cluberti

That's really not a lot of RAM, and the memory manager is likely fighting with the kernel when you are resuming from hibernation for available physical RAM. What would happen if you added another 256MB of RAM? 256MB is the maximum size of just one kernel memory pool (out of about 5 major kernel memory pools)!

Well, anything is possible . And if w32time is disabled, we can rule that out. Have you contacted the vendor of the machine to see if there are any x64 issues on that hardware, or if a BIOS update is available?

Sorry - I've been looking at internal documents, and I noticed that the article did indeed not specifically include NT4 (I believe it used to - it's been awhile ). Since it's probably the same issue on the Windows 2000 server as on the NT4 server it may not be necessary to get a dump, but if you'd like I _am_ certain that this will work for NT4 (note that it requires a null-modem cable and a second server or PC, but it'll work): http://support.microsoft.com/default.aspx?...kb;en-us;303021

Here's a silly question, but I'm surprised it hasn't been asked - what's the bug check STOP code?

What are the NTFS permissions on the new riprep image folder on the RIS server? Also, when you go to the properties of the RIS server's computer object in AD, is the image listed there?

http://consumer.usa.canon.com/ir/controlle...lid=12764#windr Click the drivers link and viola - v1.02 for x64.

What are the NTFS permissions on the actual folder? Share permissions control share access, but NTFS permissions also apply after share permissions have been processed.

What problems are you seeing with 10.0 and 10.0.1? I see quite a few every day (which are usually resolved by upgrading to 10.0.2) - I may be able to assist.

It applies to all windows machines with the w32time service (which is 2000, XP, and 2003). It does seem like the w32time service is slowing your clock. What happens if you set the time correctly, then disable the w32time service? Also, is the time in your BIOS correct?

You could always look into creating your own custom .adm templates in AD, and just put the registry changes in there - that will work too.

Yes, it supports the method listed in the KB article in step 3 - if you look at the products affected in the KB article, NT4 SP6 is listed. As to the dump, you'll have to PM me and I'll give you a location where to upload via ftp.

There are quite a few things that go into boot speed, including layout of files on disk, the amount and type of drivers installed, and service dependancies. Laptops with smaller drives (depending on the RPM speed of the drive) generally will boot a trifle faster than a desktop with a large drive for these reasons.As to the % of memory free, 10% of 192MB is a lot smaller than 10% of 1GB, so this may not be a fair assessment. Windows will swap out more virtual address space to disk on a machine with 192MB of RAM, whereas it will let address space stay in RAM longer before paging it out on a machine with 1GB of RAM. These numbers don't mean anything unless you know why, which I don't think we do. You'd need to get memory dumps of each machine, and do a !vm on each to see how much is in RAM at the time of the dump, and how much has been paged out to disk (and what). For the most part, yes. I suggest reading Windows Internals, 4th Edition, for more information on the Windows kernel and memory management - it's the bible on the innards of how Windows works.

Go to the following links to download each utility: - Filemon http://www.sysinternals.com/utilities/filemon.html - Regmon http://www.sysinternals.com/utilities/regmon.html The link for each utility has instructions on the utility's usage. Once you've downloaded and unzipped each utility, start both filemon and regmon, and then quickly attempt to start the service. Once the service starting fails, stop each utility from logging quickly (again, instructions for each at the above links). You will now be able to look through the regmon and filemon logs to see if you have any Access Denied or Not Found messages when you attempted to start the service.

Have you read the KB I posted and at least tried some of the options there?

Perfmon, poolmon, and configuring the server to do a keyboard-initiated dump the next time the server hangs up would be your best options (actually all three at the same time should be sufficient to diagnose the problem). 1. Configure perfmon using the perfwiz.exe utility available from Microsoft: http://www.microsoft.com/downloads/details...&DisplayLang=en 2. Use the poolmon utility to gather kernel pool tagging data: http://support.microsoft.com/?scid=http%3a...7415%2fen-us%2f 3. Configure the server to do a complete memory dump, and enable the CTRL+Scroll Lock manual bugcheck option: http://support.microsoft.com/kb/244139/ 4. Reboot your servers after making changes in steps 1 - 3 on both, and the next time the issue occurs, hold down the RIGHT CTRL key, and while holding the key down, press the Scroll Lock key twice. The server will bugcheck with a STOP 0x000000E2 code, and create a complete memory dump. Once you've completed steps 1 - 4 on the server, let us know and we can go through the perfmon, poolmon, and memory dump data to tell you why your server is hanging.

The clock speed on the client computer functions correctly when you synchronize the clock of the client computer with the clock of the server. When W32Time determines the local clock offset, it makes the following adjustments to the time: • If the local clock time on the client computer is behind the current time on the server, W32Time changes the local clock time immediately. • If the local clock time on the client computer is more than three minutes ahead of the current time on the server, W32Time changes the local clock time immediately. • If the local clock time on the client computer is less than three minutes ahead of the current time on the server, W32Time quarters or halves the clock frequency on the client computer until the server clock and the client clock are synchronized. Note If the local clock time on the client computer is less than 15 seconds ahead of the current time on the server, W32Time halves the clock frequency on the client computer. If the local clock time on the client computer is more than 15 seconds and less than 3 minutes ahead of the current time on the server, W32Time quarters the frequency. The length of time that the clock runs at an unusual frequency depends on the size of the local clock offset that W32Time is correcting. I'd bet that Windows time keeps slowing your clock, but as to why I would not know. You may want to look at the following KB article to see if any of these registry changes may help: 223184: Registry entries for the W32Time service http://support.microsoft.com/default.aspx?...kb;EN-US;223184

Bug Check 0x7F: UNEXPECTED_KERNEL_MODE_TRAP The UNEXPECTED_KERNEL_MODE_TRAP bug check has a value of 0x0000007F. This indicates that a trap was generated by the Intel CPU and the kernel failed to catch this trap. This could be either a bound trap (a trap the kernel is not permitted to catch) or a double fault (a fault that occurred while processing an earlier fault, which always results in a system crash). Parameters The first parameter displayed on the blue screen specifies the trap number. 0x00000000, or Divide by Zero Error, is caused when a DIV instruction is executed and the divisor is zero. Memory corruption or other hardware problems can cause this error. Cause Bug check 0x7F usually occurs after the installation of faulty or mismatched hardware (especially memory) or in the event that installed hardware fails. Troubleshooting If hardware was recently added to the system, remove it to see if the error recurs. If existing hardware has failed, remove or replace the faulty component. Run hardware diagnostics supplied by the system manufacturer, to determine which hardware component has failed. The memory scanner is especially important; faulty or mismatched memory can cause this bug check. For details on these procedures, see the owner's manual for your computer. Check that all adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure adapter card contacts are clean. If the error appears on a newly installed system, check the availability of updates for the BIOS, the SCSI controller or network cards. Updates of this kind are typically available on the Web site or BBS of the hardware manufacturer. Confirm that all hard disks, hard disk controllers, and SCSI adapters are listed in the Microsoft Windows Marketplace Tested Products List. If the error occurred after the installation of a new or updated device driver, the driver should be removed or replaced. If, under this circumstance, the error occurs during the startup sequence and the system partition is formatted with NTFS, you might be able to use Safe Mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in Safe Mode, you need to start the computer using the Recovery Console in order to access the file. Also try restarting your computer, and press F8 at the character-based menu that displays the operating system choices. At the resulting Windows Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time. Overclocking (setting the CPU to run at speeds above the rated specification) can cause this error. If this has been done to the computer experiencing the error, return the CPU to the default clock speed setting. Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. Disabling memory caching of the BIOS might also resolve it. If you encountered this error while upgrading to a new version of Windows, it might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version. If possible, remove all third-party device drivers and system services and disable any virus scanners prior to upgrading. Contact the software manufacturer to obtain updates of these tools. Also make sure that you have installed the latest Windows Service Pack. Finally, if all the above steps fail to resolve the error, take the system motherboard to a repair facility for diagnostic testing. A crack, a scratched trace, or a defective component on the motherboard can also cause this error. What's likely happening is that VMWare is not emulating a hardware issue or driver issue that your real machine has, that is being exacerbated during the setup.

What servers are your WINS and DNS settings configured to use on the workstation?

runas command? You may also want to add the registry keys using something more secure, like an encrypted VBS file. Otherwise, the admin username and password will be in the batch file.

1. Open a command prompt and type the following command: drwtsn32 -i 2. Once Dr Watson is configured as the default debugger, type this command in the command prompt window: drwtsn32 3. That will open the "Dr Watson for Windows" window. Make sure the following options are "checked": - Crash Dump Type: Full - Dump All Thread Contexts - Append To Existing Log File - Visual Notification - Create Crash Dump File Click OK to close the Dr Watson window. Now, if a program closes itself because of a crash, you should get a visual Dr Watson notification, and it should also create a .dmp file in the location specified in the Dr Watson window you opened in step 3. If you don't feel comfortable debugging a dump file, post it here and we'll take a look. 4. Open Start > Control Panel > System > Advanced tab > Performance "Settings" button > Advanced tab > Virtual Memory "Change" button. Make sure that your Paging file is configured on drive C:, and that it's initial size is at least as large as the amount of RAM installed on the machine +50MB. For example, if you have 512MB of RAM, your initial pagefile size should be at least set to 562. Once changes are made, click the "Set" button, then click "OK", then "OK" again. 5. Click the Startup and Recovery "Settings" button. Make sure that, under "System failure", the following options are set: - Write an event to the system log - Send an administrative alert - Complete memory dump - Overwrite any existing file Make certain that "Automatically restart" is NOT checked. That way, if these random server restarts are actually crashes, we'll get a bug check telling us what happened, and we'll also get a complete dump of what was in memory at the time. Again, if you aren't comfortable debugging dump files, we can do that. As to the other issues you're seeing with installing programs, running task manager, etc. - download autoruns from www.sysinternals.com, and boot into Safe Mode. Run autoruns from there, disabling all non-Microsoft items. Reboot in normal mode, and see if the issues continue, or if you are able to install apps, run task manager, etc. Otherwise, you may wish to use an online virus scanning utility like the ones offered by the major A/V vendors or Microsoft's OneCare online application. Good luck .

http://www.msexchange.org/tutorials/Diagnostics-Logging.html The settings are similar for 2003, so it's still a very good and relevant article.

Are we talking about a transitive trust, or was it a one-way trust?

Exchange logs, or regular Windows logging? And what exactly do you want to log?

Is the wallpaper a .bmp, or is it a .gif or .jpg? If it's not a .bmp, I'd strongly suggest changing your wallpaper to a .bmp and using that. Also, is it stored on a network share, or on the local machine? I know the GPO will state that you can use a UNC path, but that has never worked properly (actually, that whole portion of group policy is a mess, but I digress ).

Try the "findstr" command.