PERFGURU

Manual Print Server Migration

TechNet Archive — Wed, 08 Apr 2009 14:02:00 GMT

Steps to perform on Old/Current Server

Ø Create a Backup folder to some location which can be accessed from new print server.

Ø Backup ‘Drivers’ and ‘Prtprocs’ folder from spool folder to Backup Folder. //This will backup all Print drivers and Print Processors

Ø Export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print to Backup folder. //This will backup complete print configuration registry

Steps to perform on a New Print Server

Ø Copy ‘Drivers’ and ‘Prtprocs’ from backup folder to Spool folder on a new Print Server.

Ø Take backup and delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print on a new Print Server. Restart Print spooler. This will remove all existing print drivers, printers, print monitors, ports and print processor from new print server.

Run Cleanspl utility to clear spooler //download from http://www.microsoft.com/downloads/details.aspx?FamilyID=9D467A69-57FF-4AE7-96EE-B18C4790CFFD&displaylang=en

Ø Double click on the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print exported from old server to import on the new server.

Ø Restart Spooler service and you will be able to see all print queues on a new server.

Batch to change OBJECTGUID to NULL (save below query to a text file as *.bat) //so that there is no reference to Old server

reg query HKLM\SYSTEM\CurrentControlSet\Control\Print\Printers /v ObjectGUID /s | findstr "HKEY_LOCAL_MACHINE" > OG.TXT

for /F "delims=" %%a IN (OG.TXT) do reg add "%%a" /v objectGUID /t REG_SZ /d "" /f

Restart spooler.

File copy fails with the error “Insufficient System Resources”

TechNet Archive — Thu, 19 Feb 2009 11:10:00 GMT

Ø Apply KB 312362 http://support.microsoft.com/kb/312362

Ø Configure the below keys to maximize server resources. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanserver\Parameters subkey, configure the following entries:
• Name: MaxWorkItems Data Type: REG_DWORD Value data: 8196 (decimal)
• Name: MaxMpxCt Data Type: REG_DWORD Value data: 2048 (decimal)
• Name: MaxRawWorkItems Data Type: REG_DWORD Value data: 512 (decimal)
• Name: MaxFreeConnections Data Type: REG_DWORD Value data: 100 (decimal)
• Name: MinFreeConnections Data Type: REG_DWORD Value data: 32 (decimal)

In the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters subkey, configure the following entry:
• Name: MaxCmds Data Type: REG_DWORD Value data: 2048 (decimal)

By default, your registry does not have a Configuration Manager subkey. To create the key, locate and then right-click the following subkey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager Point to New , and then click Key . Type Configuration Manager , and then press ENTER. In the new HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Configuration Manager subkey, configure the following entry:
• Name: RegistryLazyFlushInterval Data Type: REG_DWORD Value data: 60 (decimal)

=============================
Reason for adding or modifying above keys
==============================
<http://support.microsoft.com/?id=312362>
By default, the Memory Manager tries to trim allocated paged pool memory when the system reaches 80 percent of the total paged pool. Depending on the system configuration, a possible maximum paged pool memory on a computer can be 343MB and 80 percent of this number is 274MB

By tuning the Memory Manager to start the trimming process earlier (for example, when it reaches 60 percent), it would be possible to keep up with the paged pool demand during sudden peak usage, and avoid running out of paged pool memory.

This problem can occur because the functions used by all of the copy utilities use buffered input/output (I/O) to transfer data from the source file to the destination file. Whenever buffered I/O is performed on a file, there is a paged pool memory overhead requirement that is proportional to the size of the file. Because paged pool memory is a limited resource, there is an upper limit on the size of file that can be copied.

Since all of the paged pool that is required to buffer an entire file is allocated when the first read or write procedure is performed on the file, the file copy operation fails immediately, instead of half way through the operation.

Regarding PAE

The CopyFileEx and CopyFile functions are used by all of the standard file-copy utilities. Because these functions use buffered I/O, the maximum size of a file that you can copy depends on the amount of paged-pool memory that is available at the start of the copy procedure and whether the Physical Address Extensions (PAE) kernel which allows access to memory above 4 gigabytes [GB] is in use. With the standard kernel, 1 kilobyte (KB) of paged pool is required for each megabyte (MB) of file size that is opened for buffered I/O. Because there are two files involved in a copy procedure, 2 KB of paged pool are required for each MB in the source file.

When the PAE kernel is used, the overhead is doubled and 4 KB of paged pool is required for each MB in the source file.

The procedure entry point LogonUserExA could not be located in the dynamic link library ADVAPI32.dll

fahimm — Thu, 02 Oct 2008 12:33:00 GMT

Hi,

This is my first blog ever! I am a Support Engineer at Microsoft for three years now. Living my dream - to work with Microsoft!.

You can read more about me - check my profile. To the point now!

ISSUE:
On a windows Server 2000 Service Pack 4 when you start an application you get the error message:
"The procedure entry point LogonUserExA could not be located in the dynamic link library ADVAPI32.dll" click on OK and the application loads but certain services might fail to start with "Error 1053: The service did not respond to the start or control request in a timely fashion" error message when you start or stop or pause a managed Windows service.

How do we resovle this?
The tool we could use is Process Monitor available at http://www.microsoft.com and go through the values to analyse what happens at the point when we get the error message! Sounds boring and cumbersome... Let me share what i found but first the disclaimer :)

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows

Then delete the value data for "AppInit_DLLs" which should be "ALockout.dll"

Based on http://technet2.microsoft.com/WindowsServer/en/Library/b4145d9a-c4aa-4e0d-b5bc-cb14c7ff69cd1033.mspx it states the ALockout.dll is a tool used for trouble shooting and

"Microsoft does not recommend that you use this tool on servers that host network programs or services. You should not enable ALockout.dll on Exchange servers because the ALockout.dll tool may prevent the Exchange store from starting.

Important: Before you install the ALockout.dll tool on any mission-critical computer, make a full backup copy of the operating system and any valuable data"

I hope this has been informative for you and I would like to thank you for reading.

Guidance on page file size X64 and X32 machines Windows 2003 servers

TechNet Archive — Wed, 24 Sep 2008 11:24:00 GMT

There seems to be a little confusion on the page file sizing on X64 machines and X32 machines as well. Lots of kb articles have been written; am trying to simplify it in this post.

On 32 bit machines it is easier to determine the size of the paging file because we generally do not come across machines with huge RAM on it.

There is no hard and a fast rule for a particular size of paging file. It depends on scenario to scenario.

Page files have two primary roles

A) As a page file to allow virtual memory to provide support along with the Physical RAM on the machine and potentially allow the server to perform better

B) For use in generating crash dumps for problem investigation when required.

Size required for scenario A can be argued about, and even whether one is necessary at all, but in general a page file, or page files, of several GB up to or larger than RAM size can be used. And for best performance an additional dedicated page file drive could be used.

Size required for scenario B is usually the key factor and relates to the page file on the boot (i.e. Windows) drive, which may have some space constraints of its own.

Let us take the scenario B into consideration; as this is where we need the guidance most of the times.

First we need to determine whether we need a complete dump or a kernel only dump. Most of the cases a kernel only dump would suffice.

For most crashes; i.e. blue screens of death a kernel only dump would give sufficient information; but there are times when we would need a complete dump of the system to investigate the problem.

32 bit machines:-

===============

1. A kernel only dump would be always <= 2GB due to the 32 bit virtual address space limitation. So a page file of around 2 GB+100 MB should be fine.

2. A kernel only dump with a /3GB switch would always be <= 1GB due to the fact that we are giving the kernel only 1 GB of virtual address space. So a page file of around 1 GB +100 MB should be fine.

3. A Kernel only dump with RAM over 4 GB and PAE switch would always be again <= 2GB due to the virtual address space limitations. So a page file of around 2 GB+100 MB should be fine.

4. A complete dump will require a page file of the size of the Physical RAM +100Mb.

64 bit machines:-

================

64 bit machines are where we generally ponder over the size. On a 64 bit machine the Virtual address space is quite large.

Let us have a look at the below table for the address space layouts

REGION	IA64	X64	X86
Process Address Space	7152 GB	8192 GB	2 to 3 GB
System PTE Space	128 GB	128 GB	1.2 GB
System Cache	128 GB	128 GB	960 MB
Paged Pool	128 GB	128 GB	470 to 650 MB
Non Paged Pool	128 GB	128 GB	256 MB

Looking at the above the kernel on X64 Machines could go potentially to the size of the Physical RAM. Most of the machines we have seen are with 64 GB RAM on it .i.e. the high end machines. For ex a bad driver leaking Non paged Pool memory on a machine with 64 GB RAM could potentially take up the whole of the Physical RAM as we can see from the table that the mapping capability of the NPP is 128 GB on X64 machines. From the past experience we see the below

1. A kernel only dump on midrange machines would grow up 4 GB. So a paging file of the size of around 4GB +100 Mb is fine

2. A kernel only dump on a high end machine would grow up to 16 GB. So a paging file of the size around 16 GB +100 Mb is fine.

3. A complete dump requires the size of the Physical RAM +100 Mb.

For getting a near exact figure of the page file we would recommend you to monitor the Memory usage on the system using the perfmon ; which will give you a very good idea .

4. Also please note dumping out boxes with huge amounts of RAM would cause significant down time before it can reboot and come back. A 16 GB dump may take around 40 minutes approximately.

Following are the important considerations for a page file for the dump creation

1. For a dump creation it is MANDATORY for the page file to be on the Windows Drive. (C:)

2. You can re direct the dump to another drive to save space on your system drive. It is not MANDATORY that the dump should be saved on the C drive.

3. For a complete dump option in the GUI you will have to edit the following registry key

Change the value from 0x2 to 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

Value Name: CrashDumpEnabled

Data Type: REG_DWORD

Value: 1

4. On Windows 2008 and Vista the page file used for creating dumps has changed .

Print Spooler Crash Troubleshooting Steps

TechNet Archive — Wed, 06 Aug 2008 10:46:00 GMT

Overview of Print Spooler Component

Print Processor

The print processor tells the spooler to alter a job according to the document data type. It works together with the printer driver to move the spooled print jobs from the hard disk drive to the printer.

Print Monitor

The print monitors are the name of any component that processes the print job after it has spooled and are responsible for directing the output to the print device. Print monitors can be divided into two classes:

·         Language monitors

·         Port monitors

Language monitors are typically used only for bi-directional printers. A bi-directional printer

Supports two-way communication to answer status, and configurations questions sent to it. A

        Bi-directional printer can also give unsolicited status information about the job being printed,

and error conditions such as paper out.

      Port monitors consist of user-mode DLLs. They are responsible for providing a     communications    path between the user-mode print spooler and the kernel-mode port drivers that access I/O port hardware.

Print Spooler crash happens most of the time due to third party print processor and print monitor. We can set printers to use default print processor and monitor by machine changes in the registry called as Print hive cleaning

Note that all of the changes described in this section will take effect when the Print Spooler service is restarted.

Confirm the default Local Print Provider

1) Use Regedit to locate the Print key in the Registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print

2) Click to highlight the Print key in Regedit and export the key as a .reg file for backup purposes (File > Export).

3) Locate the Local Port Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Local Port

4) Confirm that the Driver value in the Local Port Registry key is set to Localspl.dll. If it is not, double-click the Driver value to edit the Data String and set it to Localspl.dll.

Remove 3rd Party Port and Language Monitors

1) Note any 3rd-party Monitors that are listed in the Monitors Registry key for future reference:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors

The default Monitors are:

==========================

AppleTalk Printing Devices

BJ Language Monitor

Local Port

LPR Port

PJL Language Monitor

Standard TCP/IP Port

USB Monitor

Windows NT Fax Monitor

==========================

Note: Not all of the above default Port Monitors will be present in all cases. You may also see the Microsoft Office Document Imaging Monitor which is installed by MS Office.

The 2 types of monitors that may be listed here are Port Monitors and/or Language Monitors. As a general rule, Language Monitors will not have any printer ports defined in the Ports subkey and may be removed without causing a problem. Port Monitors such as HP Standard TCP/IP, however, may have active printers using this port type. If a 3rd-party Port Monitor is in use, with printers defined in the Ports subkey under the Port Monitor, you will need to convert the port(s) to a Standard TCP/IP Port (Standard Port Monitor).

2) To convert the printer ports from the 3rd-party Port Monitor to Standard TCP/IP Port Monitor, perform the following steps:

Convert 3rd Party Ports to Standard TCP/IP Ports

1) Open the Printers and Faxes folder.

2) Right-click the printer that was identified as using the 3rd-party Port Monitor and select Properties.

3) In the Properties for the printer, click the Ports tab.

4) On the Ports tab, click the Add Port button.

5) In the Printer Ports dialog, select Standard TCP/IP and click the New Port button to start the Add Standard TCP/IP Printer Port Wizard.

6) Click Next when the Add Standard TCP/IP Printer Port Wizard starts to specify the printer that will be using this new port.

7) Enter the Printer Name or IP Address for the printer that will be using this new port and click Next.

Note: The wizard automatically fills in the port name for you in the Port Name box. You can either accept this name or type the name that you want to use, and then click Next. Standard Port Monitor then sends a query to the print device. Based on the SNMP values that are returned, the device details are determined and the appropriate device options are displayed. If the print device cannot be identified, you must supply additional information about it.

8) If the Additional Port Information Required page is displayed, perform one of the following tasks under Device Type:

Click Standard, click the appropriate device in the list, and then click Next.

-or-

Click Custom, click Settings, specify the protocol settings (RAW or LPR) and the SNMP status settings that you want to use, click OK, and then click Next.

10) If the wizard prompts you for the print server protocol, specify the protocol that you want to use, either RAW or LPR.

11) If the wizard prompts you to select a port, specify the port that you want to use in the Device Port box, and then click Next.

12) Click Finish, and then click Close. On the Ports tab in the Properties for the printer, you should see that the printer is now set to use the new Standard TCP/IP Port that you just created. The new Standard TCP/IP port is also displayed in the Ports on this server list on the Ports tab in the Print Server Properties (File > Server Properties from within the Printers folder)

13) You can then delete the 3rd-party port from the Ports tab within the Print Server Properties.

14) Repeat these steps for all printers that are using a 3rd-party Port Monitor.

After moving all printers to the Standard TCP/IP Port Monitor, we can delete the 3rd-party Port Monitor's Registry key under the Monitors key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors

Remove All Other 3rd party Monitors

For any other 3rd party Monitors that are identified under the Monitors key and are confirmed to NOT have any printer ports listed under the Ports subkey for the Monitor, we will need to perform the following 2 steps

·         Identify printers configured to use the 3rd party Monitor.

·         Delete the reference to the Monitor for that printer.

·         Delete the Registry key for the 3rd party Monitor.

Note: The Client Printer Port is the Citrix Metaframe Monitor used for autocreated client printers in Terminal Server sessions. Do not remove this Monitor unless it is confirmed to be related to the problem:

==========================

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Monitors\Client Printer Port

Driver REG_SZ cpmmon.dll

==========================

See the following article before removing Lexmark Monitors:

155516 How to Remove the Lexmark MarkVision Monitor

http://support.microsoft.com/?id=155516

1) Note the name of the 3rd-party Monitor that is being removed. We will use this name to search the Print Registry key for references to this Monitor.

Assume, for example, that the HP Master Monitor is installed:

==========================

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Monitors\HP Master Monitor

EOJTimeout REG_DWORD 0xea60

Driver REG_SZ HPBMMON.DLL

==========================

2) In Regedit, click to highlight the Print key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print

3) Press F3, or click the Edit menu and select Find.

4) In the Find What field, type the name of the 3rd-party Monitor that is being removed, HP Master Monitor in this example, and click Find Next. Identify printers that are configured to use the Monitor that we are removing, for example:

==========================

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3\HP Color LaserJet 2500 PCL 6

Configuration File REG_SZ HPBF342E.DLL

Data File REG_SZ HPBF342I.PMD

Driver REG_SZ HPBF342G.DLL

Help File REG_SZ HPBF342E.HLP

Monitor REG_SZ HP Master Monitor

==========================

5) Double-click the Monitor value to delete the 3rd party Monitor data string. In this example, delete the "HP Master Monitor" value. The Monitor value will be left with a blank data string, as follows:

==========================

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3\HP Color LaserJet 2500 PCL 6

Configuration File REG_SZ HPBF342E.DLL

Data File REG_SZ HPBF342I.PMD

Driver REG_SZ HPBF342G.DLL

Help File REG_SZ HPBF342E.HLP

Monitor REG_SZ

==========================

6) Repeat the steps above for all 3rd-party Monitors.

7) Stop and restart the Print Spooler service for the changes take effect.

Net stop spooler

Net start spooler

Note: In most cases, removing the 3rd party Monitors will not affect normal printing. If new problems are seen after removing the 3rd party Monitors, we can restore the backed up Print Registry key to restore the original configuration..

You can then perform the steps above again in smaller steps, stopping and starting the Print Spooler service more frequently, to determine if a specific component is required. If so, skip the removal of this component and continue removing the other 3rd-party items.

Note: If the problem is easily reproducible, you may also individually remove the 3rd-party Monitors to try to narrow the problem down to a particular Monitor. This procedure will take more time and may require restarting the Print Spooler service multiple times.

Remove 3rd-party Print Providers

Remove 3rd party Print Providers by deleting the 3rd-party providers in the following Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers

The default Print Providers are:

Internet Print Provider

Lanman Print Services

The Client Printer Provider is the Citrix Metaframe provider used for autocreated client printers in Terminal Server sessions. Do not remove this Provider unless it is confirmed to be related to the problem:

==========================

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Providers\Client Printer

Name REG_SZ C:\Program Files\Citrix\system32\cdmprov.dll

DisplayName REG_SZ Client Printer

==========================

2) Stop and restart the Print Spooler service for the changes take effect.

Net stop spooler

Net start spooler

Remove 3rd Party Print Processors

Perform the following steps to confirm that all printers are configured to use the WinprintPrint Processor.

·         Identify printers that are configured to use a 3rd party Print Processor.

·         Change the 3rd party Print Processor to Winprint.

·         Delete the Registry key for the 3rd party Print Processor.

1) Note the name of the installed Print Processors under the following Registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Environments\Windows NT x86\Print Processors

The default Print Processor is Winprint:

==========================

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Environments\Windows NT x86\Print Processors\winprint

Driver REG_SZ localspl.dll

==========================

Assume, for example, that the HPPRN05 is installed:

==========================

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Environments\Windows NT x86\Print Processors\HPPRN05

Driver REG_SZ HPPRN05.DLL

==========================

2) In Regedit, click to highlight the Print key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print

3) Press F3, or click the Edit menu and select Find.

4) In the Find What field, type Print Processor and click Find Next. Identify the Print Processor being used for each printer:

==========================

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\Client1

ChangeID REG_DWORD 0x1b9fa8c9

Status REG_DWORD 0x180

Name REG_SZ Client\XPWS

Share Name REG_SZ

Print Processor REG_SZ HPPRN05

==========================

5) Double-click the Print Processor value to change the 3rd party processor data string to Winprint:

==========================

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\Client1

ChangeID REG_DWORD 0x1b9fa8c9

Status REG_DWORD 0x180

Name REG_SZ Client\XPWS

Share Name REG_SZ

Print Processor REG_SZ WinPrint

==========================

6) Repeat the steps above for all 3rd-party Print Processors.

7) Stop and restart the Print Spooler service for the changes to take effect.

Net stop spooler

Net start spooler

Note: In most cases, changing the print processor to Winprint will not affect normal printing. If new problems are seen after changing the print processor, we can restore the backed up Print Registry key and restart the Print Spooler service to restore the original configuration.

You can then perform the steps above again in smaller steps, stopping and starting the Print Spooler service more frequently, to determine if a specific component is required. If so, skip the removal of this component and continue removing the other 3rd party items.

Additional steps to be done

1) Check the Spool folder to see if there are any old files in the folder. When printing is working properly, the files in the Spool folder are deleted as the jobs are printed. The default Spool folder is:

systemroot\System32\Spool\Printers

The Spool folder location can be confirmed by checking the DefaultSpoolDirectory Registry value in the following Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers

Move any old files that are in the Spool folder to see if the problem still occurs. Corrupt files in the Spool folder can cause Print Spooler service problems. You may need to stop the Print Spooler service to move the files from the Spool folder.

2) The Print Spooler service is, by default, dependent only upon the Remote Procedure Call (RPC) service, RPCSS. To confirm the Spooler dependencies, check the DependOnService value in the following Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler

Confirm that the dependent services are started. If there are any other dependent services listed, in addition to RPCSS, edit the DependOnService Registry value to remove all dependencies except RPCSS.

3) Configure the installed antivirus application to exclude scanning the Spool folder. There can be contention between the antivirus application and the Print Spooler service that may cause intermittent printing problems.

If still issue persists we need to collect ADPlus crash dump of print spooler service. ADPlus is a tool that will allow us to get a memory dump from a process that is giving you problems.

To get this tool, please install the “Debugging Tools for Windows" from http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

Once these tools are installed, do the following:

1. Create a directory called c:\adplus

2. Open a command prompt and change to the directory where you installed the debugging tools. By default, this is c:\Program Files\Debugging Tools for Windows

3. Type the following: "cscript adplus.vbs -hang -pn <mmc.exe> -o c:\adplus”

4. Do not interfere with the windows that is opened, just let it run minimized.
5. You will not be able to log off the system while you are monitoring.
6. When the crash occurs, please zip and send me the contents of the c:\adplus directory.

For more information please see refer to this Knowledge Base article: 286350 HOWTO: Use Autodump+ to Troubleshoot "Hangs" and "Crashes" http://support.microsoft.com/?id=286350

After collecting the dump please contact Microsoft for the analysis.

"Windows Update failing" Torubleshooting Steps

TechNet Archive — Fri, 18 Jul 2008 08:37:00 GMT

1) Windows update can fail due to many reasons.But as an initial troubleshooting step we can run script givenbelow.

The following script will re-register windows update dlls and recreate software distribution & catroot folder.

To run the script please copy the highlighted content and save it as wu.bat.

regsvr32 comcat.dll /s

regsvr32 shdoc401.dll /s

regsvr32 shdoc401.dll /i /s

regsvr32 asctrls.ocx /s

regsvr32 oleaut32.dll /s

regsvr32 shdocvw.dll /I /s

regsvr32 shdocvw.dll /s

regsvr32 browseui.dll /s

regsvr32 browseui.dll /I /s

regsvr32 msrating.dll /s

regsvr32 mlang.dll /s

regsvr32 hlink.dll /s

regsvr32 mshtmled.dll /s

regsvr32 urlmon.dll /s

regsvr32 plugin.ocx /s

regsvr32 sendmail.dll /s

regsvr32 scrobj.dll /s

regsvr32 mmefxe.ocx /s

regsvr32 corpol.dll /s

regsvr32 jscript.dll /s

regsvr32 msxml.dll /s

regsvr32 imgutil.dll /s

regsvr32 thumbvw.dll /s

regsvr32 cryptext.dll /s

regsvr32 rsabase.dll /s

regsvr32 inseng.dll /s

regsvr32 iesetup.dll /i /s

regsvr32 cryptdlg.dll /s

regsvr32 actxprxy.dll /s

regsvr32 dispex.dll /s

regsvr32 occache.dll /s

regsvr32 occache.dll /i /s

regsvr32 iepeers.dll /s

regsvr32 urlmon.dll /i /s

regsvr32 cdfview.dll /s

regsvr32 webcheck.dll /s

regsvr32 mobsync.dll /s

regsvr32 pngfilt.dll /s

regsvr32 licmgr10.dll /s

regsvr32 icmfilter.dll /s

regsvr32 hhctrl.ocx /s

regsvr32 inetcfg.dll /s

regsvr32 tdc.ocx /s

regsvr32 MSR2C.DLL /s

regsvr32 msident.dll /s

regsvr32 msieftp.dll /s

regsvr32 xmsconf.ocx /s

regsvr32 ils.dll /s

regsvr32 msoeacct.dll /s

regsvr32 inetcomm.dll /s

regsvr32 msdxm.ocx /s

regsvr32 dxmasf.dll /s

regsvr32 l3codecx.ax /s

regsvr32 acelpdec.ax /s

regsvr32 mpg4ds32.ax /s

regsvr32 voxmsdec.ax /s

regsvr32 danim.dll /s

regsvr32 Daxctle.ocx /s

regsvr32 lmrt.dll /s

regsvr32 datime.dll /s

regsvr32 dxtrans.dll /s

regsvr32 dxtmsft.dll /s

regsvr32 WEBPOST.DLL /s

regsvr32 WPWIZDLL.DLL /s

regsvr32 POSTWPP.DLL /s

regsvr32 CRSWPP.DLL /s

regsvr32 FTPWPP.DLL /s

regsvr32 FPWPP.DLL /s

regsvr32 WUAPI.DLL /s

regsvr32 WUAUENG.DLL /s

regsvr32 ATL.DLL /s

regsvr32 WUCLTUI.DLL /s

regsvr32 WUPS.DLL /s

regsvr32 WUWEB.DLL /s

regsvr32 wshom.ocx /s

regsvr32 wshext.dll /s

regsvr32 vbscript.dll /s

regsvr32 scrrun.dll mstinit.exe /setup /s

regsvr32 msnsspc.dll /SspcCreateSspiReg /s

regsvr32 msapsspc.dll /SspcCreateSspiReg /s

regsvr32 /s urlmon.dll

regsvr32 /s mshtml.dll

regsvr32 /s shdocvw.dll

regsvr32 /s browseui.dll

regsvr32 /s jscript.dll

regsvr32 /s vbscript.dll

regsvr32 /s scrrun.dll

regsvr32 /s msxml.dll

regsvr32 /s actxprxy.dll

regsvr32 /s softpub.dll

regsvr32 /s wintrust.dll

regsvr32 /s dssenh.dll

regsvr32 /s rsaenh.dll

regsvr32 /s gpkcsp.dll

regsvr32 /s sccbase.dll

regsvr32 /s slbcsp.dll

regsvr32 /s cryptdlg.dll

regsvr32 /s schannel.dll

regsvr32 /s oleaut32.dll

regsvr32 /s ole32.dll

regsvr32 /s shell32.dll

regsvr32 /s initpki.dll

regsvr32 /s msscript.ocx

regsvr32 /s dispex.dll

regsvr32 jscript.dll /s

del %temp% /Q /F

del c:\wutemp /Q /F

net stop wuauserv

ren %windir%\system32\catroot2 catroot2.old

cd /d %windir%\SoftwareDistribution

rd /s DataStore /Q

regsvr32 wuapi.dll /s

regsvr32 wups.dll /s

regsvr32 wuaueng.dll /s

regsvr32 wucltui.dll /s

regsvr32 wuweb.dll /s

regsvr32 msxml.dll /s

regsvr32 msxml2.dll /s

regsvr32 msxml3.dll /s

regsvr32 urlmon.dll /s

net start wuauserv

2) Check if WU is working fine. If not then follow next steps

3) Clean boot the computer

a.Start-Run-Msconfig
b. Click "Hide all microsoft services"
c. Click "Disable All"
d. Click Apply/OK and restart

4) Install latest Windows Update agent

http://technet.microsoft.com/en-us/library/bb932139.aspx

5) Below two articles contain common steps which can be followed in WU issue.

http://support.microsoft.com/?id=910337

http://support.microsoft.com/?id=836941

But it’s always a good practice to look for the errors in windows update log and then troubleshoot it.

6) To open windowsupdate.log click on Startà Runà type “windowsupdate.log”

7) To find the error search the log (from bottom)with key word like ERROR,

2008-06-13 11:08:35:022 1068 d58 AU # WARNING: Search callback failed, result = 0x80244018

2008-06-13 11:08:35:022 1068 d58 AU # WARNING: Failed to find updates with error code 80244018

2008-06-13 11:14:11:739 1068 cfc Service ** END ** Service: Service exit [Exit code = 0x240001]

Search error code on http://support.microsoft.com and follow the article related to the error to fix the issue.

Hope this will help to troubleshoot WU issues J

Services not starting after installing service pack on Windows 2003 server

TechNet Archive — Tue, 15 Jul 2008 09:11:00 GMT

1) Disable all third party services and startup items using msconfig.exe.

2) Restart the machine.

3) Open services console (Start à run à services.msc)

4) Check the status of The Remote Procedure Call (RPC) service (rpcss.exe).

5) If RPC service is running in Network Service account then change the login account LocalSystem

6) Following are the two ways to change the login account:

a. Go to properties of the RPC service and click on Logon.

Select Local System account.

b. Open registry editor(Start à run à regedit)

Go to registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs

Value name: ObjectName

Type: REG_SZ

Value data: NT AUTHORITY\NetworkService

Change value of “Value data” to LocalSystem

c. Reboot the machine.

7) If all the services started after changing the account then issue could be due to Impersonation rights .

8) Open dsa .msc and give account permission impersonation policies under

Computer Configuration- LocalPolicy- Security for the following accounts

-Administrators

-IIS-WPG

-Network service

-Local Service

9) Change the logon account of RPC service

Open registry editor(Start à run à regedit)

Go to registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs

Value name: ObjectName

Type: REG_SZ

Value data: LocalSystem

Change value of “Value data” to NT AUTHORITY\NetworkService

Reboot the machine.

"COM+ Event System and MSDTC service not starting" Trouboulshooting steps

TechNet Archive — Mon, 14 Jul 2008 11:40:00 GMT

1. In Control Panel, stop all services, and change the Startup Type to "manual" <except> for the following:

- Alerter

- COM+ Event System

- Computer Browser

- Distributed File System

- Distributed Link Tracking Client

- Distributed Link Tracking Server

- DNS Client

- Event Log

- IPSEC Policy Agent

- License Logging Service

- Logical Disk Manager

- Messenger

- Net Logon

- NT LM Security Support Provider

- Network Connectors

- Plug and Play

- Remote Procedure Call (RPC)

- Remote Procedure Call (RPC) Locator

- Removable Storage

- Security Accounts Manager

- Server

- System Event Notification

- Task Scheduler

- TCP/IP NetBIOS Helper Services

- Windows Management Instrumentation

- Windows Management Instrumentation Driver Extensions

- Windows Time

- Workstation

2. Close Control Panel, and restart your computer.

3. At the command prompt, type the following command:

"msdtc -uninstall" (without the quotation marks)

4. In the registry, remove the following keys if they exist:

HKEY_CLASSES_ROOT\CID

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSDTC

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\MSDTC

HKEY_LOCAL_MACHINE\Software\Microsoft\MSDTC

5. At the command prompt, type the following command:

"msdtc -install" (without the quotation marks)

6. Check Event Viewer for the following message:

Event Source: MSDTC

Event ID: 4104

Description: The Microsoft Distributed Transaction Coordinator service was successfully installed..

7. Restore the Startup Type of the services to their original values, and then restart your computer.

8. At a command prompt, type the following command: "msdtc -resetlog" (without the quotation marks)

9. Start > Run > Regsvr32 es.dll –u

10. Open registry and delete the [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem] key and all its subkeys

11. Close regedit

12. Reboot.

13. Start > Run > Regsvr32 es.dll

14. Reboot the system in safe mode and delete all the files in the following directory “%systemroot%\registration”

15. Rename the %WinDir%\System32\Clbcatq.dll file to %WinDir%\System32\~Clbcatq.dll. Make sure that you include the tilde (~) at the start of the file name.

16. Restart the computer

17. Start Registry Editor (Regedt32.exe).

18. Locate and delete the following key in the registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3

19. At a command prompt, type "cd %windir%" (without the quotation marks), and then press ENTER

20. At a command prompt, type "rmdir /s Registration" (without the quotation marks), and then press ENTER. This is the location folder of the registration database.

21. Click the Start button, point to Settings, and then click Control Panel.

22. Double-click Add/Remove Programs, and then click Add/Remove Windows Components

23. Click Next to go through the reinstallation process, to reinstall COM+.

Remote Assistance in Windows 2008

TechNet Archive — Mon, 07 Jul 2008 11:03:00 GMT

Remote Assistance provides a way for users to get the help they need and makes it easier and less costly for corporate helpdesks to assist their users.

The Remote Assistance application in Windows Server 2008 is implemented in MSRA.exe.

It can be started from the command line by running msra.exe.

%systemroot%\system32\msra.exe

From the Start > All Programs > Maintenance > Windows Remote Assistance

Remote Assistance Registry Keys

User-specific Remote Assistance registry keys will not exist unless Remote Assistance is installed and the current user has run Remote Assistance at least once.

The per-user Remote Assistance registry values are located in the following key: HKCU\Software\Microsoft\Remote Assistance\

The location of the per-machine registry key for Remote Assistance has changed from previous versions of Windows. The new location is:

HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance

In previous versions of Windows location is:

HKLM\SYSTEM\CurrentControlSet\Control\Terminal Service

Remote Assistance Group Policies

Remote Assistance may be configured using the group policies located in the following container: Computer Configuration/Administrative Templates/System/Remote Assistance

The policies write registry values to the following area of the registry: HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services

A Remote Assistance connection may be initiated by the following ways:

++Offer Remote Assistance (unsolicited) mode

++Solicited mode

Offer Remote Assistance (or Unsolicited Remote Assistance)

Unsolicited remote assistance is initiated by an Expert user and is used to offer Remote Assistance to a Novice user. The Expert should know the Novice’s machine name or IP address to view the novice’s desktop. If the Expert needs to share control of the Novice’s machine, the Expert can request control and the Novice can accept or deny the request.

Solicited Remote Assistance

The Invite someone you trust to help you option, also referred to as solicited, Remote Assistance, is initiated by a Novice user that looks for assistance from an Expert user. This mode is started by using one of the following methods:

++Send an invitation by email via Simple MAPI The Novice can email the RA invitation to the Expert as an attachment.

To use this method, the Novice’s email application must support Simple MAPI protocol. e.g. Microsoft Outlook, Outlook Express and Lotus Notes support Simple MAPI protocol.

++Manually save an invitation file and send it to the Expert Novice has to create the ticket as a file (save it to a file) and manually send the file to an Expert.

The invitation file is a text file that is XML formatted and contains information that the Expert's machine will be able to start remote assistance.

Session logs are XML-formatted documents.

Log Path: %SystemDrive%\Users\user_name\Documents\Remote Assistance Logs

A unique session log file is created for each RA Session on the computer. Log files stored within this folder are formatted using XML and are named using the convention YYYYMMDDHHMMSS.xml, where the time format is 24-hour.

How to change RDP Port on TS

TechNet Archive — Tue, 01 Jul 2008 11:16:00 GMT

Terminal services used port 3389 by default. It is well known port TS uses so there can be a chance that it can be a target for attack by network intruders.

Even though network attackers can find the port that is in use, changing TS port from 3389 can make it more difficult to attack a TS server.

TS port can be changed from the registry

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

Value: Port Number

Type: REG_DWORD

Data: 3389 in decimal or d3d in hex

We can use any ephemeral port ranging from 1024-4999 by default. After making the registry changes restart the terminal services

To check the port on which terminal server is listening run nestat –aon from command prompt.

++ Remote Desktop Client

Launch mstsc.exe. In the computer field specify the <TS name>:<port number> e.g. If server name is termserver1 and port is 3900 then we need to put termserver1:3900

++Remote Desktop We Connection

Make connection to web server which host the remote desktop web connection using http://<server name>/ts

Click on the Remote Desktop icon. In Connect to: field specify the <TS name>:<port number>

++Remote Applications:

To configure Remote Applications, accessible through TS Web Access or a custom .rdp file, to use custom Terminal Server port, you must configure custom RDP Settings in TS Remote App Manager MMC snap-in.

RemoteApp Deployment Settings à Terminal Server à RDP Port

Specify the custom port in RDP port field.