Ask the Performance Team

Windows 7 – Reminder about Beta 1 and RC Downloads

CC Hameed — Tue, 30 Jun 2009 11:00:00 GMT

Good Morning AskPerf! A reminder to all of you who may be using the Windows 7 Beta version that you need to get your system on the Release Candidate (RC) build quickly! Beginning on July 1st, the Beta build will start to reboot every two hours, and expire completely on August 1st.

If you still need to download the RC build, you need to do it before August 15th – that’s when the RC download program closes. After August 15th, you will not be able to download the RC build, but if you already have it downloaded you will still be able to install the RC and get a key if you need one. To get a key, just go to the Downloads page and follow the instructions.

This information was originally posted on the new Springboard Series blog.

Have a great Friday everyone. Until next time …

- CC Hameed

Share this post :

Windows 7: Be First, Save Half

CC Hameed — Fri, 26 Jun 2009 11:00:00 GMT

Pre-order Windows 7 today at Microsoft Store. You'll get it for at least half off and be one of the first to get it. Hurry, quantities are limited.*

It's pretty simple

Windows 7 is coming on October 22, 2009. Here's an easy way to get it fast and save a bundle: Pre-order a Windows 7 Home Premium Upgrade for $49 or a Windows 7 Professional Upgrade for $99 at Microsoft Store. That's about half off the estimated retail prices.

Want more info?

Go to the Windows team blog and find out all the details.

* The offer begins on June 26, 2009 (today!) and will continue while supplies last, or until July 11, 2009, whichever comes first.

Share this post :

Windows 7 – Parental Controls

CC Hameed — Tue, 23 Jun 2009 12:00:00 GMT

Good Morning AskPerf! Today’s post is a bit of a departure from what we normally discuss, but since this past Sunday was Father’s Day, I thought this might be an interesting topic to share. Actually, this conversation came up while I was having lunch with my parents. My daughters are somewhat internet-savvy, but they are still only 9 and 10, and so making sure that their online experience is a safe one is my foremost concern. The Parental Control features in Windows Vista provided a way for me to manage their settings and activities – not just the sites they visited, but also which applications they could use and when they were allowed to use their systems. Being able to allow my kids the ability to learn to participate in the online world in a safe and secure environment was a huge win for me – and for them.

The Parental Controls features in Windows 7 continue to evolve in response to changes in the nature of the web and the new challenges for parents. Vladimir Rovinsky, who is a Program Manager on the Safety Team wrote a new post on the Engineering Windows 7 blog regarding the changes in Parental Controls in Windows 7: Safeguarding Windows 7 – Parental Controls. For all our readers who are parents (or uncles, aunts, godparents, grandparents or who have friends who have kids!) this is a great read. Until next time …

Additional Resources:

- CC Hameed

Share this post :

DST: Fix-It Available for Bangladesh Daylight Saving Time in 2009

CC Hameed — Tue, 16 Jun 2009 11:00:00 GMT

As reported in the Bangladesh Government’s Gazette, Bangladesh has announced the introduction of Daylight Saving Time (DST). The start of DST for 2009 is on June 19^th at 11:00

Microsoft has produced an automated workaround (called a fix-it) to implement the DST Start time change for Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008. The Fix it solution is a MSI file so it is deployed as any other MSI based software package.

If interested in downloading this workaround please refer to KB972423 titled:”An optional update is available to update the Daylight Saving Time for Bangladesh for the year 2009 for Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008 based computers”

For other Windows versions, please refer to KB 914387 “How to configure daylight saving time for Microsoft Windows operating systems” on how to update the time zone registry key.

- CC Hameed

Share this post :

Remote Desktop Services – Weekend Reading

CC Hameed — Fri, 12 Jun 2009 11:00:00 GMT

Happy Friday AskPerf! The Remote Desktop Services team have been busy the last couple of weeks. There are several new posts on the RDS blog – definitely great weekend reading!

Creating Kerberos Identity for RD Session Host Farms Part I: using the Remote Desktop Services provider for Windows PowerShell: In Windows 2008, it is possible to provide server authentication by issuing a Secure Sockets Layer (SSL) certificate to the Remote Desktop Session Host (Terminal Server) farm and deploying it to each server in the farm. Since requiring SSL certificates on each server in RDS farm within an Intranet scenario can be expensive and burdensome, Windows Server 2008 R2 now provides an option to create a Kerberos identity for the farm for providing server authentication on intranet scenarios.

Creating Kerberos Identity for RD Session Host Farms Part II: using a WMI Script: You can achieve finer control over the farm account in Active Directory by using the Win32_SessionBrokerFarmAccount WMI class. This class allows you to set or change account’s password, change the password update rules, set or change the DNS name associated with the account, or disassociate the account from the farm without deleting it from Active Directory.

Using WSRM to control RDS Dynamic Fair Share Scheduling: In Windows Server 2008 R2 Remote Desktop Services, we have added kernel-based dynamic fair share scheduling (DFSS) to control CPU allocation. This system is able to throttle runaway processes in a matter of milliseconds, ensuring that the impact of runaway processes on users is immediately minimized.

User Profiles on Windows Server 2008 R2 Remote Desktop Services: This blog post contains a high-level overview of different types of profiles, considerations for choosing a profile solution for your deployment, highlights of new profile features in Windows Server 2008 R2, and a best practices recommendation for deploying roaming user profiles with folder redirection in a Remote Desktop Services environment.

Publishing in Windows Server 2008 R2: There are a number of ways in which an administrator can publish RemoteApp programs and virtual desktops in Windows Server 2008 R2. This blog post contains a brief, high-level overview of the publishing options you have, depending on the size of your deployment.

Introducing RemoteApp and Desktop Connections: Since the debut of RemoteApp in Windows Server 2008, Windows users have been able to enjoy remote applications with the same look and feel as local applications. RemoteApp and Desktop Connections is a new feature in Windows 7 and Windows Server 2008 R2 that builds on this by bringing RemoteApp programs to the Start menu, giving them the same launch experience as local applications.

Introducing RemoteApp User Assignment: We’re pleased to announce a new feature in Windows Server 2008 R2: RemoteApp User Assignment. The RemoteApp User Assignment feature gives administrators the ability to show a customized list of RemoteApp programs specific to the logged-on user in RD Web Access and RemoteApp and Desktop Connections. This has been one of our most requested features since Terminal Services Web Access (TS Web Access) was released in Windows Server 2008.

Have a great Friday everyone! Until next time …

- CC Hameed

Share this post :

Windows 7 Application Compatibility: Virtual Roundtable with Mark Russinovich

CC Hameed — Tue, 09 Jun 2009 11:00:00 GMT

On June 18th, Mark Russinovich will be hosting a Virtual Roundtable on Windows 7 Application Compatibility. This is a chance for IT Pros to learn all about Windows 7 Application Compatibility and get answers to any management or deployment questions for Windows 7. You can submit your performance questions live during the event or send them in advance to vrtable@microsoft.com.

Save the date!
Thursday June 11, 2008
11:00am Pacific Time

There is a .ics file attached to this post - add the date to your calendar!

Springboard Series: The resource for Windows desktop IT professionals

Find answers to your Windows 7 questions with resources, tools, monthly straight-talk articles, and upfront guidance based on early adopter and community feedback. To learn more, visit www.microsoft.com/springboard

- CC Hameed

Share this post :

Windows 7 – Release Date Announced

CC Hameed — Fri, 05 Jun 2009 11:00:00 GMT

In case you missed the announcement on Tuesday from the Windows team, Windows 7 will be in stores starting on October 22nd – just in time for the Holidays! Now, the Windows team haven’t publicly discussed their plans for international releases yet, so I suspect that the October 22nd date is a US-release date. But, keep an eye on the Windows Team blogs for further details.

Also, if you were thinking about getting a new PC or laptop for your sons and daughters headed off to school this Fall, and you really want them to have Windows 7, there will be a Windows 7 Upgrade Option Program. Through this program, participating retailers and OEM’s will be able to offer a special deal to upgrade to Windows 7 for customers purchasing a qualifying PC. Again, stay tuned to the blogs for more details on this program.

That’s the big news for today – from the AskPerf standpoint, we’ll be doing a launch series on Windows 7 very similar to the one we did back in February of 2008 for the Windows Server 2008 release.

Have a great Friday! Until next time …

- CC Hameed

Share this post :

Windows Vista / Windows Server 2008 – Service Pack 2

CC Hameed — Tue, 02 Jun 2009 11:00:00 GMT

Last week we released Service Pack 2 for Windows Vista and Windows Server 2008. The links in the “Additional Resources” section provide more depth information, but here are some key pieces of information:

Language Release Schedule: Five languages (English, French, German, Japanese and Spanish) are part of the first release. Wave 2 will include an additional thirty-one languages
Prerequisites: You must have Windows Vista SP1 installed prior to installing SP2. Windows Server 2008 shipped with SP1 included
Windows Update: SP2 is currently an optional update. It will eventually be offered as an Automatic Update, however it will not install automatically until the EULA has been accepted
Pre-Release Builds: If you have a Beta / Release Candidate build of SP2, you must uninstall the pre-release version before installing the RTM version. You cannot upgrade from a pre-release build to the RTM build
Internet Explorer 8: Internet Explorer 8 is not included in SP2

See you on Friday …

Additional Resources:

- CC Hameed

Share this post :

Splitting up WMI Providers for Troubleshooting

CC Hameed — Fri, 29 May 2009 11:00:00 GMT

Good Morning AskPerf! My name is Jim Martin, and I am a Support Escalation Engineer on the Performance team. In today’s post, we are going to take a look at splitting up WMI providers. I had been working with some customers who were experiencing issues with slow SQL WMI queries. Since WMI providers by default share the same WMIPRVSE process with other providers that need to run in the same security context, you can run into issues where a problem with one provider can cause issues with another one in the same hosting process. The technique below can be used to help isolate which specific provider is responsible for a performance problem inside a specific instance of WMIPRVSE – a leak for example. This technique does not replace some of our other troubleshooting techniques such as Process Explorer or ADPlus for diagnosing issues – but it is another handy tool to have in your bag of tricks!

In order to split them up you can change the HostingModel in the .mof file for the product/component you want to split out and recompile the .mof file. Open up the .mof file and search for “HostingModel” (without the quotes). Here is an example of the change for CIMWin32, but I would typically leave that one alone and change the .mof file for SQL or other component. The mof file for SQL 2005 is sqlmgmproviderxpsp2up.mof. The change would be almost identical in the SQL .mof file. The name after the colon can be any character string from what I can tell, but I would not use special characters. Then just recompile the .mof file using MOFCOMP, and restart WINMGMT. Below is the original section of the file:

Instance of __Win32Provider as $P
{
  Name = "CIMWin32";
  ClsId = "{d63a5850-8f16-11cf-9f47-00aa00bf345c}";
  ImpersonationLevel = 1;
  PerUserInitialization = "FALSE";
  HostingModel = "NetworkServiceHost";
};

… this can be changed as shown below:

Instance of __Win32Provider as $P
{
  Name = "CIMWin32";
  ClsId = "{d63a5850-8f16-11cf-9f47-00aa00bf345c}";
  ImpersonationLevel = 1;
  PerUserInitialization = "FALSE";
  HostingModel = "NetworkServiceHost:CIMWin32";
};

Once you have made the changes and recompiled the .mof file, you can use Process Explorer to find out which instance of WMIPRVSE has the provider loaded by going to the Find menu option and entering the name of the DLL file. If no results are returned, then the provider is not loaded. This is a good way to test if you have been successful in splitting out the provider into its own instance.

Remember that this should only be used in very specific troubleshooting scenarios. By creating multiple instances of of the WMIPRVSE process you are creating additional system overhead – if you leave the providers split out you may run into resource issues.

That’s it for today’s post. Have a great Friday!

Additional Resources:

MSDN: WMI Provider Hosting and Security (Windows)

- Jim Martin

Share this post :

Two Minute Drill: The .MSP file

CC Hameed — Tue, 26 May 2009 11:00:00 GMT

Hello AskPerf – my name is Digvijay Nath, and I’m a Support Engineer on the Performance team in our Bangalore office. Today, I’m going to quickly cover the .MSP file used by the Windows Installer. The installer uses different file types to glean data about software installs, uninstalls and upgrades. So, let’s get started. There are a number of different files that are used:

.MSI (registered extension for Windows Installer packages): .MSI files contain the binaries to be installed as well as the information on actions for the installer
.MST (Windows Installer Transform file): the Transform file is a list of changes that should be applied to the installation. When you apply the transform to an install package, the installer can modify the data in the installation database.
.MSP (Windows Installer patch): the Windows Installer patch is a self-contained package that contains information regarding the specific versions of the application to which the patch is applicable, as well as information on the differences between the versions
.IPI (In Progress Database): the .IPI contains information about the operations that need to be performed after a system restart during an application install

As I mentioned above, the .MSP files contain information about updates to installed applications, as well as the versions of the applications to which the updates are applicable. The patch carries the metadata needed for applying the update and the updates files. These updated files are stored within embedded cabinet (.CAB) files. The files may be in whole, or in binary form. To explain, a patch in binary form is the byte-level difference between two files - .MST format). A patch package may only contain summary information and transform information and the cabinet files may be downloaded separately. In this fashion, only the necessary components needed for the upgrade are downloaded.

One of the advantages of patching an application that is already installed as opposed to doing a full install of the new version is that the patch only contains the bits required to update the application. This reduces the size of the file that needs to be downloaded or deployed. In addition, patching as opposed to reinstalling helps to preserve user settings and customizations. When installing a patch, the .MSP file is cached in %windir%\installer in the GUID folder that matches the registry entry in HKCR\Installer\Products. With Windows Installer 3.0 and later, any patches that contain the MsiPatchSequence table cause the installer to cache the original files being replaced into a baseline cache. This cache is used for patch uninstall operations since it stores the original files that were replaced. The original files can be copied back to their application folder locations as part of the patch uninstall process. The baseline caches are created separately for per machine and per user managed / per user unmanaged installs.

We have seen scenarios where the Installer folder is consuming large amounts of disk space. Although you may read advice on the internet that it is safe to delete files from this folder to recover disk space, we strongly advise against this course of action. These files are required for application repair, uninstall and reinstallation of patches – if the files are not there, then attempted actions against the applications will fail.

With that, we’ve reached the end of this post. Thanks for stopping by!

- Digvijay Nath

Share this post :

Two Minute Drill: Application Verifier

CC Hameed — Fri, 22 May 2009 11:00:00 GMT

Happy Friday AskPerf. My name is Syed Yusuf, and I am a Support Engineer on the Performance team. Application crash issues can be somewhat tricky to resolve – especially if we’re dealing with a third party application. Today we’re going to take a look a the Application Verifier tool and how it can be leveraged to troubleshoot application issues, or for testing application compatibility beyond most normal use-case scenarios. The tool itself is developer-focused, to be sure, but we have used it on occasion when troubleshooting unmanaged code issues. At this point, it’s probably a good idea to differentiate managed and unmanaged code. Unmanaged code is essentially an executable that loads into memory – like NOTEPAD.EXE. Managed code on the other hand, is code that has its execution managed by the .NET Framework Common Language Runtime (check out Brad Abrams’ post, What is managed code? for more info). A quick word on the difference in support for the two - if you are working on an issue with managed code, App Verifier would not be the right tool, and you should engage our Developer Support group for assistance.

OK, let’s get back to the Application Verifier and what it does. When developing an application, the App Verifier can be used to monitor how an application interacts with the OS. App Verifier can profile the application’s use of objects, the file system, registry etc. It can also be used to check how the application behaves under least-privileged user account operation, and even its interaction with the print subsystem. The App Verifier hooks into the application and then monitors the process for any errors. Information is logged to an XML file.

So, let’s take a quick look at how App Verifier works. The App Verifier can be downloaded from the Microsoft Download Center (the link is in the Additional Resources section). You will need to select the version that matches the processor type for the machine on which you will be running the tool. After you launch the tool, this is what the UI looks like:

Right-click in the left hand pane and select Add Application and then select the executable for the program you are testing. Once you have the program selected, you can select the tests you want to perform in the right-hand pane, and then run the application as normal. When you exit the application, or if it encounters an error, you can review the logs to see the results. For our example, we’re using a sample executable with known issues.

Let’s take a look at the log files (click on View –> Logs):

Right-click on the log you want to view, select “Save As”, and choose a location to save off the file:

Let’s open up the .XML file in Excel and see what we have:

OK, so we know where the error is occurring, but what exactly does it mean. Let’s go back to the App Verifier. The two pieces of information you need are the LayerName and StopCode. In the right hand pane of App Verifier, expand out the different test buckets and find the test that matches the LayerName. For our example, the Heaps test is in the Basics bucket. Right-click the LayerName and select Verifier Stop Options. Select the appropriate code in the Verifier Stop box and the information about the verifier stop is displayed in the Description field.

Armed with this information – you now have a place to start investigating with your development team. And with that – we’ve come to the end of our post. Take care!

Additional Resources:

- Syed Yusuf

Windows 7: Interesting Reads

CC Hameed — Fri, 15 May 2009 11:00:00 GMT

Happy Friday everyone! Now that Windows 7 RC has been released to the world, we thought we’d share some interesting Windows 7 posts from some of our fellow Microsoft bloggers.

Engineering Windows 7:

Security Research & Defense:

AutoRun changes in Windows 7

The Official MDOP Blog:

Get your applications virtualized on Windows 7 Beta with Microsoft App-V

Born to Learn (Microsoft Learning Community and Evangelism Team):

Sneak peek at Windows 7 exam development

Tim Sneath:

Windows 7 Developer Blog:

Test Your Application on Windows 7 at TechEd 2009

Happy Reading! Until next time …

- CC Hameed

Share this post :

Two Minute Drill: TYPEPERF

CC Hameed — Tue, 12 May 2009 11:00:00 GMT

Hello again AskPerf! Blake Morrison here to discuss a little known OS tool called TYPEPERF. TYPEPERF is a built-in tool that writes performance data to the command window or to a log file. If you are a command line junkie, love to script, and need to get Performance data from your Workstation or Server, then TYPEPERF is the tool for you. Let's check out its options and some examples. When you type "typeperf /?" at a command prompt, the following appears:

C:\>typeperf /?
Microsoft r TypePerf.exe (6.0.6000.16386)
Typeperf writes performance data to the command window or to a log file. To
stop Typeperf, press CTRL+C.

Usage:
typeperf { <counter [counter ...]> | -cf <filename> | -q [object]
                                | -qx [object] } [options]
Parameters:
  <counter [counter ...]>       Performance counters to monitor.

Options:
  -?                            Displays context sensitive help.
  -f <CSV|TSV|BIN|SQL>          Output file format. Default is CSV.
  -cf <filename>                File containing performance counters to
                                monitor, one per line.
  -si <[[hh:]mm:]ss>            Time between samples. Default is 1 second.
  -o <filename>                 Path of output file or SQL database. Default
                                is STDOUT.
  -q [object]                   List installed counters (no instances). To
                                list counters for one object, include the
                                object name, such as Processor.
  -qx [object]                  List installed counters with instances. To
                                list counters for one object, include the
                                object name, such as Processor.
  -sc <samples>                 Number of samples to collect. Default is to
                                sample until CTRL+C.
  -config <filename>            Settings file containing command options.
  -s <computer_name>            Server to monitor if no server is specified
                                in the counter path.
  -y                            Answer yes to all questions without prompting.
Note:
  Counter is the full name of a performance counter in "\\<Computer>\<Object>(<Instance>)\<Counter>" format,
  such as "\\Server1\Processor(0)\% User Time".

Here are some quick examples:

Check your Total CPU usage every second:
C:\>typeperf "\processor(_Total)\% Processor Time"

"(PDH-CSV 4.0)","\\2K8SRV\processor(_Total)\% Processor Time"
"04/13/2009 09:50:04.359","2.509119"
"04/13/2009 09:50:05.360","0.754295"
"04/13/2009 09:50:06.360","2.899090"
"04/13/2009 09:50:07.360","1.534207"
"04/13/2009 09:50:08.360","0.559314"
"04/13/2009 09:50:09.360","10.113409"
"04/13/2009 09:50:10.360","10.113409"
"04/13/2009 09:50:11.360","3.094071"
"04/13/2009 09:50:12.360","0.559314"

The command completed successfully.

Check your available memory in bytes every 5 seconds:
C:\>typeperf "\memory\Available Bytes" -si 5

"(PDH-CSV 4.0)","\\2K8SRV\memory\Available Bytes"
"04/13/2009 09:56:30.818","12821381120.000000"
"04/13/2009 09:56:35.819","12821602304.000000"
"04/13/2009 09:56:40.819","12821659648.000000"
"04/13/2009 09:56:45.820","12821610496.000000"
"04/13/2009 09:56:50.820","12821794816.000000"

The command completed successfully.

Grab 5 samples of pagefile total usage on a remote system every 10 seconds:
C:\>typeperf "\\REMOTESRV\paging file(_Total)\% Usage" -sc 5 -si 10

"(PDH-CSV 4.0)","\\REMOTESRV\paging file(_Total)\% Usage"
"04/13/2009 10:01:12.004","1.770573"
"04/13/2009 10:01:22.007","1.770573"
"04/13/2009 10:01:32.009","1.770573"
"04/13/2009 10:01:42.011","1.770573"
"04/13/2009 10:01:52.013","1.770573"

The command completed successfully.

As you can see, this tool is quite powerful. In terms of scenarios in which you might use this tool, consider a situation where you need to gather a limited set of performance data from 500 servers at 3:00 am when the backup job kicks off. Using TYPEPERF, you can configure this in just a few minutes via batch files and scripts. Don’t forget that you need to either use the –sc switch to limit the number of samples or use CTRL+C within the command window. The links below have more information and examples. Take care!

Additional Resources:

- Blake Morrison

Share this post :

Viewing Folder Sizes in Explorer

CC Hameed — Fri, 08 May 2009 11:00:00 GMT

Good morning AskPerf. Today’s post is a very short one, but it does address one of our most common Shell / Windows UI questions. That question is, “Why can’t I see the size of folders in Windows Explorer?” The simple answer is that the behavior is by design. You can view the size of folders by hovering over the folders in Windows Explorer (as shown below):

The primary reason why the Windows UI does not provide this functionality is performance. Every time you navigate through a folder structure in Windows Explorer, the OS would have to perform a recursive scan of the subfolder structure within each folder to get the file and folder sizes and add them up. This would create significant processor overhead – especially if you think about scenarios (home folders for example), where the nested directory structure for each user may be several levels deep and consist of thousands of files and folders. Extend the scenario from the local machine and add in users who are browsing through a directory structure across the network and the performance hit would grow exponentially.

The hover behavior above is governed by the “Display file size information in folder tips” setting on the View tab in Folder Options:

There are instances where turning this option off may provide a performance increase (for example, complex, multi-level nested folder structures) on the local system. When viewing complex folder structures across the LAN/WAN, client machines may experience significant delays. One other setting to be aware of is the NoRemoteRecursiveEvents registry setting (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer). When this value is set to 1, Change Notify requests are turned off for file and folder changes occurring in mapped network share subfolders. If a file or folder is change in the root and first folder level of the mapped share, a Change Notify event is still sent by the server. However if a change is made at the second level (or deeper) in the structure, no Change Notify is sent. This registry setting is set on the client machines.

Additional Resources:

- Prabhakar Shettigar

Printing and Active Directory

CC Hameed — Tue, 05 May 2009 11:00:00 GMT

Good Morning AskPerf. My name is Philip Demaree and I am an Escalation Engineer based in Washington. Today we’re going to take a look at some Printing and Active Directory concepts and troubleshooting. To start with, what we’re going to do is look at the output from LDIFDE for one of our printer objects. The command that we run is: LDIFDE –s <DC for the domain> -r objectclass=printqueue -f <path\filename>. I’m running this on one of my Windows 200x Server machines and pointing it at my domain controller. Printers that are published in Active Directory are published as a child object of the Computer object for the printer. The –s switch points to the Domain Controller for the domain. Printers that are published manually can exist anywhere in the AD as they are not connected to a computer object.

Here’s the full output of the command for one of the printers.

dn: CN=TRAILORPARK-Test Printer _1,CN=TRAILORPARK,OU=Domain Controllers,DC=perfwa,DC=local
changetype: add
cn: TRAILORPARK-Test Printer _1
driverName: HP LaserJet 4050 Series PCL
driverVersion: 1025
flags: 0
instanceType: 4
location: perfwa\Jim’s office
distinguishedName:  CN=TRAILORPARK-Test Printer _1,CN=TRAILORPARK,OU=Domain Controllers,DC=perfwa, DC=local
objectCategory: CN=Print-Queue,CN=Schema,CN=Configuration,DC=perfwa,DC=local
objectClass: printQueue
objectGUID:: ohhNtD6m00C95soPl/t2DQ==
portName: LPT1:
printBinNames: Envelope Feeder
printBinNames: Manual Feed (Tray 1)
printBinNames: Tray 4
printBinNames: Tray 3
printBinNames: Tray 2
printBinNames: Tray 1
printBinNames: Auto Select
printBinNames: Automatically Select
printCollate: TRUE
printColor: FALSE
printDuplexSupported: TRUE
printEndTime: 0
printKeepPrintedJobs: FALSE
printMaxResolutionSupported: 600
printMaxXExtent: 2159
printMaxYExtent: 3556
printMediaReady: Letter
printMediaSupported: Executive (JIS)
printMediaSupported: 16K
printMediaSupported: Envelope Monarch
printMediaSupported: Envelope B5
printMediaSupported: Envelope C5
printMediaSupported: Envelope DL
printMediaSupported: Envelope #10
printMediaSupported: B5 (JIS)
printMediaSupported: A5
printMediaSupported: A4
printMediaSupported: Executive
printMediaSupported: Legal
printMediaSupported: Letter
printMemory: 4096
printMinXExtent: 984
printMinYExtent: 1905
printNumberUp: 6
printOrientationsSupported: LANDSCAPE
printOrientationsSupported: PORTRAIT
printPagesPerMinute: 17
printRate: 17
printRateUnit: PagesPerMinute
printShareName: TestPrin
printSpooling: PrintAfterSpooled
printStaplingSupported: FALSE
printStartTime: 0
printerName: Test Printer #1
priority: 1
name: TRAILORPARK-Test Printer _1
serverName: trailorpark.perfwa.local
shortServerName: TRAILORPARK
uNCName: \\trailorpark.perfwa.local\Test Printer #1
uSNChanged: 4684
uSNCreated: 4682
versionNumber: 4
whenChanged: 20020606234738.0Z
whenCreated: 20020606234737.0Z

As you can see, all the metadata about the printer is available – Color, Duplex etc. When we’re looking at this output, the most important line is this one, located near the end of the output: uNCName: \\trailorpark.perfwa.local\Test Printer #1. This is the path that the AD is still on the network during the Pruning process. It uses the printer name, not the share name. Now, you might have noticed that I have a space in my printer name. In my testing, I discovered that spaces are OK, but putting the period character in the printer name causes issues (think about Fully Qualified Domain Names and you’ll understand why). When the pruning process occurs, if this path cannot be found, the printer is pruned from Active Directory. To verify this path and view the print queue you should be able to connect to this path from the Run command on the domain controller.

I mentioned manually published print queues a moment ago. When you look at the LDIFDE output for a manual print queue, you will notice some differences:

dn: CN=queue1,OU=printers,DC=perfwa,DC=local
changetype: add
cn: queue1
driverName: HP LaserJet 5N
driverVersion: 1025
instanceType: 4
location: perfwa\phil's cube

.
.
.

name: queue1
serverName: philipdwks1
shortServerName: philipdwks1
uNCName: \\philipdwks1\hplaserj

You can see that the dn line doesn’t refer to a server in the same way that the published printer entries do. Also the UNC name is a standard NetBIOS share path – what was input when the printer was manually added.

OK, but what happens if the LDIFDE output isn’t correct (or corrupted)? If you do wind up with a situation like this, then you should get a network trace of the LDAP traffic between the Domain Controller and the Print Server. If the data is correct in the trace, then you have some sort of underlying AD issue, and you should definitely get in touch with our Directory Services team. However, if the data in the trace is incorrect, then the problem is a client-side issue and we need to figure out why the LDAP traffic is being garbled on the client before it sends it.

When you look at the LDIFDE output for a print queue, the “Location” field is the "path” to the printer when searching by Location. The tree that is displayed when browsing for a printer in AD is built by assembling these paths from the Location field for all print queues. This is then displayed as a logical tree. The process is manual, so a good deal of planning needs to go into determining how the tree should be organized. In the Group Policy under Computer Configuration\Administrative Templates\Printers there are two entries that affect the Add Printer Wizard in relation to browsing for printers in the Active Directory. The first is “Pre-populate printer search location text”. This is a Yes / No setting that determines whether or not the location field should be pre-populated when the user does a search. The second is “Computer Location”. This entry contains the text that will be put in the Location field during a search if the “Pre-populate printer search location text” is enabled. This entry should be consistent with the tree structure defined by the administrators that we discussed earlier.

Now let’s switch gears for a second and discuss how to troubleshoot issues where printers “disappear” from Active Directory. A print queue becomes orphaned when its uNCName points to a non-existent or incorrect printer. This results in the domain controller not being able to resolve the name. The Printer Pruner detects that a given PrintQueue object is orphaned by contacting the print server and comparing the Printer object to the Active Directory PrintQueue object. Printer Pruner only runs on domain controllers. Thus, if the domain controller is taken offline, the Printer Pruner is unable to contact any print servers and marks all the published printers as orphaned. By default, Printer Pruner deletes orphaned printers after checking three times – waiting eight hours between checks. Therefore, the domain controller would have to be running continuously and be unable to contact the print server for at least twenty-four hours before PrintQueue objects are deleted.

Troubleshooting these issues requires a little bit of detective work. First, check the System Log on the DC to see if there are many Printer Pruner events at the time when the printers are deleted. If there are, to determine if the problem is indeed related to the Printer Pruner verify that the domain controller has not been removed from or unable to communicate on the network for an extended period of time (replication events etc will provide clues as well). Since the Printer Pruner thread runs in the context of the Spooler service (spoolsv.exe) you also need to ensure that at least one domain controller in each site in the enterprise is running the Spooler service.

There are some other things to check as well:

Can the printer be seen from Active Directory Users and Computers? See Microsoft KB Article 278504 for details.
Are there any DNS errors? An incorrect DNS Server or router configuration can prevent the domain controllers from being able to verify the print queues – resulting in the printers being considered orphaned.
Check the domain policies for Directory Pruning Interval (try setting this to “Never”) and Directory Pruning Retry Periods. These policies are located in the Group Policy Editor under Computer Configuration\Administrative Templates\Printers.

Well, that about does it for this post. Hopefully you found the information useful. Thanks for stopping by!

Additional Resources:

- Philip Demaree

Share this post :