Windows sysinternals

More documents

Recommendations

Info

Chapter 16 Error Messages 391 He opened the Security tab of the file’s Properties dialog box in Windows Explorer, but found nothing wrong. He then noticed that the Read-Only check box was selected on the General tab. (See Figure 16-16.) He cleared it, and the program began working correctly. FIGURE 16-16 “ACCESS DENIED” caused by the Read-Only check box being selected. The Case of the Installation Failure A customer that my co-author Aaron was working with had Kodak scanners that came with CDs containing the required software. When the administrator inserted the CD, Windows Vista’s Autorun didn’t quite work correctly—the Autorun dialog box appeared but did not show the Autoplay option to install the software. So the administrator opened the folder in Explorer and started autorun.exe to start the installation. Shortly after approving the User Account Control elevation request, the administrator saw an error message with a strange title that looked like the installer was performing an incorrect operating system version check. (See Figure 16-17.) FIGURE 16-17 Application installation error message. www.it-ebooks.info
392 Part III Troubleshooting—”The Case of the Unexplained...” The Troubleshooting Aaron figured that the author of the installation program had believed that because Windows XP was so perfect Microsoft would never need to release another version of Windows, there was no reason to check for newer versions. He applied the Windows XP compatibility mode which, among other things, lies to the program about what the operating system version actually is and tried again. It failed in exactly the same way. Additionally, the installation worked perfectly well on freshly installed copies of Windows Vista that didn’t have the organization’s policies applied to it. He started Procmon, ran the installation program again to the point of the error message and then stopped the Procmon trace. He dragged the Procmon crosshairs toolbar icon over the error message to apply a filter to show only events involving the window owner’s process, Setup.exe. (See Figure 16-18.) FIGURE 16-18 Procmon after filtering with “Include Process From Window.” Because of the “0” in the title in the error message, Aaron thought the problem might be due to the program searching for something and not finding it, so he right-clicked on items in the Result column and excluded events with result codes he figured would not be interesting: SUCCESS, FAST IO DISALLOWED, FILE LOCKED WITH ONLY READERS, REPARSE, BUFFER OVERFLOW, and END OF FILE. (Aaron usually excludes “known-good” result codes rather than including potentially bad results because it is easy to miss some and filter out important entries.) When he looked at the remaining entries, one thing that quickly stood out was the name “DoesNotExist” appearing in path names near the end of the results. He used Procmon’s highlighting feature to make them stand out in the context of surrounding events. (See Figure 16-19.) www.it-ebooks.info
Page 1 and 2:
www.it-ebooks.info
Page 3 and 4:
PUBLISHED BY Microsoft Press A Divi
Page 5 and 6:
www.it-ebooks.info
Page 7 and 8:
www.it-ebooks.info
Page 9 and 10:
viii Table of Contents 2 Windows Co
Page 11 and 12:
x Table of Contents Process Tree .
Page 13 and 14:
xii Table of Contents PsLogList. .
Page 15 and 16:
xiv Table of Contents Object Type .
Page 17 and 18:
xvi Table of Contents 14 System Inf
Page 19 and 20:
www.it-ebooks.info
Page 21 and 22:
www.it-ebooks.info
Page 23 and 24:
xxii Introduction layout, I set out
Page 25 and 26:
xxiv Introduction Microsoft had bee
Page 27 and 28:
xxvi Introduction Part III, “Trou
Page 29 and 30:
xxviii Introduction Errata & Book S
Page 31 and 32:
www.it-ebooks.info
Page 33 and 34:
4 Part I Getting Started Table 1-1
Page 35 and 36:
6 Part I Getting Started Utility LD
Page 37 and 38:
8 Part I Getting Started FIGURE 1-2
Page 39 and 40:
10 Part I Getting Started Running t
Page 41 and 42:
12 Part I Getting Started FIGURE 1-
Page 43 and 44:
14 Part I Getting Started Because t
Page 45 and 46:
16 Part I Getting Started unrestric
Page 47 and 48:
18 Part I Getting Started For more
Page 49 and 50:
20 Part I Getting Started FIGURE 2-
Page 51 and 52:
22 Part I Getting Started ■ The c
Page 53 and 54:
24 Part I Getting Started “System
Page 55 and 56:
26 Part I Getting Started is not av
Page 57 and 58:
28 Part I Getting Started symbolic
Page 59 and 60:
30 Part I Getting Started The debug
Page 61 and 62:
32 Part I Getting Started Terminal
Page 63 and 64:
34 Part I Getting Started access on
Page 65 and 66:
36 Part I Getting Started With UIPI
Page 67 and 68:
www.it-ebooks.info
Page 69 and 70:
40 Part II Usage Guide ■ Tooltips
Page 71 and 72:
42 Part II Usage Guide Procexp repr
Page 73 and 74:
44 Part II Usage Guide is simply th
Page 75 and 76:
46 Part II Usage Guide Updating the
Page 77 and 78:
48 Part II Usage Guide Tooltips Hov
Page 79 and 80:
50 Part II Usage Guide On Windows V
Page 81 and 82:
52 Part II Usage Guide FIGURE 3-6 D
Page 83 and 84:
54 Part II Usage Guide FIGURE 3-7 T
Page 85 and 86:
56 Part II Usage Guide Process Perf
Page 87 and 88:
58 Part II Usage Guide FIGURE 3-9 T
Page 89 and 90:
60 Part II Usage Guide FIGURE 3-10
Page 91 and 92:
62 Part II Usage Guide By default,
Page 93 and 94:
Page 95 and 96:
66 Part II Usage Guide You can disp
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
72 Part II Usage Guide Peering Deep
Page 103 and 104:
Page 105 and 106:
76 Part II Usage Guide ■ Access M
Page 107 and 108:
78 Part II Usage Guide The Properti
Page 109 and 110:
Page 111 and 112:
82 Part II Usage Guide TCP/IP Tab A
Page 113 and 114:
84 Part II Usage Guide In most circ
Page 115 and 116:
86 Part II Usage Guide Click the Sa
Page 117 and 118:
Page 119 and 120:
Page 121 and 122:
92 Part II Usage Guide Some reasons
Page 123 and 124:
94 Part II Usage Guide available to
Page 125 and 126:
96 Part II Usage Guide running on t
Page 127 and 128:
98 Part II Usage Guide Command-Line
Page 129 and 130:
www.it-ebooks.info
Page 131 and 132:
102 Part II Usage Guide Because mil
Page 133 and 134:
104 Part II Usage Guide Events Tabl
Page 135 and 136:
106 Part II Usage Guide As an NTSTA
Page 137 and 138:
108 Part II Usage Guide Application
Page 139 and 140:
110 Part II Usage Guide File Attrib
Page 141 and 142:
112 Part II Usage Guide ■ When th
Page 143 and 144:
114 Part II Usage Guide Displaying
Page 145 and 146:
116 Part II Usage Guide invoked by
Page 147 and 148:
118 Part II Usage Guide without per
Page 149 and 150:
120 Part II Usage Guide Configuring
Page 151 and 152:
Page 153 and 154:
124 Part II Usage Guide Saving Proc
Page 155 and 156:
126 Part II Usage Guide If Procmon
Page 157 and 158:
128 Part II Usage Guide When lookin
Page 159 and 160:
130 Part II Usage Guide History Dep
Page 161 and 162:
132 Part II Usage Guide Automating
Page 163 and 164:
134 Part II Usage Guide ■ Line 4
Page 165 and 166:
136 Part II Usage Guide File Summar
Page 167 and 168:
Page 169 and 170:
140 Part II Usage Guide Cross Refer
Page 171 and 172:
142 Part II Usage Guide BOOL WriteP
Page 173 and 174:
www.it-ebooks.info
Page 175 and 176:
Page 177 and 178:
148 Part II Usage Guide Disabling o
Page 179 and 180:
150 Part II Usage Guide Files for w
Page 181 and 182:
152 Part II Usage Guide Viewing ASE
Page 183 and 184:
154 Part II Usage Guide Per-User AS
Page 185 and 186:
156 Part II Usage Guide Per-User AS
Page 187 and 188:
158 Part II Usage Guide Per-User an
Page 189 and 190:
160 Part II Usage Guide Codecs The
Page 191 and 192:
162 Part II Usage Guide Command Pro
Page 193 and 194:
164 Part II Usage Guide Winsock Pro
Page 195 and 196:
166 Part II Usage Guide Saving and
Page 197 and 198:
168 Part II Usage Guide The CSV for
Page 199 and 200:
170 Part II Usage Guide ■ A defau
Page 201 and 202:
172 Part II Usage Guide Incidentall
Page 203 and 204:
174 Part II Usage Guide Alternate C
Page 205 and 206:
176 Part II Usage Guide What this m
Page 207 and 208:
178 Part II Usage Guide Redirected
Page 209 and 210:
180 Part II Usage Guide PsExec Comm
Page 211 and 212:
182 Part II Usage Guide The -s opti
Page 213 and 214:
184 Part II Usage Guide Note The re
Page 215 and 216:
186 Part II Usage Guide Use of full
Page 217 and 218:
188 Part II Usage Guide In the prec
Page 219 and 220:
190 Part II Usage Guide Note PsList
Page 221 and 222:
192 Part II Usage Guide on the netw
Page 223 and 224:
Page 225 and 226:
196 Part II Usage Guide the event l
Page 227 and 228:
198 Part II Usage Guide example, al
Page 229 and 230:
200 Part II Usage Guide The config
Page 231 and 232:
202 Part II Usage Guide Find One of
Page 233 and 234:
204 Part II Usage Guide Option Disp
Page 235 and 236:
206 Part II Usage Guide To suspend
Page 237 and 238:
208 Part II Usage Guide depend serv
Page 239 and 240:
www.it-ebooks.info
Page 241 and 242:
Page 243 and 244:
Page 245 and 246:
216 Part II Usage Guide Allocations
Page 247 and 248:
218 Part II Usage Guide ■ Shared
Page 249 and 250:
220 Part II Usage Guide When you co
Page 251 and 252:
222 Part II Usage Guide ■ The mem
Page 253 and 254:
Page 255 and 256:
226 Part II Usage Guide ■ .TXT Th
Page 257 and 258:
228 Part II Usage Guide Command-Lin
Page 259 and 260:
230 Part II Usage Guide To avoid an
Page 261 and 262:
232 Part II Usage Guide You can use
Page 263 and 264:
234 Part II Usage Guide and results
Page 265 and 266:
236 Part II Usage Guide Capturing A
Page 267 and 268:
238 Part II Usage Guide static meth
Page 269 and 270:
240 Part II Usage Guide You can ann
Page 271 and 272:
242 Part II Usage Guide the crash d
Page 273 and 274:
244 Part II Usage Guide Highlightin
Page 275 and 276:
246 Part II Usage Guide ■ Limit L
Page 277 and 278:
248 Part II Usage Guide To view deb
Page 279 and 280:
250 Part II Usage Guide LiveKd Requ
Page 281 and 282:
252 Part II Usage Guide This comman
Page 283 and 284:
254 Part II Usage Guide ListDLLs re
Page 285 and 286:
256 Part II Usage Guide Handle Hand
Page 287 and 288:
Page 289 and 290:
260 Part II Usage Guide Timer : 7 T
Page 291 and 292:
Page 293 and 294:
264 Part II Usage Guide ■ Signing
Page 295 and 296:
266 Part II Usage Guide displays ha
Page 297 and 298:
268 Part II Usage Guide Note that t
Page 299 and 300:
270 Part II Usage Guide Object Type
Page 301 and 302:
272 Part II Usage Guide Although th
Page 303 and 304:
274 Part II Usage Guide effective p
Page 305 and 306:
276 Part II Usage Guide is explicit
Page 307 and 308:
278 Part II Usage Guide Click on a
Page 309 and 310:
280 Part II Usage Guide ShellRunAs
Page 311 and 312:
282 Part II Usage Guide [1] Logon s
Page 313 and 314:
284 Part II Usage Guide The only wa
Page 315 and 316:
286 Part II Usage Guide The second
Page 317 and 318:
Page 319 and 320:
290 Part II Usage Guide Objects You
Page 321 and 322:
Page 323 and 324:
294 Part II Usage Guide The current
Page 325 and 326:
296 Part II Usage Guide You can scr
Page 327 and 328:
Page 329 and 330:
300 Part II Usage Guide To view inf
Page 331 and 332:
302 Part II Usage Guide AdInsight m
Page 333 and 334:
304 Part II Usage Guide To configur
Page 335 and 336:
306 Part II Usage Guide AdInsight c
Page 337 and 338:
www.it-ebooks.info
Page 339 and 340:
310 Part II Usage Guide When you st
Page 341 and 342:
312 Part II Usage Guide In addition
Page 343 and 344:
314 Part II Usage Guide selected, B
Page 345 and 346:
316 Part II Usage Guide the data it
Page 347 and 348:
Page 349 and 350:
320 Part II Usage Guide provide a w
Page 351 and 352:
322 Part II Usage Guide Drawing Mod
Page 353 and 354:
324 Part II Usage Guide LiveZoom Wh
Page 355 and 356:
326 Part II Usage Guide The followi
Page 357 and 358:
Page 359 and 360:
330 Part II Usage Guide into subdir
Page 361 and 362:
Page 363 and 364:
334 Part II Usage Guide This sample
Page 365 and 366:
Page 367 and 368:
338 Part II Usage Guide disk), Disk
Page 369 and 370: 340 Part II Usage Guide Volume Perm
Page 371 and 372: 342 Part II Usage Guide FIGURE 12-7
Page 373 and 374: 344 Part II Usage Guide ■ One lin
Page 377 and 378: 348 Part II Usage Guide sizing, and
Page 379 and 380: 350 Part II Usage Guide VolumeID Wh
Page 381 and 382: 352 Part II Usage Guide executables
Page 383 and 384: 354 Part II Usage Guide ■ System
Page 385 and 386: 356 Part II Usage Guide ■ Process
Page 389 and 390: 360 Part II Usage Guide costs on NU
Page 397 and 398: www.it-ebooks.info
Page 399 and 400: 370 Part II Usage Guide and endpoin
Page 405 and 406: 376 Part II Usage Guide adjacent if
Page 407 and 408: 378 Part II Usage Guide Hex2Dec If
Page 409 and 410: 380 Part II Usage Guide his audienc
Page 411 and 412: www.it-ebooks.info
Page 413 and 414: 384 Part III Troubleshooting—”T
Page 419: 390 Part III Troubleshooting—”T
Page 467 and 468: 438 AdInsight AdInsight (continued)
Page 469 and 470: 440 BgInfo BgInfo (continued) Rich
Page 471 and 472:
442 DebugView DebugView (continued)
Page 473 and 474:
444 events events (continued) filte
Page 475 and 476:
446 HKLM\System\CurrentControlSet\C
Page 477 and 478:
448 malware malware (continued) Aut
Page 479 and 480:
450 paging files, defragmenting pag
Page 481 and 482:
452 Process Monitor (Procmon) Proce
Page 483 and 484:
454 PsShutdown PsShutdown (continue
Page 485 and 486:
456 Security Reference Monitor Secu
Page 487 and 488:
458 Sysinternals utilities Sysinter
Page 489 and 490:
460 unhandled exceptions, process d
Page 491 and 492:
462 Windows 7 Windows 7 (continued)
Page 493 and 494:
www.it-ebooks.info
Page 495 and 496:
www.it-ebooks.info
Page 497:
What do you think of this book? We
show all

Windows sysinternals

Create successful ePaper yourself

Delete template?

Save as template?