704 Chapter 14 • Troubleshooting Windows XP Expanding the boxes within the window delivers information about the test results.The automated process conducts tests of connectivity to the default gateway, DNS servers, and loopback function, as well as detailing information about the adaptor(s) present and clients installed on the machine.This test is fairly fast, and it provides good, detailed information about the performance of the system. In the event that you want to use some of the more traditional command- line tools, those capabilities have been retained.You can use a number of diag- nostic tools from the command line, including ping, pathping, tracert, arp, netstat, ipconfig, nslookup, and nbtstat. In addition, you can use the previ- ously discussed command-line tool netdiag to verify connectivity. Troubleshooting System Performance System performance is an area that requires ongoing analysis.At times, you may notice that a performance issue has arisen, leading to sluggish performance and response.Two familiar tools from Windows NT 4.0 and Windows 2000 are still available for locating and correcting performance problems that may be occurring on your machines. In this section, we look at and discuss the use of Task Manager and the Performance MMC snap-in (which was the Performance Monitor in Windows NT 4.0). Both of the tools have been improved, offering you the oppor- tunity to more quickly and accurately troubleshoot and repair problems. Task Manager The Task Manager tool is an often overlooked, quick diagnostic tool for trou- bleshooting performance issues. It has the capability to provide information about running applications, running processes, memory usage, and an added function- ality to display basic network information. In this section, we examine the func- tionality of Task Manager in troubleshooting Windows XP. You can access Task Manager by using the normal Windows paths: From the Security window (Ctrl+Alt+Delete), select the Task Manager button, or right- click the taskbar, and select Task Manager; or type taskmgr either in the Run command window or at the command prompt.When you start Task Manager, you’ll see the window displayed in Figure 14.26. Notice that a tab has been added to Task Manager for Networking. Let’s take a look at each of the tabs and windows and discuss the troubleshooting informa- tion you can view in each of them. www.syngress.com 189_XP_14.qxd 11/12/01 11:15 AM Page 704 Troubleshooting Windows XP • Chapter 14 705 The Application Tab The first tab that is displayed is the Application tab.This window displays cur- rently running applications with basic information about whether the application is running or not responding.You have the opportunity to start applications either by clicking the New Task button at the bottom-right of the window, or by selecting File | Run and typing in the name of the executable for the appli- cation you want to start.You may also use the End Task button to terminate an application that is not responding (is hung), or the Switch To button to change to another application. The Processes Tab The second tab you may select is the Processes tab.This window is shown in Figure 14.27. Notice that in the default window, you see information detailing the process that is running, the credential of the user account that the process is running under, the CPU utilization, and the memory usage for the process.You have the capability to add numerous counters to this window by adding columns to the display.To add them, select View | Select Columns, giving you the window shown in Figure 14.28. Here you have the capability to select a large number of other areas to mon- itor, including I/O reads and writes, memory, and page fault information that may be useful in your troubleshooting efforts. www.syngress.com Figure 14.26 The Initial Task Manager Window 189_XP_14.qxd 11/12/01 11:15 AM Page 705 706 Chapter 14 • Troubleshooting Windows XP The Performance Tab The third tab in Task Manager is the Performance tab, which presents you with a graphical representation of performance that gives you a quick analysis of CPU and page file usage for troubleshooting and investigating processing or memory area issues.The Page File Usage and Page File Usage History windows are new to Windows XP, replacing the Windows 2000 Memory and Memory History win- dows in Task Manager. It also includes text sections with dynamically updated information about memory usage.These include information about kernel memory www.syngress.com Figure 14.27 The Processes Tab in Task Manager Figure 14.28 TheSelect Columns Window in the Processes Tab of Task Manager 189_XP_14.qxd 11/12/01 11:15 AM Page 706 Troubleshooting Windows XP • Chapter 14 707 (memory in use by the operating system), physical memory (physical memory installed on your machine), and commit memory (allocated to programs and the system). Selecting the View menu in the toolbar allows you to make small changes in the display. Figure 14.29 shows the Performance tab screen. The Networking Tab The fourth tab in Task Manager is the Networking Tab.This tab and its function- ality are new to Windows XP, and you can use this tool for quick analysis and troubleshooting.This tab allows you to perform some basic troubleshooting of net- work conditions, your adaptor, and performance of your network. Figure 14.30 dis- plays the default Networking tab Window. www.syngress.com Figure 14.29 The Performance Tab Window in Task Manager Figure 14.30 The Networking Tab Window in Task Manager 189_XP_14.qxd 11/12/01 11:15 AM Page 707 708 Chapter 14 • Troubleshooting Windows XP The default display shows a graphical representation of network performance; the lower section allows you to choose the columns for which you would like to have statistics for further analysis. By default, the graphical display will show the following: ■ Bytes Received (Yellow). ■ Bytes Total (Green). ■ The graph measures percentage of network utilization, and it dynami- cally changes depending on load. To access the additional columns of information, choose View | Select Columns, which delivers the pop-up window shown in Figure 14.31. With the choices available here, you can view information that is customized to your needs.You can further refine the troubleshooting tool as needed to get a dynamically updated picture of performance and have a quick view of the condi- tion of your machine and its communication capabilities. Overall,Task Manager allows you the capability to take a running snapshot of your machine and its performance, allowing you to refine your troubleshooting to those areas that may need attention. Its added capability to perform basic network analysis makes it more useful for this task than it was in previous Windows editions. After using the Task Manager tool for initial diagnostics and troubleshooting, you may find that you need a more detailed tool for analysis to really make a good decision about where the problem lies. For instance, you may find that www.syngress.com Figure 14.31 The Select Columns Pop-Up in the Network Tab Window 189_XP_14.qxd 11/12/01 11:15 AM Page 708 Troubleshooting Windows XP • Chapter 14 709 CPU utilization values are high, or that the commit charge values indicate more than normal allocation to programs based on the applications you have running. To do this, we visit the Performance Microsoft Management Console tool in the next section. Performance MMC If you are familiar with the Windows 2000 platform Performance MMC snap-in, you will find that the tool provided in Windows XP for performance monitoring is—at first glance—familiar. For those who have not worked actively with the tool, let’s take a moment to look at accessing and setting up the tool and follow that discussion with a look at some of the new functionality that is provided with Windows XP. NOTE In Windows NT 4.0 and Windows 2000, you had to enable physical disk counters by entering the diskperf command with either the –y or –ye switches at the command prompt. Recall that the –y switch enabled normal disk counters, and the –ye switch enabled the counters if RAID 5 was implemented through the operating system. In Windows XP, these counters are permanently enabled, making this initial step for configura- tion unnecessary. Depending on your choices for your Start menu, you can access the Performance MMC in a number of ways. In the advanced properties of either the Start menu or Classic Start menu properties page, you may select to display Administrative Tools. In this case, open the Administrative Tools pop-up window and select Performance. Or, with either Start menu interface, you may select Control Panel and navigate to the Administrative Tools area. Select the Performance shortcut to launch the MMC. Finally, you may also access the Performance MMC by typing perfmon in either the Run window or from the command prompt.The Performance MMC has two functional areas: System Monitor and Performance Logs And Alerts. Performance Logs And Alerts allows you to expand your use of the tool for analysis. In this section, we look only at System Monitor.After you launch the Performance MMC, you will see the screen shown in Figure 14.32. The default window automatically displays three counters.These counters include one each in the areas of memory, physical disk, and percentage of processor www.syngress.com 189_XP_14.qxd 11/12/01 11:15 AM Page 709 710 Chapter 14 • Troubleshooting Windows XP time.As you recall from either Windows NT 4.0 or Windows 2000, these are areas that you would normally begin to concentrate on while troubleshooting perfor- mance problems. In Windows XP, these base indicators are provided by default. To add more counters to the console, right click anywhere in the right-hand pane, and select Add Counters, as shown in Figure 14.33. This will produce the window shown in Figure 14.34. www.syngress.com Figure 14.32 The Initial Performance MMC Window Figure 14.33 Selecting Add Counters in the Performance Console 189_XP_14.qxd 11/12/01 11:15 AM Page 710 Troubleshooting Windows XP • Chapter 14 711 Now that you know where to go to select the counters, let’s take a look at the areas in which you can monitor the performance of various components and areas in Windows XP.You can access the various Performance Objects by selecting the drop-down list, as shown in Figure 14.35. Table 14.2 lists the performance objects and a capsule of the functionality for each of them. www.syngress.com Figure 14.34 The Add Counters Window in the Performance Console Figure 14.35 The Performance Objects List in the Performance Console 189_XP_14.qxd 11/12/01 11:15 AM Page 711 712 Chapter 14 • Troubleshooting Windows XP Table 14.2 Performance Objects Counters Object Name Available Object Description ACS/RSVP Interfaces 31 Resource Reservation Protocol (RSVP) Interface statistics—used with QoS ACS/RSVP Service 11 RSVP service counters for QoS Battery 5 Provides charge rate, discharge rate, capacity and other critical battery information for laptop computer users Browser 20 Monitors browser traffic and conditions on the Network Interface Cache 27 Monitors performance of cache memory and paging operations Distributed Transaction 13 Tracks transaction speed and Coordinator accuracy during application functions requiring MS-DTC functionality Http Indexing Service 9 Monitors index service counters related to http queries ICMP 22 Monitors ICMP traffic, flags, fragments, offsets for network evaluation Indexing Service 11 Counters related to speed, size, condition of index operations Indexing Service Filter 3 Measurement of index service filter speed IP 17 Evaluation of datagram and frag- mentation conditions Job Object 13 Measurement of time used in kernel mode, user mode, pro- cessor by processes and threads of code Job Object Details 27 I/O operations, measurement of threads, code execution, paging operations Logical Disk 23 Monitors disk read/write opera- tions and free space www.syngress.com Continued 189_XP_14.qxd 11/12/01 11:15 AM Page 712 Troubleshooting Windows XP • Chapter 14 713 Memory 29 Memory, cache, and page fault counters NBT Connection 3 Bytes sent, received, and total Network Interface 17 Bytes sent received; bandwidth and packet information Objects 6 Instantaneous (not averaged) numbers of process, threads, semaphores at time of data collection Paging File 2 Usage statistics for page file Physical Disk 21 Disk read and write statistics, queue length counters Print Queue 13 Spooler, bytes printed, jobs printed, pages printed, errors Process 27 Counters related to process func- tion (running executables, for instance) including %privileged time, %user time, %processor time, page faults, and I/O operations Processor 15 Contains new counters for C1, C2, C3 time to measure low power states on systems that support them, as well as interrupts/sec and other processor counters previously available PSchedFlow 20 Packet scheduling counters and information for quality of service (QoS) PSchedPipe 17 Packet and performance informa- tion for adapters involved in QoS scheduling RAS Port 17 Provides counters for monitoring various RAS items on a port-by- port basis RAS Total 18 Provides counters for monitoring the totals of various RAS items www.syngress.com Table 14.2 Continued Counters Object Name Available Object Description Continued 189_XP_14.qxd 11/12/01 11:15 AM Page 713 [...]... resources, you explored five categories of troubleshooting that are used on a regular basis.You looked at tools and procedures for troubleshooting in the logon process, new and expanded tools for troubleshooting network and internet connectivity, and at some improved versions of Task Manager and Performance MMC while looking at troubleshooting system performance.You continued your look by visiting troubleshooting. .. as you help them www.syngress.com 189 _XP_ 14.qxd 11/12/01 11:15 AM Page 721 Troubleshooting Windows XP • Chapter 14 Summary In our discussion of troubleshooting Windows XP, we’ve visited many areas and seen some new tools and capabilities, as well as visiting some old friends of troubleshooting that have been extended and improved We started with a discussion of troubleshooting resources Here we talked... existing restore points and disable the System Restore service Using the Recovery Console Windows XP includes the Recovery Console, which was introduced in Windows 2000.The Recovery Console is a text-based command interpreter, which is different from the normal Windows XP cmd.exe command interpreter in that it has a different set of commands and it allows you to access a Windows XP system that is not... Knowledge Base www.syngress.com 721 189 _XP_ 14.qxd 722 11/12/01 11:15 AM Page 722 Chapter 14 • Troubleshooting Windows XP The Help and Support Center page (new) gives you a very good, flexible tool for troubleshooting many areas of your Windows XP machines Remote Assistance (new) offers an expanded functionality based on Terminal Services Remote Desktop Protocol to request and receive support on the desktop... www.syngress.com 717 189 _XP_ 14.qxd 718 11/12/01 11:15 AM Page 718 Chapter 14 • Troubleshooting Windows XP In the console, conflicting devices or devices with problems will typically be noted with an exclamation point, as in past versions of Windows However, expanded features are also available in Windows XP s Device Manager that allow you more flexibility in the troubleshooting and repair of devices For... Microsoft Knowledge Base, TechNet, and Microsoft.com.We had a chance to explore new features in the Help and Support Center that have expanded your abilities to troubleshoot and have provided wizards and other diagnostic tools to help with the process.You also had the chance to explore the highly functional capabilities of Remote Assistance and saw the many ways you can use and configure it Following your... devices are detected and initialized .Windows XP provides a number of tools that allow you to dig into the cause of the problem and make the necessary repairs.We begin to look at some areas here that will allow you to get a jump on the diagnosis of the problem at hand A number of resources are available in Windows XP for hardware troubleshooting A familiar resource to users of Windows 98 or Windows 2000 is... 719 Troubleshooting Windows XP • Chapter 14 at the Run command or the command prompt.This will launch the tool, shown in Figure 14.41 Figure 14.39 The System Information Page Figure 14.40 The Hardware Resources and Components Areas Figure 14.41 The System Configuration Utility www.syngress.com 719 189 _XP_ 14.qxd 720 11/12/01 11:15 AM Page 720 Chapter 14 • Troubleshooting Windows XP With the System Configuration... troubleshooting are available in the Help and Support Center page Additional configuration problems may require troubleshooting if Internet connection firewall or network bridging are installed Command-line tools such as ping, pathping, arp, tracert, nslookup, and others are still available www.syngress.com 189 _XP_ 14.qxd 11/12/01 11:15 AM Page 723 Troubleshooting Windows XP • Chapter 14 Troubleshooting System Performance... adjust compatibility as needed in Windows Explorer The Dr.Watson utility is still available for logging application problems when they occur Don’t forget to make a stop at the Event Viewer .Windows XP logs application events Troubleshooting Hardware The Device Manager has expanded capabilities for use in troubleshooting Winmsd gives you an evaluation of hardware, resources, and conflicts Msconfig allows you . Page 189 _XP_ 14.qxd 11/12/01 11:15 AM Page 720 Troubleshooting Windows XP • Chapter 14 721 Summary In our discussion of troubleshooting Windows XP, we’ve visited many areas and seen some new tools and. CPU and page file usage for troubleshooting and investigating processing or memory area issues.The Page File Usage and Page File Usage History windows are new to Windows XP, replacing the Windows. disk, and percentage of processor www.syngress.com 189 _XP_ 14.qxd 11/12/01 11:15 AM Page 709 710 Chapter 14 • Troubleshooting Windows XP time.As you recall from either Windows NT 4.0 or Windows