Windows sysinternals

392 Part III Troubleshooting—”The Case of the Unexplained...”
The Troubleshooting
Aaron figured that the author of the installation program had believed that because
Windows XP was so perfect Microsoft would never need to release another version of
Windows, there was no reason to check for newer versions. He applied the Windows XP
compatibility mode which, among other things, lies to the program about what the operating
system version actually is and tried again. It failed in exactly the same way. Additionally,
the installation worked perfectly well on freshly installed copies of Windows Vista that didn’t
have the organization’s policies applied to it.
He started Procmon, ran the installation program again to the point of the error message
and then stopped the Procmon trace. He dragged the Procmon crosshairs toolbar icon over
the error message to apply a filter to show only events involving the window owner’s process,
Setup.exe. (See Figure 16-18.)
FIGURE 16-18 Procmon after filtering with “Include Process From Window.”
Because of the “0” in the title in the error message, Aaron thought the problem might
be due to the program searching for something and not finding it, so he right-clicked on
items in the Result column and excluded events with result codes he figured would not be
interesting: SUCCESS, FAST IO DISALLOWED, FILE LOCKED WITH ONLY READERS, REPARSE,
BUFFER OVERFLOW, and END OF FILE. (Aaron usually excludes “known-good” result codes
rather than including potentially bad results because it is easy to miss some and filter out
important entries.)
When he looked at the remaining entries, one thing that quickly stood out was the name
“DoesNotExist” appearing in path names near the end of the results. He used Procmon’s
highlighting feature to make them stand out in the context of surrounding events. (See
Figure 16-19.)
www.it-ebooks.info