Networking.docx

Application Crashes 1299 When an application crashes, you want to isolate the cause of the crash and solve it. The cause could be a compatibility issue, a hardware issue, or a host of other problems. One step to take early on is to look for updates/patches/fixes to the application released by the ve...

Application Crashes 1299 When an application crashes, you want to isolate the cause of the crash and solve it. The cause could be a compatibility issue, a hardware issue, or a host of other problems. One step to take early on is to look for updates/patches/fixes to the application released by the vendor. Be sure to try these updates on a test machine before rolling them out to all machines, and verify that they address the problem and not introduce new problems. One tool that is extremely helpful in identifying software problems is Reliability Monitor, as shown in Figure 24.14. Reliability Monitor allows you to see application crashes and the times and dates they occurred. It also allows you to see which updates were installed before and after the crashes. Reliability Monitor allows you to narrow down if other software is causing the issues and what led up to the crashes. Figure 24.14 Windows Reliability Monitor In addition to Reliability Monitor, you can also access the Windows event logs in Event Viewer for information about Microsoft-based application problems, as shown in Figure 24.15. All third-party vendors should log errors to the Windows event logs, but generally you will only find Microsoft products using these logs. In either case, you might find more information about why an application is crashing by looking at the Application log. Figure 24.15 Windows event logs in Event Viewer Blue Screen of Death 1300 The Blue Screen of Death (BSOD)—not a technical term, by the way—is another way of describing the blue-screen error condition that occurs when Windows fails to boot properly or quits unexpectedly, as shown in Figure 24.16. If this happens during a boot, it is at this stage that the device drivers for the various pieces of hardware are installed/loaded. If your Windows GUI fails to start properly, more likely than not the problem is related to a misconfigured driver or misconfigured hardware. You can try a few things if you believe that a driver is causing the problem. One is to try booting Windows into Safe Mode, which you can access via the Startup Settings in the Windows Recovery Environment. In Safe Mode, Windows loads only basic drivers, such as a standard VGA video driver and the keyboard and mouse. After you’ve booted into Safe Mode, you can uninstall the driver that you think is causing the problem. Another option is to boot into the Windows Recovery Environment and use System Restore, which will revert the system drivers back to the state they were in when the restore point was created. Bear in mind that a System Restore will not affect personal files, but it will remove applications, updates, and drivers. In Windows 7 and prior operating systems, you can enter into the Advanced Boot Options during system startup with the F8 command. The Advanced Boot Options menu contains an option called Last Known Good Configuration. This option will allow you to boot to the last time you had successfully started up and logged in. This option was removed in Windows 8/8.1 and Windows 10. You should now be using System Restore. Figure 24.16 Blue Screen of Death Black Screen 1301 A black screen is a common problem when the operating system resolution is higher than the monitor can handle. This can happen if you have replaced the original monitor with a new monitor. Windows might not recognize the various resolution modes that the new monitor can display. If you are using Windows 8/8.1 or Windows 10 and this happens, it’s advisable to reconnect the original monitor and lower the resolution. Windows 8/8.1 and Windows 10 do not have a key sequence to enter the Windows Recovery Environment during boot up. You can always boot up the Windows Recovery Environment from a USB drive or DVD and enter Startup Settings from there. If your screen has gone black and nothing has changed, perform the following steps: Check all your physical connections to make sure that nothing has come loose or disconnected. If everything is connected, the first troubleshooting step is to press the Windows key+Shift+Ctrl+B at the same time. This key sequence will send a wake signal to the display. If that key sequence does not work, then pressing Ctrl+Alt+Delete and signing out or rebooting is the next step to take. If none of the preceding tricks work, it’s time to hard power the system down by pressing the power button for 5 to 10 seconds. 1302 If the screen is a second screen or a projector, the video card driver might not be sending a signal to the device. The second screen’s mode can be selected with the following steps: Start by duplicating the primary screen to the secondary device by pressing the Windows key+P. A pop-out menu will appear from the right side of the screen, as shown in Figure 24.17. Figure 24.17 Secondary screen settings Cycle through the options with the same key combination. If the key combination does not work, ensure that the proper driver for multiple displays is loaded. Printing Issues Outside of the printer problems you learned about in Chapter 14, “Hardware and Network Troubleshooting,” printers should just print from the aspect of the operating system. Unfortunately, printing issues at the software level are very common and sometimes difficult to fix. Again, collecting the information to identify the problem is the first step to solving the problem with printing in the operating system. The first step is to check the most obvious stuff, such as: Is the printer on? Is anything unplugged? 1303Are there errors on the printer? Toner out Paper out Offline Does the operating system see the printer? Assuming the problem isn’t something as simple as being out of paper, the next step is to send a test page with the Printers & Scanners settings app, as shown in Figure 24.18. You can view the status of the printers installed on the operating system. To print a test page, select the printer and choose Manage. Figure 24.18 Printers & Scanners If the test page prints, then the problem might be the application printing to the printer. A common problem with applications (such as Word) is that they expect a specific paper size when printing a document, and the document might be misconfigured for the wrong paper size. If a simple test fails, such as sending a test page, then the driver might need to be upgraded or reinstalled. Record the information about the printer, such as model and accessories, and visit the vendor’s website to download the latest driver. You should also1304check to see if newer firmware exists for the printer. If so, follow the vendor’s directions for installation. The Print Management MMC is a second way to manage printers. It provides detailed information, such as the printer driver version, as shown in Figure 24.19. To open the Print Management MMC, click the Start menu, type Administrative Tools, and then select Print Management from the results. The Print Management MMC allows you to manage printers on the local computer as well as remote servers. You can perform all the same functionality in the MMC as you would in the Settings app. Figure 24.19 Print Management MMC Services Fail to Start A service’s failure to start is directly related either to another application installed with conflicting resources or to a misconfiguration of the service. In either case, the first place to start is the Event Viewer, as shown in Figure 24.20. The System log will display an Event ID of 7000 from the source of the Service Control Manager. The reason for the failure will vary, depending on the problem. If a service is conflicting with another resource, we recommend that you reinstall the software that installed the service that is failing. Although this might break the conflicting application, it is probably the quickest way to find a conflicting resource. If the service fails to start because of a misconfiguration, the most likely cause is the user account the service is configured to start with. If a misconfigured user account is the problem, you will see an Event ID of 7000 in Event Viewer, and the description will read that the service failed due to a login failure. You can verify the user configured to start the service in the Services properties, as shown in Figure 24.21. You open the properties of the service by right-clicking the Start Menu, selecting Computer Management, then Services, right-clicking the service, selecting Properties, and finally the Log On tab.1305 Figure 24.20 Service Control Manager events Figure 24.21 Services properties 1306 Make sure that the password for the user account has not changed and the user account is not locked out. You can manually reset the password for the user and re-enter the password in the Services properties. Also make sure that the account has the Log on as a Service right. Did You Reboot Your Computer? Quick quiz: You just got an error in Windows, and it appears that you are on the verge of a crash (of your application or the whole system). What do you do? The first thing is to write down any error messages that appear. Then save your work (if possible) and reboot your computer. Anyone who has called tech support, or who has been a tech support person, knows how demeaning the question, “Did you restart your computer?” can seem. Most people respond with an indignant, “Of course!” In reality, they might or might not have actually done it. Whenever there’s a software problem, always, always reboot the computer before trying to troubleshoot. Often, the problem will disappear, and you’ll have just saved yourself half an hour of frustration. If the same problem reappears, then you know that you have work to do. Why does rebooting help? When an application is running, it creates one or more temporary files that it uses to store information. It also stores information in memory (RAM). If a temporary file or information in RAM becomes corrupted (such as by application A writing its information into application B’s memory space), the original application can have problems. Rebooting will clear the memory registers and most often remove problematic temporary files, thus eliminating the issue. It might sound trite, but the first axiom in troubleshooting software really is to reboot. Even if the user says they did, ask them to reboot again. (Tell them you want to see the opening screen for any possible error messages, or make up another good excuse.) If the problem doesn’t come back, it’s not a problem. If it does, then you can use your software skills to fix it. Slow Bootup Performance problems at bootup can be identified with methods detailed earlier in this chapter. By enabling boot logging and examining the ntbtlog.txt file, you can identify what is slowing down bootup performance. 1307 You can also use the System Configuration (msconfig.exe) utility to identify slow bootup problems. By selecting the Selective Startup option in the System Configuration utility, you can choose not to start system services and load startup items; only critical services will load, as shown in Figure 24.22. After choosing Selective Startup and applying it, you can switch to the Services tab to see the services that won’t be started on the next reboot, as shown in Figure 24.23. Figure 24.22 Selective Startup selection Figure 24.23 Selective Services 1308 Using the process of elimination, you can add services back and reboot to time performance of bootup, which will allow you to identify the bootup slowdown. Usually Microsoft services will not slow down the boot process. Third-party services—usually antivirus or anti-malware software—will most likely be the culprits. Slow-Loading Profiles A local profile is a group of settings for the user as well as their personal files. Local profiles can be slow to load because of items set to start, when the profile is loaded. You can use Task Manager to selectively disable startup items, as shown in Figure 24.24. By the process of elimination and after several logouts and logins, you can narrow down the performance problem caused by slow-loading local profiles. Figure 24.24 Startup items in Task Manager Typically discuss slow-loading profiles in respect to network-based roaming profiles, not local profiles. The fundamental difference is that local profiles don’t need to traverse a network during login. Roaming profiles, on the other hand, need to traverse the network during login (load from the server) and logout (write back to the server). There are some things you can do to alleviate the stress on the network and speed up the load time of network profiles. For example, you can save space by deleting temporary Internet files in both Edge and Internet Explorer. You can also save a tremendous amount of space—sometimes gigabytes—by deleting downloaded files. Common Solutions Now that we’ve covered some common symptoms to Microsoft Windows OS problems, let’s look at some common solutions that you can implement to solve problems. Defragmenting the Hard Drive 1309 Workstations with a conventional magnetic hard disk drive (HDD) eventually slow down because the filesystem is fragmented. Defragmenting the hard drive can speed up performance because the head needs to travel less to read the data. The defragmentation tool speeds up drive access by rewriting files, so the data appears contiguously on the drive platters. Starting with Windows 8, the operating system automatically defragments the disks. It is set to run on a weekly schedule, as shown in Figure 24.25. To change the schedule, click the Start menu, type defrag, and then select Defragmentation and Optimize Drives. Click Change Settings to change the frequency and to select the drives to defragment. You can manually run a defragmentation on a drive by selecting the drive and clicking Optimize. Figure 24.25 Optimize Drives utility Although deleting files on the operating system will not defragment the hard drive, it will help speed up defragmentation. You should always run the Disk Cleanup utility prior to a disk defragmentation (optimization of drives) so that the defragmentation utility has free space for the defragmentation process. The Disk Cleanup utility allows you to delete temporary Internet files and other unneeded files.  Disk Cleanup is a utility that can be used to free up space on the operating system, by deleting temporary files, thumbnails, and temporary Internet files, just to name a few. You can access Disk Utility by clicking the Start menu, typing Disk Cleanup, and then selecting it from the results. You can also right-click a root drive, like the C: drive, under This PC, choose Properties, and then click Disk Cleanup on the General tab. Rebooting 1310 Rebooting a system often takes care of problems, for a multitude of reasons. One of the top reasons is that it allows the operating system to terminate hung processes gracefully. After the operating system reboots, the processes are normally restarted. An added bonus is that only the applications the user requires are re-launched. The goal is to fix the user’s problem with minimal disruption. A reboot can’t be done every time, especially if the user could lose work as a result. Depending on the circumstance, when reproducing a problem, one of the first things to do is reboot. It serves an important purpose of isolating the problem so that you can reproduce it. For example, if you’ve isolated the problem to Excel not scrolling properly when a web browser is open, you should reboot and try to replicate the problem. If you discover the reboot fixed the problem, then you’ve solved the problem. However, if the problem still exists, you’ve now isolated the problem further by eliminating other programs that could have been hung in the background affecting this problem. The steps of rebooting and then opening Excel can also be used to verify when you’ve solved the problem. Killing Processes Depending on the situation, sometimes a process must be terminated because it is frozen and non-responsive. Terminating a process should be considered a last resort because the potential for loss of work is high, especially if it’s a Microsoft Office application. Killing the process of Excel with a spreadsheet that hasn’t been saved will certainly lose work. However, if Excel is non-responsive, then it is also causing a work stoppage and is equally disruptive. As a technician, you must evaluate when loss of work due to force closing the application with unsaved work is necessary. It’s a tough position to be in, but over your career you will find yourself in that very position. You can kill processes in the GUI through either Task Manager or Resource Manager. In Task Manager, simply right-click the process and select End Task, as shown in Figure 24.26. In Resource Manager, you can use the same process to kill a process. In Exercise 24.1 you’ll get some practice killing processes through the GUI. Figure 24.26 Killing a non-responsive process 1311 You can also kill processes at the command prompt with the taskkill.exe utility. You can kill processes either with the process name using the /IM switch or by the process ID (PID). For example, if you wanted to kill all Notepad processes on the operating system, you would use taskkill /IM notepad*. You can also use tasklist.exe to see if the process was terminated. A useful feature of the taskkill utility is its ability to remotely kill a process. You can use the /S switch to specify the destination system. For example, to kill Notepad on client1, you would use the command taskkill /S client1 /IM notepad*. Tasklist is a utility to view running tasks. You can use it with the /S switch to verify that a process was killed remotely. EXERCISE 24.1 Killing Processes Open Task Manager by pressing Ctrl+Shift+Esc. Click the Details tab and then the heading Name (this will sort the column). 1312Verify that there is no entry for Notepad.exe. Click the Start menu and type Notepad. Select Notepad from the results. Right-click the entry for Notepad.exe in the Name column, and then select End Task. Notice that the Notepad instance you opened is now closed. Restarting Services Services normally don’t need to be restarted. On occasion, however, a change is made that requires a service be restarted to reflect. Services should be restarted if they crash, of course. Although this is rare, it still happens from time to time. If a service crashes, you can restart the service in the Computer Management MMC by selecting Services, then right-click Service and choose Start, as shown in Figure 24.7. You can use the same method to restart a running service. Figure 24.27 Manually starting a service 1313 Services can be configured to automatically start in the event of failure on the Recovery tab of the Services properties, as shown in Figure 24.28. For example, by default the Print Spooler service is set to restart on the first and second failure, but after that it will remain stopped. The reset counter can be set for a number of days, and the service can be started after a specific number of minutes after its failure. You can even have the computer restart or run a program in the event a service fails. Figure 24.28 Service recovery Updating Network Settings When you experience network-related issues with a Windows operating system, the first step to diagnosing the problem is to view the network settings. You can view the current network settings by opening a command prompt, typing ipconfig /ALL, and recording the settings, as shown in Figure 24.29. You can also obtain similar information by right-clicking the Start menu, then Network Connections, then clicking View Your Network properties. Figure 24.29 Output from ipconfig /ALL 1314 You can tell a lot from the information that ipconfig /ALL provides. For example, you can see the DNS suffix that will be appended to client DNS requests. You can also see that the IP address was derived from a DHCP server and the DHCP server the IP address was configured from. The most important information is the IP address, subnet mask, and default gateway. You can also see a wealth of other information, including the lease time and expiration of the IP address. A common solution for network issues is to update network settings to match other clients on the network that are operating normally. If a network change to DHCP was made recently and all you need to do is refresh the setting, you can issue an ipcofig /RELEASE and then an ipconfig /RENEW. You can manually change settings in the Internet Protocol Version 4 (TCP/IPv4) Properties for the network card, as shown in Figure 24.30. You can access these settings by right-clicking the Start menu, then Network Connections, then Network and Sharing Center, then Change adapter settings, finally right-click the adapter and select Properties. To update the gateway and DNS settings, click Advanced (see Figure 24.31).1315 Figure 24.30 IPv4 Properties Figure 24.31 IPv4 Advanced Properties Reimaging/Reloading the Operating System 1316 In certain situations, a problem may require you to reinstall software. The time to uninstall and reinstall the software can sometimes exceed the time it takes to reimage the operating system with the software preinstalled. Reimaging the computer will depend on whether you use operating system images or load each computer by hand. If your organization does not use a standardized image for its computers, you can use the Windows Recovery Environment and select the Reset This PC option. If the computers have a preinstalled image, you can use the System Image Recovery option to reload the operating system. You can select this option by holding down the Shift key as you reboot the operating system, then choose Advanced Options after the reboot, then System Image Recovery. You can also reset the computer by opening the Settings app, then Update & Security, then Recovery, then Reset This PC (Get started), and finally choose Remove Everything. Depending on the type of computer you have, it may have a proprietary process for recovering system images.