Page 2 - Useful Windows Information

A service is a process (a running program) that runs from the time Windows boots up to the time Windows shuts down; in contrast, a user process runs from the time the user invokes a program to the time the user terminates the process or the user logs off. Services are useful when a system-wide execution makes more sense than a user-specific execution. For example, the Windows Firewall (ISC) service blocks unwanted network traffic while the operating system is running.

This post focuses on two, built-in tools used to manage the services: the Computer Management GUI and the sc command-line utility. The author of this post is running Windows XP Professional SP2.

Using Computer Management
To start this tool:
1) Right-click on My Computer.
2) Select Manage.

Here you will see a number of useful tools such as user and disk management. The tool of interest is Services and Applications->Services.

This tool will allow you to start/stop services, specify startup parameters, change startup and recovery behavior, edit services' credentials, enable/disable services for each hardware profile, and view dependencies. As an example, you can disable a service by right-clicking on the service and select stop. Wait a few seconds for the service to shutdown, then double-click on the service to bring up its properties dialog. There, change the startup type to disabled. Now, the service, although installed, will not run even after a reboot.

Using sc
To invoke this tool:
1) Click Start->Run.
2) Type cmd and click OK.
3) At the prompt, type sc and press ENTER to view a list of subcommands.

The sc tool provides more options than the Computer Management GUI such as creating/destroying services and changing the description. To create a service, type the following:
C:\> sc create MyService binPath= "c:\path\to\myservice.exe"

Best Practices
1) Only enable the services you need. As with any process, a service takes up resources. Also, more services usually means more administration and possibly less security.
2) Don't give every service administrative/system rights. This is especially important for server applications such as web servers. Change the Log on as property to a restricted user. This way, any security vunerabilities with the service will have less impact on your system.
3) Watch out for dependencies. When disabling or removing a service, check if there are any other services depending on the to-be-stopped service.

If your task manager looks like that, most likely, it's not a problem, just double click anywhere in the cream colored area and it should return.

If you install a new motherboard in your system, and go to use a Windows install that has already been installed, you may run into some problems. First, you may get a quick flashing blue screen right before the NTOSKRNL.exe loads (aka. the "Boot Screen") In order to fix such a problem, you cannot use a recovery console fix. All you simply have to do is proceed like a normal install. Do not format, select "leave current file system intact" and it will proceed like a normal install, yet leaving all of the installed software and files intact. NOTE: Backup important work/data, this is Windows, a lot can go wrong. The second problem you may run into is an activation issue. If this is the case, you may end up having to re-install, or you can backup the following files from the system32 directory "WPA.dbl, WPA.bak" And then replace them when you are done, this may not always do the trick. Note that this is legal, but if any moderators feel the need to remove it, please do so.


Moderator Note: I think that once you've upgraded your motherboard, there won't be any activation problems - it's the same computer, just with a new motherboard. If you need to activate again, I don't see how Microsoft can have any problems with it since this is a legitimate upgrade. -- Edwin

The three most common reasons why Windows will not boot are mis-configured/mis-used BIOS settings, third-party bootloaders, and bad/missing system files.

Mis-Configured/Mis-Used BIOS Settings:
Most (if not all) BIOS configurations have options for controlling what devices to boot and in what order. One possible arrangement is to boot from floppy drive, then the CD drive, and finally the hard drive; as soon as a bootable device is found, BIOS passes control to that device. Another arrangement is to boot from the network only (read more).

A couple of possibilities of why BIOS is not booting to your local hard drive is BIOS not recognizing your hard drive (see the hardware forums) or it's booting to the wrong device (e.g. the boot CD is still in the drive).

Third-Party Bootloaders:
A third-party bootloader, when installed, will overwrite the MBR (Master Boot Record) stored on the local boot device (hard drive); this record stores a small program that reads the partition tables and transfers program control to a bootloader from the appropriate partition. The partition's bootloader then initiates and transfers control to an operating system. Windows, for example, has its own bootloader, which can either be loaded by the MBR or a third-party bootloader (read more about the boot process).

For Windows XP Professional, there are two commands that can be used to restore the MBR and the Windows bootloader: fixmbr and fixboot; for previous versions, there's FDISK. These commands are only available in the Recovery Console.

Bad/Missing System Files:
System files usually means drivers when it comes to Windows not booting. Either the drivers are corrupted or incompatible with the hardware. One scenario is moving everything from a hard drive from an old computer to a newer model. What may happen then is a blue screen will flash on the screen before rebooting.

There's no definite solution to this problem, just troubleshooting:
1) Try booting into Safe Mode by pressing F8.
2) If you cannot boot into Safe Mode, you'll need to go into the Recovery Console.
3) Recall what was the last software/driver installed and consult its documentation for system files involved (e.g. *.vxd files).
4) Check the boot.ini file located at 'C:\'. In Safe Mode, right-click 'My Computer' and select 'Properties'. In the dialog, select the 'Advanced' tab and click 'Startup and Recovery'->'Settings'. Click the 'Edit' button to bring up a notepad on boot.ini. The contents will typically look like this:
5) At the Recovery Console, run chkdsk /r.
6) If all else fails, run a repair detailed in oneMSBi's post.

The following post assumes you have System Restore enabled (set on by default with a Windows Xp installation)

Sometimes when you install a program or driver, it might render XP unbootable.
If your computer won't boot into the operating system normally, you might be able to boot into Safe Mode and use System Restore to go back to a previous restore point to fix the problem.

If you can't even boot into safe mode Then you need to start the System Restore tool from the command line.
To do so, when booting your computer, press F8 to bring up a boot menu.
1) Select Safe Mode with Command Prompt

2) Select the operating system to start (if you have multiple operating systems installed)

3) Log on with an account that is a member of the administrators group

4) At the command prompt, type
%systemroot%\system32\restore\rstrui.exe
Press Enter This will start the "Welcome to System Restore" screen.

5) Go through the steps of the Wizard that opens and follow the instructions to restore your system to a previous restore point.

Windows has a DLL caching mechanism that keeps certain Dynamic Link Libraries (DLL files) loaded to help shorten the time it takes to open programs you use often. While this is a good idea in itself, it is only really useful when you use the same programs over and over and open and close them frequently. You'd think that closing a program would free up all resources it takes up when running, but that doesn't happen.

The following method will turn off the DLL Caching "feature" and allow the unloading of all program-related DLL files upon closing the program that loaded them. This can and does in fact free up resources used and can also help gain overall stability of the system, especially if the computer is going to be run for long periods of time without restarting.


For Win9x: Unload DLLs method

1) Go to Start - Run - type in "REGEDIT" without quotes and press enter. The Registry Editor should open up.

2) Now use the left-hand explorer pane to find this key:
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer"

3) In the Right-hand pane, right click in an empty space and choose "New" then "String Value" and name it: "AlwaysUnloadDll" (without quotes and capital letters are important). Give this new string a value of 1

4) close the Registry Editor, and reboot Windows.



For WinXP: Unload DLLs Method

1) Go to Start - Run - type in "REGEDIT" without quotes and press enter. The Registry Editor opens up.

2) Now use the left-hand explorer pane to find this key: "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer"

3) Still in the left-hand pane, right click on the Explorer folder and choose "New" then "KEY". Give it a name of "AlwaysUnloadDLL" (without quotes and capital letters are important). Inside that key change the default string to 1

4) Close regedit and reboot.

This tweak is good for low resource (memory) systems. The drawback of using this is a small slowdown in the initial opening of programs, but in my opinion the benefit of using this tweak far outweighs the drawback.

How to edit or fiddle with "boot.ini" quite safely for fun!

First, format 2 floppies on XP.
Next, copy, ntldr / boot.ini / NTDETECT.COM ( bootsect.dos / bootfont.bin) to each floppies.

Make sure that you can boot from these floppies

It boots! <---(OO;?(Oh! It booted!)

Along the way, try to apply this floppy to another similar system (e.g. XP on 1st partition of Primary Master.) if available.

As you know now, you have only to edit the boot.ini on the floppy first as you like and apply it for experiment. If it works, then copy it or edit real? boot.ini.

As to actual items of boot.ini, consult the below or so:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q289022

Apply this floppy to boot any Multi Boot systems by editing boot.ini.

If you would rather replace your Windows 'Welcome' screen when you boot, to a logon screen where you have to press 'Ctrl+Alt+Del' to logon, like you do on a network then this should be what you are looking for ! :

Very first thing you need to do is to turn off your current logon type (Welcome Screen)

1. Click Start
2. Click Control Panel
3. In the Classic View of the Control Panel, double click on User Accounts.
4. Click Change the way users log on or off. If you get a pop-up about "Fast Switching," just click cancel.
5. Uncheck Use Fast User Switching and Use the Welcome Screen
6. Click Apply Options
7. Click on the Guest account
8. Click Turn OFF the Guest Account
9. Close out of the User Accounts windows by clicking the little X.


Now that you have turned off your old logon, now you have to configure your new logon (Ctrl+Alt+Del)

1. Right Click on the TaskBar
2. Click Properties
3. Click the Start Menu tab
4. Click the Radio Button option Start Menu
5. Then click Customize
6. Click the Advanced tab
7. Scroll down and click the Radio Button option under "System Administrative Tools," labeled Display on the All Programs menu and the Start Menu.
8. Click Ok, then click Ok.
9. Now you have to adjust our "preferences." You should be viewing your desktop.
10. Click Start
11. Click Administrative Tools while the rollover menu is still there, click Local Security Policy
12. On the left side of the screen click the + so its a - on the Local Policies menu.
13. Then click on Security Options
14. Then make sure the following is changed to or is the option in bold.

1. Interactive logon: Do not display last user name. Change it to Enabled
2. Interactive logon: Do not require CTRL+ALT+DEL. Change it to Disabled
3. Interactive logon: Message text for users attempting to log on. Change it to anything you want e.g. : "Welcome ! By using this computer you are agreeing to the EULA. Thank you. If you need an account please contact the administrator."
4. Interactive logon: Message title for users attempting to log on: Change it to anything you want, e.g. : Welcome !"
5. System cryptography: User FIPS compliant algorithms for encryption, hashing, and signing. Enabled
6. System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) Enabled

Reboot and you should now require to press Ctrl+Alt+Del to logon.

Locking XP
actualy in windows XP just hit windowskey and L key at the same time.

view CMD buffer history and scroll through comands
open comand window and hit F7

To image an XP install to multiple machines run sysprep before imaging so new SIDs are created and the XP hardware discovery will re-run at startup. (This is also nice when replacing like a motherboard so it detects the new hardware at reboot.)


actualy all you have to do is change this to enabled for interactive login


This just makes it so last username is not automagicly entered, when enable the username is blank



Make windows login to a domain as a domain user automagicly at bootup..(usefull for public computers so a domain policy can be enforced)
set this setting
Interactive logon: Do not display last user name. Change it to Enabled
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"AutoAdminLogon" = "1"
'DefaultUserName' value username.
'DefaultPassword' password for the user entered above.
add a new string value named 'DefaultDomainName' and set this to the domain of the user. value is name of domain

To make it so user cant bypass auto login name

Value Name: IgnoreShiftOverride
Data Type: REG_SZ (String Value)
Value Data: (1 = Ignore Shift)

Adding registry values to computers in login scipts or just an exacutable...

create batch file that runs a .reg file at login

.reg file example

autologin.reg

forceautologin =1 will make it so even when they log out it will log back in as that user

After you install/remove some CD/Dvd Recording, emmulaton, or service software, your CD rom drives may dissapear from the "My Computer" area, and will be innoperable. The problem is known to specifically be caused by the removal of

InCD,
Roxio,
Daemon Tools,
CDburnerXp,
Direct CD


• In My Computer, there is no access to your CD-ROMs.
• In Device Manager, the following error message appears in connection with any CD-ROM device that is part of your computer system:
The device is not working properly because Windows cannot load the drivers required for this device (Code 31).
• Device Manager displays the following error message:
A driver for this device was not required, and has been disabled (Code 32 or Code 31).
You may also receive an error Code 39 message that indicates that the driver is corrupted.


• Device Manager displays the following error Code 19 message, which means that the registry returned some unknown result:
Your registry might be corrupted. (Code 19)
• You may also receive the following error message:
Windows successfully loaded the device driver for this hardware but cannot find the hardware device. (Code 41)



Solution


1. Start Registry Editor (Regedt32.exe).
2. Locate the UpperFilters value under the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}
3. On the Edit menu, click Delete, and then click OK.
4. Locate the LowerFilters value under the same key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}
5. On the Edit menu, click Delete, and then click OK.
6. Quit Registry Editor.NOTE: After you remove the Upperfilters value and the Lowerfilters value, if you notice lost functionality in a particular program, such as CD recording software, you may need to reinstall that software. If the problem recurs, consult with the software vendor for assistance.


7. Restart your computer.



There may be other third-party CD-writing software products that exhibit similar behavior. Some or all of the troubleshooting steps in this article might apply if such a product also adds entries under the UpperFilters or LowerFilters value in the registry, either by adding its own filter drivers or by removing the registry keys and values outlined in this article that begin with:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}