiple representation forms, including UTF-8, UTF-16, and UTF-32. Most Windows interfaces use the UTF-16 form.

See also: American Standard Code for Information Interchange (ASCII); Unicode Character System (UCS)

Unicode Character System (UCS)

An international standard character set reference that is part of the Unicode standard. The most widely held existing version of the UCS standard is UCS-2, which specifies 16-bit character values currently accepted and recognized for use to encode most of the world's languages.

See also: Unicode; American Standard Code for Information Interchange (ASCII)

Uniform Resource Locator (URL)

An address that uniquely identifies a location on the Internet. A URL for a World Wide Web site is preceded with http://, as in the fictitious URL http://www.example.microsoft.com/. A URL can contain more detail, such as the name of a page of hypertext, usually identified by the file name extension .html or .htm.

uninterruptible power supply (UPS)

A device connected between a computer and a power source to ensure that electrical flow is not interrupted. UPS devices use batteries to keep the computer running for a period of time after a power failure. UPS devices usually provide protection against power surges and brownouts as well.

Universal Naming Convention (UNC)

A convention for naming files and other resources beginning with two backslashes (\), indicating that the resource exists on a network computer. UNC names conform to the \\SERVERNAME\SHARENAME syntax, where SERVERNAME is the server's name and SHARENAME is the name of the shared resource. The UNC name of a directory or file can also include the directory path after the share name, with the following syntax: \\SERVERNAME\SHARENAME\DIRECTORY\FILENAME.

universal serial bus (USB)

An external bus that supports Plug and Play installation. Using USB, you can connect and disconnect devices without shutting down or restarting your computer. You can use a single USB port to connect up to 127 peripheral devices, including speakers, telephones, CD-ROM drives, joysticks, tape drives, keyboards, scanners, and cameras. A USB port is usually located on the back of your computer near the serial port or parallel port.

UNIX

A powerful, multiuser, multitasking operating system initially developed at AT&T Bell Laboratories in 1969 for use on minicomputers. UNIX is considered more portable, that is, less computer-specific, than other operating systems because it is written in C language. Newer versions of UNIX have been developed at the University of California at Berkeley and by AT&T.

URL

See definition for: Uniform Resource Locator (URL)

user profile

A file that contains configuration information for a specific user, such as desktop settings, persistent network connections, and application settings. Each user's preferences are saved to a user profile that Windows uses to configure the desktop each time a user logs on.

UUEncoding/Decoding

A form of encoding and decoding that allows binary files to be sent as e-mail. A binary file, such as a program or image, cannot be sent directly over the Internet by e-mail. To send such a file, you must first encode it to hide the control characters. This encoding can be accomplished by converting the binary file to a text file. UUEncoding carries out this conversion, and UUDecoding regenerates the original file.

V

variable

In programming, a named storage location capable of containing a certain type of data that can be modified during program execution.

System environment variables are defined by Windows 2000 Server and are the same no matter who is logged on to the computer. Administrator group members can add new variables or change the values, however.

User environment variables can be different for each user of a particular computer. They include any environment variables you want to define or variables defined by your applications, such as the path where application files are located.

See also: environment variable

virtual local area network (VLAN)

A logical grouping of hosts on one or more LANs that allows communication to occur between hosts as if they were on the same physical LAN.

See also: local area network (LAN)

VoIP (Voice over Internet Protocol)

A method for sending voice over a LAN, a WAN, or the Internet using TCP/IP packets.

See also: local area network (LAN); Transmission Control Protocol/Internet Protocol (TCP/IP); wide area network (WAN)

volume set

A partition consisting of disk space on one or more physical disks that was created with Windows NT 4.0 or earlier. You can delete volume sets only with Windows&nsbsp;2000 or Windows XP. To create new volumes that span multiple disks, use spanned volumes on dynamic disks.

See also: partition; spanned volume

voluntary tunnel

A tunnel that is initiated by the client. It tunnels PPP over IP from the client to the tunnel server, then the data is forwarded to the target host by the tunnel server.

See also: tunnel server

W

WAN

See definition for: wide area network (WAN)

wc

Word count. Command-line POSIX tool that returns the number of bytes, words, and lines in files.

wide area network (WAN)

A communications network connecting geographically separated computers, printers, and other devices. A WAN allows any connected device to interact with any other on the network.

See also: local area network (LAN)

Windows Internet Name Service (WINS)

A software service that dynamically maps IP addresses to computer names (NetBIOS names). This allows users to access resources by name instead of requiring them to use IP addresses that are difficult to recognize and remember. WINS servers support clients running Windows NT 4.0 and earlier versions of Microsoft operating systems.

See also: Domain Name System (DNS); network basic input/output system (NetBIOS); resource; service; WINS resource; IP address

WINS

See definition for: Windows Internet Name Service (WINS)

WINS resource

A resource type that provides Windows Internet Name Service (WINS) from a cluster.

See also: cluster; Windows Internet Name Service (WINS)

X

X.500

A set of standards defining a distributed directory service, developed by the International Standards Organization (ISO).

Y

There are no glossary terms that begin with this letter.

Z

There are no glossary terms that begin with this letter.


This program could not start.

The operating system could not start this program. Some possible solutions are:

If your computer is on a network, contact your system administrator.

If a system administrator controls your computer, you should ask the administrator why you cannot start the program. Your administrator may have removed the program or set a policy that prevents you from starting it.

Install the necessary hardware.

Some programs are installed automatically when you install the hardware associated with them. To install new hardware click Start, point to Settings, click Control Panel, and then double-click Add Hardware.

Install the necessary software.

The program might not be installed on your computer because:

  • It is an optional component. To install optional components, click Start, point to Settings, click Control Panel, and then double-click Add or Remove Programs.
  • You have not installed the hardware that uses this program. To install new hardware click Start, point to Settings, click Control Panel, and then double-click Add Hardware.
  • If your computer is on a network, your system administrator may have removed this program or set a policy that prevents you from starting it.

Reinstall the program file.

The program file may have been accidentally deleted or corrupted. If you know the name of the file that is missing, you can copy the compressed version from the operating system installation compact disc to your hard drive, and then restore it by doing the following:

  1. Insert the installation compact disc.
  2. Click Browse the CD.
  3. In the folder list, open either the Alpha or I386 folder.
  4. Find the name of the missing file.

    NOTE: The last letter in the file name extension will be replaced by an underscore because it is a compressed version of the file. For example, notepad.exe is called notepad.ex_ on the installation compact disc.

  5. Copy the compressed file to your systemroot\System32 folder on your hard drive.
  6. Click Start, point to Programs, and then click Command Prompt.
  7. At the command prompt, type:

expand %systemroot%\system32\
my_file_name.ex_

%systemroot%\system32\
my_file_name.exe
    and then press ENTER.


This information is not available

The information you are trying to locate is not available on this computer.

Try the following Web sites:

  • Windows Resource Kits (http://go.microsoft.com/fwlink/?LinkId=291)
  • Microsoft Press (http://go.microsoft.com/fwlink/?LinkId=215)
  • Microsoft Windows (http://go.microsoft.com/fwlink/?LinkId=622)
  • Microsoft Product Support (http://go.microsoft.com/fwlink/?LinkId=281)
  • Microsoft Technet (http://go.microsoft.com/fwlink/?LinkId=170)
  • Microsoft MSDN (http://go.microsoft.com/fwlink/?LinkId=140)


About this Help file

This Help file contains topics integrated into the main Windows Help and is not meant for browsing. For overviews of features and help with specific tasks, click Start, and then click Help.