karthik's blog

While troubleshooting, most of the times you can see Windows OS is throwing error in Hexadecimal code. You may find this error in event viewer or msi logs, or CBS logs. Most of the time there wont be any description for this error code in the logs or events. You can convert this error codes into Simple error description. Here I am going to show how to do this. Lets take the below error code as an example. You can see from the above error message that calling of vbscript.dll was failed with error code 0x80004005. The error code is in Hexadecimal. You have to convert the code into decimal before finding out its error description. Lets convert the code 0x80004005 in to decimal. You donot need to convert whole number into decimal. Take only last four or three last digits from the error code. Here we are going to convert last 3 digit of the error code "005".  Open the calculator in Programmer mode.   Enter the value in Hexadecimal Click on Decimal to ge...

  resolution for “Unable to Start Windows Event Log service”. When you try to start the Windows Event Log service from the services console on either Windows Server 2008 computers, the Windows Event Log service fails. Additionally, you receive the following error message: "Error 5: Access denied" CAUSE This problem happens if any of the following conditions are true. 1. The built-in security group EventLog missing permission on folder C:\Windows\System32\winevt\Logs 2. Local Service account do not have default permission on registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Reliability *** Resolution *** Default permissions on C:\Windows\system32\winevt\logs Folder should be Authenticated user - List folder/read data, Read attributes, Read Extended attributes, Read permissions Administrators - Full control SYSTEM - Full control EventLog - Full control To restore default permissions on folder "C:\Windows\system32\winevt\logs", follow these steps. 1. Rig...

Microsoft provides two types of cluster: 1. Network load balancing 2. Windows Fail over cluster (For 2008 on wards servers), Microsoft Cluster service (For 2003 and before servers). First one is to distribute the network traffic on servers Using virtual IP address. NLB (Network Load Balancing) Suppose there are two nodes in NLB , both the nodes will host the website. Client accessing the website will be redirected to anyone of the node depending upon configuration of NLB (By default it works on round robin methods) Microsoft Cluster Service (MSCS) Unlike NLB , in MSCS, resource will be online at only one of the nodes at a time . Microsoft Cluster Service is based on the shared-nothing clustering model. The shared-nothing model dictates that while several nodes in the cluster may have access to a device or resource, the resource is owned and managed by only one system at a time. There are mainly three Components of MSCS: 1.Cluster service 2. Resource monitor 3.Resource DLL. Suppose You...

The default user profile is located in C:\Users\default and it is used for customizing the user profiles for the new users logging in to the machine. When the new user logs into the machine it will fetch the profile configuration information from the default folder and creates its own new user profile in C:\users\%username%.   For examples if we decide what are the favorites links should appear in new user’s internet explorer, we need to just copy the favorite links to the default folder in C:\users\default\.   So that the new user logs in to the machine for the first time, all the favorites will be copied into the C:\users\%username%\favorites folder. I have found an issue where the favorites links are not copying to the new users directory. The issue was that the files are copying from the default folder to the new user’s favorites  folder when he logs in. But it got deleted automatically when user launches IE. I have reset the IE settings but still the issue was...

Here I am going to show you how to analyze the minidump file to identify the cause of BSOD which  happend in my laptop. The minidump file will be located in C:\Windows\minidump\ where we can find the dump file in date month year time format. eg: 150513-22994-01.dmp. You have to download the Windbg tool from the below link to analyze the minidump file. http://msdn.microsoft.com/en-US/windows/hardware/gg463009/ After installation of the Windbg tool, you have to configure the sysmbol path before analayzing the dump file. You can set the sysmbol path by going to File menu, Select Symbol file path and add the below line SRV*c:\localsymbols*http://msdl.microsoft.com/download/symbols Now your Windbg tool is ready for analyzing the dump file. You can open the dump file by clicking on File menu and then open crashdump. Then enetr the command !analyze -v in the console as shown in the below figure. After executing the command you can see a lot of information....

If you want to enable features like Telnet , ISS in Windwso 7 you may have to go to Windows feature on or off from Programs and features of control panel. Some times you may get a blank window as below There may be multilple reason you may get this above issue. I have come accross same issue and resolved it. The generic steps for resolving the issue is explained here. Step 1: Perform a SFC /Scannow to scan all protected system files and repair it. Ref: http://support.microsoft.com/kb/931712 Step 2 : If step 1 doesnot helped you, then run System update readiness tool on the machine and look for the errors generated in C:\windows\logs\cbs\checksur.log. You can download the system update readiness tool  from microsoft. 32bit : http://www.microsoft.com/en-us/download/details.aspx?id=3132 64bit : http://www.microsoft.com/en-us/download/details.aspx?id=20858 I ran the tool on the problamatic machine and found the following entries in it. ---------------------------...

Sfc /scannow will inspect all of the important Windows files on your computer, including Windows DLL files. If System File Checker finds an issue with any of these protected files, it will replace it. You can find the sfc logs inside CBS.log under C:\Windows\logs\CBS\ folder. There will be a lot of entries in cbs logs. You can filter out the log for SFC by running the below command.  findstr /c:"[SR]" cbs.log > sfcdetails.txt The above command will search for the string [SR] and if it found , then it copies the corresponding entry in to the sfcdetails.txt Below is sample text extracted from CBS log by using the above command ----------------------------------------------------------------------------------------------------------- 2013-06-24 12:55:44, Info                  CSI    00000210 [SR] Verify complete 2013-06-24 12:55:44, Info      ...

When you enable userenv logging, you can perform debug logging of the user profile and the system policy processes. Userenv log files also contain information about the status of each Group Policy extension, such as Application Deployment, Security, and Folder Redirection. Userenv log files reveal what is occurring in the background as a user logs on   Userenv.log file located in the %SystemRoot%\Debug\UserMode folder Userenv log files contains information about the following: Group Policy settings that are not processed or not applied as expected Folder redirection that does not occur Profile or registry hive load, unload, or deletion failures Logon script, or script not applied as expected Default behaviors occurring because a slow link was detected Roaming profile issues Slow logon issues Whether a given GPO is accessible, and if not, why access was denied. The name of the domain controller that is accessing SYSVOL. The Userenv log has a maximum size of 1 meg...

1.      !thread/!process [address] e - on x64 will not show you the meaningless Args to Child information. 2.      .frame /c [FrameNumber] - sets context to specificied stack frame. On x64 provides more reliable register information than .trap. 3.      kn - Dumps call stack with frame numbers, easier than counting stacks for .frame. 4.      .frame /r [FrameNumber] - same as .frame /c, but shows registers without changing context.Note: With .frame /c or /r you can only trust the nonvolatile registers.  5.      k=rbp rip FrameCount - Dumps call stack starting at rbp/rip on x64. Useful when the stack is corrupt. 6.      .process/.thread /p /r [address] - sets new process context, sets .cache forcedecodeuser, and reloads user symbols. 7.      !process [address] 17 - Sets the context for this command, avoids the need for .process...

Address Windowing Extensions (AWE) is a set of extensions that allows an application to quickly manipulate physical memory greater than 4GB. Certain data-intensive applications, such as database management systems and scientific and engineering software, need access to very large caches of data. In the case of very large data sets, restricting the cache to fit within an application's 2GB of user address space is a severe restriction. In these situations, the cache is too small to properly support the application. AWE solves this problem by allowing applications to directly address huge amounts of memory while continuing to use 32-bit pointers. AWE allows applications to have data caches larger than 4GB (where sufficient physical memory is present). AWE uses physical nonpaged memory and window views of various portions of this physical memory within a 32-bit virtual address space. AWE places a few restrictions on how this memory may be used, primarily because these rest...

. Active Directory (AD) uses DNS as its locator service to support the various types of services that AD offers, such as Global Catalog (GC), Kerberos, and Lightweight Directory Access Protocol (LDAP). Other non-Microsoft services can be advertised in the DNS, including--but not restricted to--non-Microsoft implementations of LDAP and GC. However, sometimes clients might need to contact a Microsoft-hosted service. For that reason, each domain in DNS has an _msdcs subdomain that hosts only DNS SRV records that are registered by Microsoft-based services. The Netlogon process dynamically creates these records on each domain controller (DC). The _msdcs subdomain also includes the globally unique identifier (GUID) for all domains in the forest and a list of GC servers. If you install a new forest on a system that runs Windows Server 2003 and let the Dcpromo wizard configure DNS, Dcpromo will actually create a separate zone called _msdcs.&ltforest name&gt on the DNS s...

All of the objects in the Active Directory forest are represented in the Directory Tree. A Directory Tree is a hierarchy of objects and containers in a directory that can be viewed graphically as an upside-down tree, with the root object at the top. A tree shows how objects are connected in terms of the path from one object to another. The Directory Tree of Active Directory tree is partitioned to allow sections to be distributed (replicated) to domain controllers in different domains within the forest. Each domain controller stores a copy of a specific part of the directory tree, called a “Naming Context” also know as Directory Partition. “Naming Context” is replicated as a unit to other domain controllers in the forest that contain a replica of the same sub tree. A “Naming Context” is also called a Directory Partition. In Active Directory, a single server always holds at least three naming contexts: Schema Naming Context Sche...

OU are logical containers in a domain. They can contain users group, computers and other OUs, but only from home domain. you cant put gloal groups or computers from other domains into your domains OU An OU is a container , but not just as container like the users container in DSA.MSC. you can delegate control of container , ut you cant apply group policy to one. How are OU different from groups? a user can e a member of many groups but can only e in one OU at a time. Like groups OU can contain other OU. Groupname appear in ACL (Access control list) but not OU

What’s New in Windows Server 2008 Active Directory Domain Services? Active Directory Domain Services in Windows Server 2008 provides a number of enhancements over previous versions, including these: Auditing —AD DS auditing has been enhanced significantly in Windows Server 2008. The enhancements provide more granular auditing capabilities through four new auditing categories: Directory Services Access, Directory Services Changes, Directory Services Replication, and Detailed Directory Services Replication. Additionally, auditing now provides the capability to log old and new values of an attribute when a successful change is made to that attribute. Fine-Grained Password Policies —AD DS in Windows Server 2008 now provides the capability to create different password and account lockout policies for different sets of users in a domain. User and group password and account lockout policies are defined and applied via a Password Setting Object (PSO). A PSO has attributes for all ...

The debugging information can be written to different file formats (also known as memory dump files) when your computer stops unexpectedly because of a Stop error (also known as a "blue screen," system crash, or bug check). You can also configure Windows not to write debugging information to a memory dump file. Windows can generate any one of the following memory dump file types: Complete memory dump Kernel memory dump Small memory dump (64 KB) Complete memory dump A complete memory dump records all the contents of system memory when your computer stops unexpectedly. A complete memory dump may contain data from processes that were running when the memory dump was collected. If you select the Complete memory dump option, you must have a paging file on the boot volume that is sufficient to hold all the physical RAM plus 1 megabyte (MB). If a second problem occurs and another complete memory dump (or kernel memory dump) file is c...