Wednesday, January 2, 2008

OS: Recovery Console In Action

Excellent examples (with screenshots) of typical Recovery Console command you would use to bring Windows back up after a failure to boot successfully.
You have NO Access to any other directory !

You can copy files FROM Floppy disk to the directories on disk, to which you have access.
You can NOT copy files from disk to Floppy Disk !
Recovering from Bootup problems :
When the system displays on booting a message of "missing" NTLDR or NTDETECT,
you can copy these files via Recovery Console from the CD-ROM :
make sure to be on the root of the C:-drive (please make : CD \ ).
In my example, the CD-ROM drive is Drive D: , allowing to make a copy of the files
NTLDR and NTDETECT.COM from the i386-directory to the C:\ - root directory.


If there is a problem with the Boot-sector on the C:-drive, you can use "fixboot" to write
a new boot-sector.
If there is a problem with the Master-Boot-Record of the disk (maybe damaged by a virus),
you can use "fixmbr" to write a new MBR :
 blog it

Saturday, December 22, 2007

Operating Systems: Investigating Corrupt Drivers

You suspect that some driver on your Windows XP system is the source of the system crashing and locking up.
How can you verify that all drivers on the system have not been changed?
1. Run DiskProbe.
2. Run the DMDIAG.EXE program from the Run dialog box.
3. Run ASR.
4. >>Run the SIGVERIF.EXE program from the Run dialog box.

Explanation : Windows 2000 and Windows XP support the verification of digital signatures assigned to device drivers. If you suspect a problem with a driver, run SIGVERIF.EXE to scan for drivers that are not digitally signed. To use the utility, enter the command in the Run dialog box.
A digital signature is an electronic signature that can be used to authenticate the identity of the sender of a message or the signer of a document, and possibly to ensure that the original content of the message or document that has been sent is unchanged. Digital signatures are easily transportable, cannot be imitated by someone else, and can be automatically time-stamped. The ability to ensure that the original signed message arrived means that the sender cannot easily repudiate it later.
A digital signature can be used with any kind of message, whether it is encrypted or not, simply so that the receiver can be sure of the sender's identity and that the message arrived intact. A digital certificate contains the digital signature of the certificate-issuing authority so that anyone can verify that the certificate is real.

If changes to the operating system cause instability or startup problems, you can use the Automated System Recovery (ASR) tool to restore the system state and all files stored on the system volume. ASR is a last resort option to use after you have unsuccessfully tried other recovery methods, such as rolling back drivers, restoring from backups, performing parallel installations, and using System Restore. ASR restores system state files and settings and restores your ability to start the system. For example, hard disk corruption might prevent you from starting Windows XP, and the damage might be serious enough to prevent you from using Safe Mode, Recovery Console, or the Last Known Good Configuration. ASR will restore the Windows XP files that originally were installed from CD-ROM and may place incompatible file versions on the hard drive if files from service packs had been installed after original installation.

DiskProbe is a sector editor tool for Windows XP Professional that allows administrators to directly edit, save, and copy data on a physical hard disk. With DiskProbe, you can replace the Master Boot Record, repair damaged partition table information, and repair or replace damaged boot sectors.

DMDIAG is a command line tool that displays the location and layout of dynamic disks and disk volumes.
Objective: Operating Systems

Operating Systems: Performance Issues and Paging Files

A user's computer has two hard disks. The operating system and all applications are installed on the first hard disk. The second hard disk is used only to store backups of critical files. The computer is running Windows XP Professional.
The user reports that the system is slow when accessing certain applications. You launch the application and discover that there is a lot of disk access when running certain tasks. You use Task Manager and notice that the application is using a lot of memory.
What can you do to optimize performance? (Select TWO.)
1. >>Move the paging file to the second hard disk.
2. Configure the hard disks in a striped (RAID 0) volume.
3. Reinstall the operating system on the second hard disk.
4. Move the user's My Documents folder to the second hard disk.
5. >>Add more RAM to the computer.

Explanation : One way to resolve the problem is to move the paging file to the second hard disk. The paging file is used to swap data in and out of physical Random Access Memory (RAM). When performance is poor and there is a lot of disk access, the most likely problem is memory. You can either add more RAM or optimize the paging file. One way to optimize the paging file is to move it to a different hard disk than the one where the operating system is installed.
If the budget allows, you can also resolve the problem by increasing physical RAM. Doing so will cause the computer to rely less on the paging file.
Reinstalling the operating system on the second hard disk will not resolve the problem. The paging file is created on the same hard disk as the one where the operating system is installed by default.
You cannot configure the hard disks in a striped volume. The system and boot partitions must be located on a simple volume. They cannot be located on a striped volume.
Moving the user's My Documents folder to the second hard disk will not resolve the problem. The problem is caused by memory consumption. Moving the My Documents folder to the second hard disk might improve file access times for documents in the My Documents folder, but it will not resolve the problem the user is having.
Objective:

Components: Antistatic Wrist Strap

What safety feature is incorporated into an antistatic wrist strap?
1. >>A resistor in the path to ground
2. An alligator clip for quick disconnection
3. A high-voltage fuse
4. Static-eliminating material in the wrist band
5. A quick-release snap on the ground wire

Explanation : A wrist-grounding strap is necessary when working with PC motherboards, memory modules, and expansion boards. The strap drains away static electric charges that can damage microchips. A proper strap contains a high-value resistor (typically between 1 and 2 Megaohms) embedded in the strap or the coupling to the ground wire. One side of the resistor connects to a contact plate that touches your skin, and the other side connects to a wire lead (usually coiled) that should be connected to a known-good earth ground. The resistor is of high enough value that it acts as a short to ground for any high-voltage static charges that build up, but appears as an open circuit to the lower, current-carrying voltages that can be lethal (recall Current = Voltage / Resistance).
Static-eliminating material in the wristband may reduce static buildup.
A quick-release snap on the ground wire and an alligator clip for easy disconnection are conveniences, but not safety devices.
A high-voltage fuse would not offer protection against lower, current-carrying voltages.
Objective: Personal Computer Components

Operating Systems: Moving Boot Logs to another computer

Which boot option can you use to move system boot logs from a failing computer to another computer for evaluation?
1. Recovery Console
2. Debugging Mode
3. Safe Mode with Networking
4. Enable Boot Logging
Explanation : Debugging Mode gives you the opportunity to move system boot logs from the failing computer to another computer for evaluation. To use this mode, you first must connect the failing computer to another computer using a serial cable. You then can review the boot logs on a functioning computer.

Safe Mode with Networking is the same as Safe Mode, but the drivers necessary to access the network are loaded. This is useful if you need to access the network to download replacement drivers.

The Enable Boot Logging option allows the system to boot normally while recording all files loaded during the boot process. The log is recorded in a file named NTBTLOG.TXT. The log will identify which drivers loaded and which failed. This is especially helpful if you have a copy of the NTBTLOG.TXT file that was created before there was a problem. You then could compare them to see what has changed.
The Recovery Console does not start the graphical interface, but it does allow you to access any FAT16, FAT32, and NTFS file systems. The purpose of the Recovery Console is to allow you to repair a damaged registry, system files, or file system on the hard drive.
Objective: Operating Systems

Components: Installing SIMM vs DIMMs

Which statement about installing DIMMs is true?
1. You insert the DIMM at a 35-degree angle.
2. You must install DIMMs in matching pairs.
3. You must line up the cutout end of the DIMM with the correct end of the memory socket.
4. >>You push the DIMM straight down into the socket.

Explanation : Dual Inline Memory Modules (DIMMs) differ from the older Single Inline Memory Modules (SIMMs) in a variety of ways. DIMM connectors have different sized sections so you can line them up correctly in the socket. Once you match the sections correctly, you push the DIMM straight down into the socket. When the DIMM is correctly seated, swivel locks on either end snap into place.
SIMMs have a cut-away portion on one edge so you can line them up properly. You insert them at an angle and then raise them into place.
Older 486 and Pentium I systems required SIMMs to be installed in pairs.
Objective: Personal Computer Components

Operating Systems: Backups II

A customer's computer stores accounting and sales data that is backed up according to the following schedule:
Full backup Sunday night Differential backup Monday-Friday nights
The hard disk fails on Thursday morning.
What must you do to restore the data in the least amount of time?
1. Restore the Sunday backup. Restore the Monday backup. Restore the Tuesday backup. Restore the Wednesday backup.
2. Restore the Wednesday backup.
3. >>Restore the Sunday backup. Restore the Wednesday backup.
4. Restore the Sunday backup.
Explanation : You should restore the Sunday backup, then the Wednesday backup. A differential backup backs up all data that has changed since the last full backup. Therefore, you only need to restore the last full backup and the most recent differential backup.
You cannot restore the data using only the Sunday backup. If you only restore the Sunday backup, all data changed since the Sunday night will be lost.
You cannot restore the data using only the Wednesday backup. You must restore the full backup before you can restore the differential backup.
You do not need to restore the Sunday, Monday, Tuesday, and Wednesday backups. If the weekday backups were incremental backups, you would need to take these steps. However, since they are differential backups, they include all data changed since the last full backup.

Operating Systems: Dealing corrupt OS file

A user's computer cannot boot because an operating system file is corrupt.
What should you try first to resolve the problem?
1. Boot to Safe Mode and use System Restore.
2. Boot to Recovery Console and use System Restore.
3. Boot to Recovery Console and run Chkdsk.
4. Boot to Safe Mode and run Chkdsk.

Explanation : You should boot to Recovery Console and run Chkdsk. Because an operating system file is reported as corrupt, you will need to boot to Recovery Console. To do so, insert the Windows XP installation disc and choose R when prompted whether you want to install Windows XP or repair an existing installation. Next, run Chkdsk with the /r option to locate bad sectors and repair the file. If that does not work, you will probably need to reinstall Windows or restore from backup.
You cannot boot to Safe Mode because an operating system file is corrupt. Safe Mode loads a minimum set of drivers, but it still requires that the operating system files be valid.
You cannot use System Restore from Recovery Console. System Restore requires Windows XP. Also, System Restore is used to recover from configuration problems caused by installing applications or updating drivers. It does not perform a check disk.
Objective: Operating Systems

Operating Systems: Utilities to view Operating System Errors

Which utility would you use to view errors reported by operating system components?
1. Event Viewer Application log
2. System Information
3. System Monitor
4. >>Event Viewer System log

Explanation : Errors, warnings, and informational messages generated by the operating system components are viewed through the Event Viewer System log.
You would not use the System Monitor to view operating system error messages. System Monitor is used to monitor real-time performance of system components, operating system processes, and applications.
You would not use System Information. The System Information utility provides a lot of information about installed hardware and software. But it does not list error messages generated by operating system components.
You would not use the Event Viewer Application log to look for errors logged by operating system components. Applications log errors, warnings, and informational messages appear in the Application log.
Objective: Operating Systems

Components: Keyboard issues

A user reports that the C key sometimes will not register or registers multiple times. The problem only affects the C key.
What should you do?
1. Use Accessibility Options to disable StickyKeys.
2. >>Use tweezers to remove the debris from around the key.
3. Dust the keyboard using a soft cloth and window cleaner.
4. Install a new keyboard driver.
Explanation : The problem is most likely caused by debris under or around the C key. You can remove the debris with tweezers. Or if the entire keyboard seems dirty, you can use compressed air to blow out the debris or shake the debris to one end and pick it out with tweezers.
You should not spray window cleaner on a keyboard. You should avoid getting liquid under the keycaps. If you need to clean a keyboard's keys, avoid getting liquid under the keys.
Disabling StickyKeys will not solve the problem. StickyKeys is an accessibility feature that helps users who cannot press multiple keys at once activate key sequences.
The problem is not likely caused by a keyboard driver. The most likely cause of the problem is debris under the key.
Objective: Personal Computer Components

Operating Systems: Automatic Update Options

You are configuring a Windows XP computer for a client who travels frequently. The client often must connect to the Internet using a slow-speed connection. The client wants to ensure that the computer is updated with security updates in a timely manner, but he does not want to download updates when the computer is connected through a slow link.
What should you do?
1. On the Automatic Updates tab, select Download updates for me, but let me choose when to install them.
2. On the Automatic Updates tab, select Notify me but don't automatically download or install them.
3. On the Automatic Updates tab, select Turn off Automatic Updates.
4. On the Automatic Updates tab, select Automatic (recommended).

Explanation : You should select Notify me but don't automatically download or install them. This configuration option will allow the user to decline the update before it is downloaded based on how critical the update is and the speed of the computer's connection.
You should not select Download updates for me, but let me choose when to install them. Doing so will allow the user to selectively install the updates at a convenient time, but it will not prevent them from being downloaded when the computer is using to a slow connection.
You should not select Automatic. Doing so will not allow the user any control over the updates. They will be downloaded and installed automatically.
You should not select Turn off Automatic Updates. Doing so will cause the user to not be notified of security updates and will leave it up to the user to update the computer.
Objective: Operating Systems

Components: Command to Improve HDD performance

Which disk utility provides the best way to improve disk performance?
1. FDISK
2. CHKDSK
3. SCANDISK
4. >>DEFRAG
Explanation : Defragmenting a hard drive reorganizes all the files into contiguous sectors on the disk. This improves disk performance because the system can recover a file in fewer revolutions of the disk.

Both CHKDSK and SCANDISK can identify and correct disk errors, but neither will improve disk access times. CHKDSK is used by Windows NT family platforms, while SCANDISK is found in Windows 9x family of operating systems. Both perform the same function.
FDISK is a disk partitioning utility used in the initial setup of a hard drive. It creates the Master Boot Record required by the operating system. It does not affect disk performance.
Objective: Personal Computer Components

Printers and Scanners: More on the printing process

Which component of a laser printer is responsible for attaching the toner to the paper and making the print job permanent?
1. >>Fuser assembly
2. Photosensitive drum
3. Transfer corona
4. Print head

Explanation : The fuser assembly is the part of the laser printer that performs the final step in creating a printed page. Prior to this point, the toner is attracted to the page because of a difference in electrical charges. However, the toner is not permanently attached. The fuser assembly heats the toner and the paper, melting the plastic in the toner. The roller in the fuser assembly then presses the toner onto the page, making the print job permanent (fusing the image to the paper).

The transfer corona (or transfer roller) is used to apply a positive charge to the paper so that the paper attracts the negatively charged toner.

The photosensitive drum is used to create the image that will be printed. It is first given a strong uniform negative charge (between -800 and -1200V). Next, the image is "written" to the drum using the laser beam, which changes the charge of the dots that should be written to a low negative charge (between -200 and -400V). The toner, which is given a higher negative charge than the dots (around -600V) are attracted to the areas where the dots are drawn, thus forming the image on the drum.
A print head is used on impact printers, such as dot-matrix printers and on inkjet printers. A laser printer does not have a print head.
Objective: Printers and Scanners

Operating Systems: Change Directory Command

You are writing a batch file. The current focus is the C:\Windows\System directory. What command do you use to change the current focus to the root of the drive C:\?
1. CD\
2. CD..
3. C:
4. C:\
Explanation : The CD command is used to change the directory that has focus when working at a command prompt. The CD\ command changes the current focus to the root directory.
The CD.. command is used to navigate up to the parent directory.

The C: command is used to change the input focus to the C: drive, not to move the focus to the root directory on the same drive.

Typing C:\ will cause an error.
Objective: Operating Systems

Components: Installing New Memory Modules

Before installing new memory modules in your computer, what precautions should you take prior to removing the new modules from the bag and installing them? (Select TWO.)
1. Shut down and unplug the monitor.
2. >>Shutdown the PC and unplug the power cord.
3. Clean the motherboard with an approved cleaner.
4. Wash your hands.
5. >>Put on an antistatic wrist strap and clip it to a chassis ground connection.

Explanation : Before installing the new memory modules, the system should be turned off and unplugged so it does not accidentally start when you are installing the modules. Unplugging the system also cuts off the small amount of current that flows even when the system is turned off.
You should also use an antistatic strap to discharge any static prior to touching the modules. ESD (Electrostatic Discharge) must be prevented because it can cause the failure of the new modules.
Washing your hands, shutting down and unplugging the monitor, and cleaning the motherboard are unnecessary steps and would have no effect on the outcome of the job.
Objective: Personal Computer Components

Printers and Scanners: Memory Overflow Errors

A user receives a memory overflow error when printing a high resolution image.
What should you try to allow the user to print the document? (Select TWO.)
1. >>Reduce the printing resolution.
2. Upgrade the printer driver.
3. Add more memory to the computer.
4. Move the spooler to a hard disk with more disk space.
5. >>Turn off RET.

Explanation : You should reduce the printing resolution. A memory overflow error might mean that you are trying to print data that is too complex for the printer to render. In this case, reducing printing resolution will reduce the complexity of the data and the amount of data that must be stored in the printer's memory.

You might also try turning off Resolution Enhancement Technology (RET). RET helps produce smooth curves. However, it also requires more memory. Therefore, disabling RET might reduce the amount of printer memory required enough to allow the user to print the document.
Moving the spooler to a new location will not resolve the problem. If the hard disk containing the spool file did not have sufficient disk space, you would find that large print jobs would not print, but smaller print jobs would.
Upgrading the printer driver will not resolve the problem. The problem is caused by the printer's hardware being unable to handle the document's complexity.
Adding more memory to the computer will not resolve the problem. The problem is caused by the printer's hardware being unable to handle the document's complexity, not by insufficient memory in the computer.
Objective: Printers and Scanners

Operating Systems: Services

You install an application that includes a Windows service. When you restart the computer, you receive the message that the application cannot load because a service it depends on is not running.
Which utility should you use to correct the problem?
1. Program Compatibility Wizard
2. MSConfig
3. Add or Remove Programs
4. >>Services

Explanation : You should use the Services utility. The Services utility allows you to manage Windows services, including starting, stopping, pausing, disabling, and configuring their log properties. In this case, you need to locate the service on which the application depends and configure it to start automatically when the computer restarts. To prevent a restart now, you can start the service manually. If the error message does not provide enough information for you to know which service is not running, you can use Event Viewer to look for an error or warning. Operating system errors are logged to the System log. Application errors are logged to the event log.
The MSConfig utility (also called the System Configuration Utility) allows you to view which services are running and which are stopped. However, it does not allow you to modify their configuration or start or stop them. One useful feature is that MSConfig allows you to filter the services displayed to only non-Microsoft services, which can help you identify malicious programs that are loaded as Windows services.

You cannot resolve the problem using Add or Remove Programs. Add or Remove Programs allows you to install programs, but it does not allow you to configure services.

You cannot resolve the problem by using the Program Compatibility Wizard. The Program Compatibility Wizard allows you to specify backwards compatibility settings for legacy applications. It does not allow you to manage Window services.
Objective: Operating Systems

Components: External CD-Rom on a Parallel Port

A user reports poor performance accessing an external CD-ROM drive installed on a parallel port.
What should you do?
1. Change the system BIOS to use IEEE-1284 ECP/EPP mode.
2. Change the system BIOS to use IEEE-1394 FireWire mode.
3. Update the CD-ROM driver.
4. >>Assign a different DMA to the CD-ROM drive.

Explanation : You should change the system BIOS to use IEEE-1284 ECP/EPP mode. IEEE-1284 is the standard for parallel connections. Enhanced Capabilities Port (ECP) and Enhanced Parallel Port (EPP) are two standards for bi-directional communication over a parallel port. They provide better performance than older standards. However, you will still receive better performance by purchasing a USB or Firewire external drive.

You cannot change a parallel CD-ROM drive to support IEEE-1394 FireWire. FireWire is a high-speed wired connection appropriate for data transfer, such as to an external drive. However, the drive must have a FireWire port.

Updating the CD-ROM driver will most likely not solve the problem. Updating the driver might correct other problems, but if the BIOS is configured to support an older parallel bi-directional standard, it will not resolve the performance issue.

Assigning a different Direct Memory Address (DMA) to the CD-ROM drive would resolve a resource conflict, but it will not help correct a performance problem.
Objective: Personal Computer Components

Printers and Scanners: Sharing a PC printer with PDAs

A user in the sales department has an ink jet printer that is currently connected to the user's desktop computer through the parallel connection. The printer is currently available for use only by that user. The department wants to enable all salespeople to print to the printer from their PDAs.
What should you do?
1. >>Connect a Bluetooth adapter to the printer's USB port.
2. Install an 802.11g wireless access point. Connect the computer to the access point.
3. Connect a Bluetooth adapter to the computer's USB port.
4. Install an 802.3 switch. Connect the printer to the switch.

Explanation : You should connect a Bluetooth adapter to the printer's Universal Serial Bus (USB) port. Doing so will make the printer visible to Bluetooth devices that are in range, including the Personal Data Assistants (PDAs).

You should not install an 802.3 switch. 802.3 is the Ethernet standard for a wired local area network. It will not allow wireless connectivity for PDAs.

You should not install an 802.11g access point and connect the computer to the access point. Doing so will not make the printer available unless you share the printer to the network and the PDAs are compatible with Windows file and printer sharing.
You should not connect a Bluetooth adapter to the computer's USB port. Doing so will allow the computer to communicate with Bluetooth devices, but it will not allow the printer to be visible to Bluetooth devices.

Operating Systems: Setting Users PC for Automatic Updates

You are installing Windows XP Professional on a user's computer. You want to ensure that the user receives all security updates in a timely manner. The user's computer is connected to the Internet.
What should you do?
1. Add a shortcut to the URL to the Windows Update Web page to the All Users Startup folder.
2. Add a shortcut to the URL to the Windows Update Web page to the user's Startup folder.
3. >>Use the System Control Panel utility to enable Automatic Updates.
4. Create a batch file that checks the Windows Update Web page and add it to Scheduled Tasks.

Explanation : Windows XP Professional supports Automatic Updates to allow users to keep their systems up to date with service packs and security updates. You can enable Automatic Updates through the System Control Panel utility.
Each user has a Startup folder located at C:\Documents and Settings\user_name\Start Menu\Programs\Startup. This folder contains shortcuts to programs that run when a specific user logs on. However, adding a shortcut to the Windows Update Web site Uniform Resource Locator (URL) to the user's Startup folder will not cause updates to be applied each time the user starts the computer.

Shortcuts to programs that should start when any user logs on should be added to the C:\Documents and Settings\All Users\Start Menu\Programs\Startup folder. However, adding a shortcut to the Windows Update Web site's URL to the All Users Startup folder will not cause updates to be applied each time the user starts the computer.

You should not create a batch file that checks the Windows Update Web page and add the batch file to Scheduled Tasks. However, you can configure Automatic Updates to run on a schedule by using the System Control Panel utility.

Objective: Operating Systems