Windows sysinternals

Chapter 16
Error Messages
In this chapter, I’ll demonstrate troubleshooting techniques using the Sysinternals
utilities when the primary symptom is an error message. In this chapter, Procmon is the
troubleshooting tool of choice in all but the first two cases:
■ The Case of the Locked Folder highlights a common use case for Procexp.
■ The Case of the Failed AV Update demonstrates Autoruns’ Analyze Offline System
feature to repair an unbootable computer.
■ The Case of the Failed Lotus Notes Backups is interesting to me and will be useful to
many readers because it shows what a search for a missing DLL looks like in Procmon.
■ The Case of the Failed Play-To and The Case of the Crashing Proksi Utility
highlight different ways in which “Access Denied errors can manifest.
■ The Case of the Installation Failure turned out to be caused by ill-advised security
guidance.
■ The Case of the Missing Folder Association demonstrates comparing a Procmon
trace from a problematic system to one from a working system.
■ The Case of the Temporary Registry Profiles is especially interesting because it
affected a large number of users and made use of one of Procmon’s lesser-known
features: boot logging.
The Case of the Locked Folder
While writing up “The Case of the IExplore-Pegged CPU” (in Chapter 17, “Hangs and
Sluggish Performance”), I decided to rename the folder containing the files. However, I ran
into an unexpected error (shown in Figure 16-1) because another program had an open
handle to the folder or to something in it. After making sure I didn’t have any files open or
command prompts in that folder, I clicked Try Again, but the folder remained in use and
could not be renamed.
www.it-ebooks.info
383