18-13 2. In the Control Panel window, click Performance And Maintenance. 3. In the Performance And Maintenance window, click Administrative Tools. 4. In the Administrative Tools window, double-click Event Viewer. 5. In the left pane, click the log you want to view. Windows displays the events in the log file in the right window, as shown in Fig- ure 18-7. F18us07 Figure 18-7 Use Event Viewer to view information contained in Windows XP Professional logs. You will encounter five types of events in the logs you view in Event Viewer. A unique icon identifies each event type so that you can easily distinguish between entries. The five types of events you will encounter are as follows: Error This type of entry, indicated by an icon with a red X, means that a significant problem has occurred, such as a service that might not have started properly. Warning This type of entry, indicated by an icon with a yellow exclamation point, means that an event has occurred that is not currently detrimental to the system but might indicate a possible future problem. Information This type of entry, indicated by an icon with a blue “i,” means that a successful operation has occurred. For example, a service starting successfully might trigger this type of event. Audit Success This type of entry, indicated by a key icon, means that an audited security access attempt—for example, a successful logon to the system—was suc- cessful. Audit Failure This type of entry, indicated by a lock icon, means that an audited security access attempt—for example, a failed attempt to open an audited file or directory—was not successful. Lesson 2 Using Event Viewer 18-14 Chapter 18 Using Windows XP Tools How to View an Event Double-click any event in the right pane of Event Viewer to open the Event Properties dialog box (see Figure 18-8), which shows a description of the event. The up and down arrow buttons let you move through the events in the log without having to close the Event Properties dialog box and then reopen it for each event you want to view. The Copy button (showing the Copy icon) copies the information about the event to the Windows Clipboard. F18us08 Figure 18-8 Open an event’s Properties dialog box to see a description of the event. The Event Properties dialog box contains the following information to help you iden- tify an event: Date and Time The date and time that the event occurred. Type The type of event (Information, Warning, and so on). User The user with which the event is associated. Many events do not have an asso- ciated user. Computer The computer on which the event occurred. Source The service that experienced the event. Category The category associated with the event. Most events, particularly in the System log, do not have categories. Some application developers specify a cate- gory for events that concern the application, so you will see some events in the Application log that have an associated category. In the Security log, the category indicates the type of event that was audited. 18-15 Event ID The Event ID number associated with the event. Microsoft keeps track of Event IDs and often makes solutions to problems available in the Microsoft Knowledge Base. To find out more about an event, use the Event ID as a keyword search in the Knowledge Base. Description A description of the event. The description often includes informa- tion on other services affected by the event and a link for finding out more information. How to Locate Events In a Log When you first start Event Viewer, it automatically displays all events that are recorded in the selected log. Because many events occur on a computer running Windows XP Professional, the number of events displayed can make it difficult to find the events you are looking for. To change what appears in the log, you can locate selected events by using the Filter command. You can also search for specific events by using the Find command. To filter or find events, start Event Viewer, and then on the View menu, click Filter or click Find. The options provided by Filter and Find are almost identical. Figure 18-9 shows the options available on the Filter tab. F18us09 Figure 18-9 You can apply a filter to make it easier to locate certain types of events. Table 18-2 describes the options for using the Filter tab to filter events and the Find command to find events. Lesson 2 Using Event Viewer 18-16 Chapter 18 Using Windows XP Tools Logging Options You can configure the properties of each individual log. To configure the settings for logs, right-click the log in Event Viewer, and then click Properties to display the Prop- erties dialog box for the log. Use the Properties dialog box for each type of audit log to control the following: ■ The maximum size of each log, which can be from 64 KB to 4,194,240 KB (4 GB). The default size is 512 KB. ■ The action that Windows XP Professional takes when the log fills up. To control this action, click one of the options described in Table 18-3. Table 18-2 Options for Filtering and Finding Events Option Description Event Types The types of events to view Event Source The software or component driver that logged the event Category The type of event, such as a logon or logoff attempt or a system event Event ID An event number to identify the event. This number helps product sup- port representatives track events. User A user logon name Computer A computer name From And To The date ranges for which to view events (Filter dialog box only) Restore Defaults Clears any changes in this tab and restores all defaults Description The text that is in the description of the event (Find dialog box only) Search Direction The direction (up or down) in which to search the log (Find dialog box only) Find Next Finds and displays the next occurrence defined by the Find Settings (Find dialog box only) Table 18-3 Options for Handling Full Audit Log Files Option Description Overwrite Events As Needed You might lose information if the log becomes full before you archive it. However, this setting requires no maintenance. Overwrite Events Older Than X Days You might lose information if the log becomes full before you archive it, but Windows XP Professional will lose only information that is at least x days old. Enter the number of days for this option. The default is seven days. Do Not Overwrite Events This option requires you to clear the log manually. When the log becomes full, Windows XP Professional will stop, but no security log entries will be overwritten. 18-17 How to Save and Open Logs Saving logs allows you to maintain a history of events. Many companies have policies on archiving logs for a specified period—especially auditing-related events in the Secu- rity log. To work with a log, right-click the log you want to configure in Event Viewer, and then click one of the options described in Table 18-4. Lesson Review The following questions are intended to reinforce key information presented in this lesson. If you are unable to answer a question, review the lesson materials and try the question again. You can find answers to the questions in the “Questions and Answers” section at the end of this chapter. 1. What are the three Windows XP Professional logs you can view with Event Viewer, and what is the purpose of each log? Table 18-4 Options to Archive, Clear, or View a Log File To Do this Save the log Click Save Log File As, and then type a filename. Clear the log Click Clear All Events to clear the log. Windows XP Professional creates a security log entry, stating that the log was cleared. Open a saved log Click Open Log File. Open a new log view Click New Log View to create a second view of the selected log. By default, this view is named the same as the original view with a copy number appended in parentheses. For example, if you create a new view of the System log, the default name for the new view is System (2). Right-click the new view and click Rename to change the name. You can use different views to look at log files filtered different ways or to open saved logs. Lesson 2 Using Event Viewer 18-18 Chapter 18 Using Windows XP Tools 2. The two ways that Event Viewer provides for locating specific events are the _____________ command and the _____________ command. What does each of the commands allow you to do? 3. The size of each log can be from ____ KB to ____ GB, and the default size is ____ KB. 4. If you select the Do Not Overwrite Events option, what happens when the log becomes full? Lesson Summary ■ Windows XP Professional has the following three logs by default: the application log, the security log, and the system log. ■ You use Event Viewer to view the contents of the Windows XP Professional logs. ■ Viewing the Event Properties dialog box shows you the date and time the event occurred, the user and service associated with the event, an Event ID that you can use to find more information about the event, and a detailed description of the event. ■ You can use the Filter and Find commands in Event Viewer to easily locate specific events or types of events. ■ For each log in Windows XP Professional, you can control the maximum size the log is allowed to reach and the action that Windows XP Professional takes when the log fills up. ■ You can archive the Windows XP logs so that you keep an historical record of events and track trends over time. 18-19 Lesson 3: Using Scheduled Tasks Use Scheduled Tasks to identify programs and batch files you want to run once, at regular intervals, or at specific times. You can schedule any script, program, or docu- ment to start at a specified time and interval, or when certain operating system events occur. This feature can complete many administrative tasks for you. After this lesson, you will be able to ■ Identify tasks that you can schedule. ■ Schedule a task. ■ Configure advanced options for a scheduled task. ■ Troubleshoot scheduled tasks. Estimated lesson time: 25 minutes Overview of Scheduled Tasks Windows XP Professional saves scheduled tasks in the Scheduled Tasks folder (see Fig- ure 18-10), which you can access through the Control Panel under Performance And Maintenance. In addition, you can access Scheduled Tasks on another computer by browsing that computer’s resources using My Network Places, which allows you to move tasks from one computer to another. For example, you can create task files for maintenance, and then add them to a user’s computer as needed. F18us10 Figure 18-10 Schedule a task to run when you need it to. Use Scheduled Tasks to perform the following tasks: Lesson 3 Using Scheduled Tasks 18-20 Chapter 18 Using Windows XP Tools ■ Run maintenance programs at specific intervals. ■ Run programs at a time when there is less demand for computer resources. How to Schedule a Task Use the Scheduled Task Wizard to schedule tasks. You access the wizard in the Sched- uled Tasks folder by double-clicking Add Scheduled Task. Table 18-5 describes the options that you can configure in the Scheduled Task Wizard. How to Configure Advanced Options for a Scheduled Task In addition to the options that are available in the Scheduled Task Wizard, you can set several additional options for tasks. You can change options that you set with the Scheduled Task Wizard or set additional advanced options by configuring advanced properties for the task. Table 18-5 Scheduled Task Wizard Options Option Description Application The applications to schedule. Select from a list of applications that are registered with Windows XP Professional, or click Browse to specify any program or batch file. Name A descriptive name for the task. Perform This Task How often Windows XP Professional will perform the task. You can select Daily, Weekly, Monthly, One Time Only, When My Computer Starts, or When I Log On. Start Time The start time for the task to occur. Start Date The start date for the task. User Name And Password A user name and password. You can enter your user name and pass- word or another user name and password to have the application run under the security settings for that user account. If the user account that you used to log on does not have the rights required by the scheduled task, you can use another user account that does have the required rights. For example, you can run a scheduled backup by using a user account that has the required rights to back up data but does not have other administrative privileges. Advanced Properties Select this check box if you want the wizard to display the Advanced Properties dialog box so that you can configure additional properties after you click Finish. Advanced Properties are covered in the next sec- tion. 18-21 Table 18-6 describes the tabs in the Advanced Properties dialog box for the scheduled task. How to Troubleshoot Scheduled Tasks In general, troubleshooting the Scheduled Tasks involves checking the parameters that you have set up. In the Scheduled Tasks window, switch the view to Details view. Two columns, Status and Last Result, are useful in determining whether a task was success- ful or not. The Advanced menu provides a few options to help you with troubleshooting. When you open Scheduled Tasks and click Advanced, the first option on the Advanced menu allows you to stop and start the Task Scheduler Service, and the selection is either Stop Using Task Scheduler or Start Using Task Scheduler. If your scheduled tasks are not starting, you can check this option to be sure that the Task Scheduler Service is run- ning; if it is not, you can start it. The second option is similar to the first, only it pauses and continues the service. If the service is paused, scheduled tasks do not start. The third option on the Advanced menu, Notify Me Of Missed Tasks, causes the system to send you a message when a scheduled task does not occur. The next option on the Advanced menu is the AT Service Account, which allows you to change the account being used from the System account. The next option, View Log, allows you to view a log of when the Task Scheduler Service started, stopped, paused, and continued. It also logs the name of each scheduled task, the application or task that started, and the time and date the task was started. The final option, View Hidden Tasks, allows you to view tasks created by Windows and applications that hide the tasks by default. Table 18-6 Scheduled Task Wizard Advanced Options Tab Description Task Change the scheduled task or change the user account that is used to run the task. You can also turn the task on and off. Schedule Set and display multiple schedules for the same task. You can set the date, time, and number of repeat occurrences for the task. For example, you can set up a task to run every Friday at 10:00 p.m. Settings Set options that affect when a task starts or stops, such as how long a backup can take, if the computer can be in use, or if the computer can be running on batteries when it runs the task. Security Change the list of users and groups that have permission to perform the task, or change the permissions for a specific user or group. This tab is available only if you have simple file sharing disabled. Lesson 3 Using Scheduled Tasks 18-22 Chapter 18 Using Windows XP Tools Practice: Using Task Scheduler In this practice, you schedule Address Book to start at a predetermined time. You can use this as a reminder to review address information. You also configure Task Sched- uler options. 1. Click Start, and then click Control Panel. 2. In the Control Panel window, click Performance And Maintenance. 3. In the Performance And Maintenance window, click Scheduled Tasks. Windows XP Professional opens the Scheduled Tasks folder. 4. Double-click Add Scheduled Task. The Scheduled Task Wizard appears. 5. Click Next. Windows XP Professional displays a list of currently installed programs. To sched- ule a program that is not registered with Windows XP Professional, click Browse to locate the program. 6. Click Browse. Windows XP Professional displays the Select Program To Schedule dialog box. 7. Double-click Program Files, and then double-click Windows NT. 8. Double-click Accessories, and then double-click WordPad. 9. Type Launch WordPad in the Type A Name For This Task text box. The Type A Name For This Task text box allows you to enter a description that is more intuitive than the program name. Windows XP Professional displays this name in the Scheduled Tasks folder when you finish the wizard. 10. Click One Time Only, and then click Next. 11. In the Start Time box, set the time to 4 minutes after the current system time and make a note of this time. To confirm the current system time, look at the Windows taskbar. Do not change the entry in the Start Date text box. 12. Click Next. The wizard requires you to enter the name and password of a user account. When Task Scheduler runs the scheduled task, the program receives all the rights and permissions of the user account that you enter here. The program is also bound by any restrictions on the user account. Notice that the user name you are currently using is already filled in as the default. You must type the correct password for the user account in both password boxes before you can continue. [...]... Properties 2 On the Remote tab, in the Remote Desktop section, select Allow Users To Connect Remotely To This Computer, as shown in Figure 1 8- 1 4 1 8- 3 4 Chapter 18 Using Windows XP Tools F18us14 Figure 1 8- 1 4 Enable Remote Desktop on a computer running Windows XP Professional 3 If the user account to be used to connect remotely is not a member of the Administrators group, click Select Remote Users, add... that Windows XP Professional requires for startup You can also create restore points manually and restore the computer to any restore point 1 8- 4 8 Chapter 18 Using Windows XP Tools Questions and Answers Lesson 1 Practice: Exercise 1 Page 1 8- 9 6 What is the description provided for the Error Reporting Service? Allows Error Reporting For Services And Applications Running In Non-Standard Environments 8 What... supervising manager of a resort in 1 8- 4 2 Chapter 18 Using Windows XP Tools Jackson Hole, Wyoming Ken has recently installed a non -Microsoft backup program on his computer running Windows XP Professional and is having some problems He says that during the installation of the program, he was asked whether he wanted to install the backup program as a service or as a command-line utility Not knowing what to... device, or troubleshooting a problem ■ Windows provides access to restore points in a convenient date-based display When you restore to a restore point, Windows must restart so that it can apply configuration changes 1 8- 3 2 Chapter 18 Using Windows XP Tools Lesson 5: Using Remote Desktop and Remote Assistance Remote Assistance and Remote Desktop are both Windows XP Professional features that allow remote... Manager 702 4 3 Looking through these events, what do you suspect is the problem? How would you correct it? Chapter Summary ■ Services are programs or processes that start with Windows XP Professional and run in the background, providing necessary functions to other programs and operating system components The Services console allows you to perform basic com- 1 8- 4 6 Chapter 18 Using Windows XP Tools... Accessories, then Communications, and then Remote Desktop Connection 2 In the Remote Desktop Connection dialog box, depicted in Figure 1 8- 1 6, enter the name or IP address of the remote computer and click Connect 1 8- 3 6 Chapter 18 Using Windows XP Tools F18us16 Figure 1 8- 1 6 Establish a Remote Desktop session 3 When prompted, enter the appropriate user account and password, and then click OK 4 If another... solve a problem 1 8- 3 8 Chapter 18 Using Windows XP Tools How to Establish a Remote Assistance Session A Remote Assistance session requires that both the user needing help and the expert user actively participate in establishing the connection The session is established in the following phases: 1 The user that needs help sends a Remote Assistance invitation to the expert user 2 The expert user responds... directly by using Windows Messenger, by using an e-mail attachment, or by saving an invitation file and transmitting it to the helper user (for example, you could save the file to a shared folder on the network) F18us 18 Figure 1 8- 1 8 Choose the method to create an invitation 4 When prompted, enter the requested information, including your name, a message, when the invitation should expire, and (optionally)... System Restore 1 8- 2 7 Exam Tip Restoring to a restore point affects the Windows Registry and certain system and application files The restoration does not affect user-created documents and data Restoring to a restore point provides a safe means to reset the Windows configuration to an earlier time How to Enable or Disable System Restore System Restore is enabled by default in Windows XP Professional to... Restore Windows displays the System Restore window, as shown in Figure 8- 1 2 2 Click Create A Restore Point, and then click Next 3 In the Restore Point Description text box, type a name that describes the restore point, and then click Create 4 Click Close F18us12 Figure 1 8- 1 2 Create a restore point before making any major changes Lesson 4 Using System Restore 1 8- 2 9 How to Restore a Restore Point If you experience . Event Viewer 1 8- 1 4 Chapter 18 Using Windows XP Tools How to View an Event Double-click any event in the right pane of Event Viewer to open the Event Properties dialog box (see Figure 1 8- 8 ), which. double-click Event Viewer. 5. In the left pane, click the log you want to view. Windows displays the events in the log file in the right window, as shown in Fig- ure 1 8- 7 . F18us07 Figure 1 8- 7 Use. in Windows XP Professional, you can control the maximum size the log is allowed to reach and the action that Windows XP Professional takes when the log fills up. ■ You can archive the Windows XP