mcseFREEsite
Just the right place to learn for Microsoft certifications

Windows NT Workstation and Server
(Study Guide: Written By Baalendu Dadhich)
Part 3

Dear Students! Windows NT Workstation and Windows NT Server exams have lots of things in common and therefore, it is advisable to prepare for both in conjunction. This way, they will also be easier to understand. Take twice as much time but face the two exams together.

Disk Issues:

 Windows NT has a powerful disk management utility called Disk Administrator to create and delete partitions, format disks and carry out a lot of other disk related activities.

 Partitions are logical divisions of a physical disk. A disk can be sub-divided into many partitions, which is separately formattable in any file system. To understand more clearly, if you have a C: drive, you can divide it into several logical drives (partitions) which will be further named as D:, E: and so on…. These logical drives will be treated by the computer as if they are

Separate hard disks. Partitions are independent entities. You can format one of them with FAT file system and the other with NTFS. Both of them will work perfectly. The only difference will be that the FAT partition will not be able to 'see' the NTFS partition, as FAT does not recognize NTFS. The NTFS partition, however, will be able to 'see' contents of the FAT partition. You can also install separate operating systems on them.

 There are two types of partitions: Primary and Extended. There can be up to four Primary partitions (if you don’t use an Extended partition) and they are the ones who can boot the system. If you choose to use an Extended partition as well, you can have only three Primary partitions. The Extended partition can be further subdivided into four logical drives. Keep in mind, however, that none of these secondary logical drives (in Extended partition) can boot the system.

 Partitioning can be done with a DOS utility called FDISK or if NT is previously installed; Disk Administrator can do it. You can also do so by the NT Setup CD.

 One of these all partitions is Active partition. Disk Administrator has a facility to select a partition you want to make Active. However, any partition in which Windows NT is installed automatically becomes the Active partition at the time of installation. Active partition is also System Partition from where the operating system boots. Extended partitions can never be marked Active.

 Windows NT requires two partitions for working as a normal system: System Partition and Boot Partition. A system does not necessarily have two separate partitions. A single partition can have both System Partition and Boot Partition. The way these partitions behave is confusing yet very important.

 System Partition is the partition where boot files are stored. Generally it is the C: drive. This is used by the system to boot (begin operations) which happens immediately after we switch on the computer. Windows NT is nowhere in picture yet. After the computer boots, the system transfers control to the Boot Partition which keeps Windows NT System Files. Now the process of launching Windows NT starts. Remember that System Partition keeps the boot files and Boot Partition keeps the System files needed by Windows NT. They behave exactly opposite to what their names suggest.

 On RISC based computers Primary Partition must be FAT formatted and at least of 2 MB size.

 When you make a partition boot partition, an entry of this effect is made to Boot.ini file. When your computer boots Windows NT operating system, it first checks from the Boot.ini file regarding the location of the operating system files. You can manually edit Boot.ini file, which will be taken up some time later.

 Whenever Disk Administrator is used for the first time, it puts its 'Signature' on the hard disk for future reference. This process also occurs whenever a new hard disk is added. This makes it impossible to replace a disk with another and make the computer treat it as the original one. Disk Administrator utility marks the first physical disk as Disk 0, Second physical disk as Disk 1 and so on.

 If you can divide one disk into many logical disks, it is also possible to combine many physical disks into one joint entity. In such cases, the system will treat both of the physical disks as one logical drive. This is possible using Disk Administrator features such as Volume Sets and Stripe Sets.

 Combining free disk space on one or many drives into a large logical drive is called a Volume Set. Disk space may be collected from 1 to 32 hard drives. The drives could be of any type and the free space to be used for creating the volume set could be different on each drive. However, there are some restrictions such as:

 Stripe sets are also used to combine free disk space from many drives to form a large logical drive with a condition that free space on all drives should be of same size. Another condition is, that number of such drives should be at least two. Other features of stripe sets are the same as volume sets. Stripe Sets are also called RAID LEVEL ZERO. We are just going to talk about what it is.

 Deleting a Volume Set or Stripe Set will delete all the information stored on them.

Fault Tolerance:

We have been emphasizing that security was foremost on the minds of those who developed Windows NT. Of all the major security issues, saving data in case of a disaster is of great import. System crashes, hard disk crashes are not uncommon in the computer world. If no advance arrangement is made to preserve data from such happenings, an organization will lose lots of invaluable information and everything will come to a halt. The very thought of it is horrifying for most companies. Windows NT provides some excellent ways to save data from any mishaps. One of them is Fault Tolerance (and another is Back Up, of course).

 Fault tolerance is a way to save data from being lost during hardware disasters. Fault tolerance is provided using more than disk to protect data. A few standards have been set for different level of fault tolerance. These are called RAID (Redundant Array of Inexpensive Disks). They range between RAID level 0 to 5.

 RAID LEVEL 0: This is a simple stripe set, often called Stripe Set Without Parity. It does not provide any data backup and therefore, no fault tolerance. I wonder why it is there at all?

 RAID LEVEL 1: This is called Disk Mirroring. In Raid Level 1, a hard disk's contents are mirrored (copied exactly in the same manner on another disk). Thus, you have two copies of its contents. Naturally, if one of these two hard disks crashes, you can always use another. Disk mirroring can be done in two ways: 1) Software method and 2) Hardware method. Software method is provided by Disk Administrator itself, which just asks for the drives that are going to mirror each other. You do this by opening Disk Administrator->Fault Tolerance->Establish Mirror. In Hardware method, you use separate disk controllers hardware utility). Whatever you save on one disk, it is automatically saved on the other disk with the help of disk controllers. This method of disk mirroring is also called Disk Duplexing. Unlike Volume Sets and Stripe Sets, any partition (including boot and system partitions) can be part of Mirror Sets.

 If one hard disk in the Mirror Set crashes, you need to break the mirror set from Disk Administrator->Fault Tolerance->Break Mirror. You also need to first boot the system with a Windows NT emergency disk and then modify boot.ini file to point to the mirrored copy of the boot partition. Now the system, in the absence of the original hard disk, will boot from the mirrored disk.

 RAID Level 5 is called Stripe Set with Parity. Minimum three hard disks are required to create a Stripe Set with Parity. The maximum limit is 32. Parity is a mathematical method of verifying data integrity. Raid level 5 is the most popular way of fault tolerance. Stripe sets with Parity work in a unique way. A hard disk's data is divided into as many parts as the number of total hard disks forming the Stripe Set with Parity. Of these parts, one part is reserved for writing parity information (to keep details about locations of distributed data) and in rest of the parts, data pertaining to other hard disks is stored. Data pertaining to a particular disk is divided into parts, which are then written across all other drives. Parity block keeps the information regarding how to put these parts together when that particular hard disk fails. During a disaster, data spread across all other drives can be collected and reconstructed with the help of parity block. After recovery of data, we can regenerate the stripe set from Regenerate application in the Fault Tolerance menu of Disk Administrator.

  All partitions, except boot or system partitions can be part of a stripe set with parity.

  If two drives fail together, Stripe Set with Parity can not recover data.

  All write operations on a stripe set with parity require three times as much memory due to parity calculation.

  When a drive fails, the read performance on a stripe set with parity slows down because data is being recovered using parity information.

  While calculating the size of Stripe Set with Parity, the system will first find out which drive has the minimum free space available. Then the same amount of space will be reserved from each drive. All the free space thus reserved will form a Stripe Set with Parity. Of this, 1/Nth size will be reserved for writing parity information and the rest will be available for storing data. Suppose, you have three drives of 200 MB each, having 80 MB, 100 MB and 120 MB free space respectively. The system will take 80 MB free space from each drive to form a combined size of 240 MB. This will be the effective size of Stripe Set with Parity. Of this, 160 MB will be available for writing data and 80 MB for writing Parity information. Thus, every drive will have 26.33 MB of free space for parity information and 53.66 MB of free space for storing data. This calculation is very important to understand.

  Stripe Set with Parity has lower cost per MB in comparison with Mirror sets. If money is the consideration in finalizing a fault tolerance method, go for RAID Level 5.

  A comparison of speed:

Disk Arrangement

Read Operation Speed

Write Operation Speed

Disk Mirroring/ Duplexing

Fast

Slow

Volume Sets

Slow

Slow

Stripe Set without Parity

High

High

Stripe Set with Parity

Better than Mirror sets

Slow

 Stripe Set with Parity is only possible on a server.

 Pagefile should not be stored on a stripe set. Pagefile stores a certain amount of disk space to be used as RAM whenever the system faces shortage of RAM to perform its operations. In such situations, hard disk space can be used as extended RAM. This extra memory is called Virtual Memory and it is made available by Pagefile.

 Boot Sequence and ARC Paths:

 Before we understand what boot.ini file is and how it is necessary to know its contents, let's have a look at Windows NT boot process. In normal Intel computers, Boot sequence starts with Power On Self Test (POST) during which the system performs a check of all its hardware including hard disk(s), RAM, Monitor, Keyboard and Mouse. After everything is found in place, NTLDR file is loaded that guides the entire boot process in the following manner:

  Boot sequence for RISC based computers is quite simple. They don’t need NTLDR as most of work done by this file is tackled here by the RISC firmware itself. (Firmware is the basic minimum operating system that works on a computer till the main operating system is loaded. This is also called Non Volatile RAM). RISC firmware contains a list of hardware configuration so there is no need for NTDETECT.COM as well. Similarly, their firmware also contains a list of valid operating systems and their locations, and therefore, they don't need BOOT.INI file either. These computers just look for a file called OSLOADER.EXE which takes hardware configuration details from the firmware. Afterwards NTOSKRNL.EXE, HAL.DLL and HKEY_LOCAL_MACHINE\SYSTEM hive are loaded. And this concludes the boot process.

  BOOT.INI file is the only INI file that Windows NT uses. If you remember, earlier versions of Microsoft operating systems (Windows for Workgroups 3.11, Windows 3.1 etc) used INI files to maintain record specific to software loaded on the operating system. That concept has been discontinued with new operating systems from the Microsoft family. All new Windows operating systems including '95 and Windows NT use Registry. We will deal with Registry very soon.

  BOOT.INI file is a hidden, read only file that can be edited using any text editor. It contains the boot menu that is presented to the user upon the beginning of boot process. Boot menu contains details regarding various operating systems stored on the computer and their locations. A computer may have many drives and partitions and in such situation, it may become extremely difficult for the computer to locate the operating system files. BOOT.INI file guides the boot process to move in the right direction.

  BOOT.INI file has two sections, [boot loader] and [operating systems]. Boot loader section defines the operating system that will be loaded if the user doesn't make a selection within a defined period of time. The time parameter (called Timeout) is, by default, set to 30 seconds. So the system waits for 30 seconds for the user to select the operating system he wants to work on. If the user doesn’t do so, default operating system is loaded. If timeout is set to 0, then the default operating system loads immediately. If it is set to -1, the menu displays until the user makes a selection.

 [Boot loader] section of a BOOT.INI file looks like this:

[boot loader]

timeout=30

default=multi(0)disk(0)rdisk(0)partition(1)\WINNT

Contents of the third line (from multi to WINNT) point towards the path where Windows Windows NT operating system is stored. This is a unique way of writing path which is called ARC path. Generally, RISC based computers use such paths. Since not all machines use MS-DOS style paths (like C:\Winnt) for referring to locations on a hard disk, Windows Windows NT uses this cross-platform standard. ARC stands for Advance RISC Computer. We will understand the concept of ARC paths in detail after a while.

 [Operating systems] section of this file contains a reference for every operating system available on the computer. It also contains a few switches to customize the Windows NT environment. It also shows the locations of operating system files in the form of ARC paths. One of these paths should match the entry in the [boot loader] section. Otherwise, there will be two entries for the same operating system.

 [Operating systems] section of BOOT.INI files looks like this:

multi(0)disk(0)rdisk(0)partition(1)\WINNT= "Windows Windows NT Workstation Version 4.00"

multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows Windows NT Workstation V4.00 [VGA mode]" /basevideo /sos

C:\= "Windows 95"

Here you can easily identify ARC paths. The description written within quotes is exactly what is shown in the boot menu. This can be edited.

 Here two switches are used: /basevideo and /sos. The first switch tells Windows NT to load standard VGA driver rather the graphics driver associated with your video card. The other switch tells the system to show names of all the drivers on screen when they are loaded during the boot process. This is particularly useful when you feel that one of your drivers are not working properly. This way, you can identify the faulty driver. Other BOOT.INI switches include /noserialmice (if you specifically want to tell the system that you are not using a serial mouse), /crashdebut (if you want the system to write a log file in case the operating system fails to load) etc.

 Let's now try to understand how ARC paths are written. Here is an example of an ARC path: multi(0)disk(0)rdisk(0)partition(2). The first part of the path identifies the adapter/disk controller as multi or scsi. You know that there are two different types of hard disks/ adapters available: SCSI and IDE. Now a few things that you should always remember:

Now again have a look at the ARC path: multi(0)disk(0)rdisk(0)partition(2).

Go through the following table to understand what means what in ARC paths.

Written As

Description

multi/scsi

The hardware adapter (either multi or SCSI)

(x)

Ordinal number of the hardware adapter

disk(y)

SCSI bus number (always 0 if you are not using SCSI adapters)

Rdisk(z)

Ordinal number of the disk (Always 0 if you are using SCSI adapters)

Partition(a)

Ordinal number of the partition

Example: Suppose you have an IDE adapter that is connected to three IDE drives. Also suppose, the partition on which your operating system resides is the 3rd partition on the 3rd IDE drive. Then the ARC path would be:

Multi (as it is an IDE Adapter)

  1. (since only one adapter is used)

disk(0) (since you are not using SCSI hard disks)

rdisk (since you are using non-SCSI hard disks)

(2) (since it is 3rd disk so its ordinal number is 2)

partition (3) (since the operating system resides on its 3rd partition).

All other things combined will make this ARC path: multi(0)disk(0)rdisk(2)partition(3).

Did you know: SCSI hard disks are faster than IDE. They have more pins than IDE disks and are of larger capacity. Up to 7 hard disks can be connected to a SCSI adapter.

Windows NT Registry:

You know that whenever we first install an operating system or an application, we have to configure it. Configuration provides some important application specific details to the computer. These details may include name of the application, version, key number, any specific hardware/software requirements etc. Whenever we run the application, the computer first checks this information in order to create suitable environment for the application to run. But where does the computer read this information?

Earlier versions of Windows operating system had a provision of INI files for storing such data. If you ever had any chance to use Windows 3.1 or Windows for Workgroups, you must have seen files such as WIN.INI, SYSTEM.INI, PROTOCOL.INI, PROGMAN.INI, WINFILE.INI that the operating system used to store application specific data. With the launch of Windows 95, Microsoft has come up with an excellent alternative to these files, in the form of Registry.

 Registry is a properly organized Windows NT configuration database. It gives the operating system freedom from scattered information stored in so many different INI files. Now all information is treasured at a single, central place. Registry information is stored in a structured manner (like Windows Explorer) and therefore easy to find. INI files were written using impossible-to-read ASCII text, but Registry can contain simple text entries as well. It is very much secure from accidental manipulation. Registry can be read and edited using a utility called "Regedt32.exe", but only administrators have access to it. Few parts of the Registry are so secure that even they can't edit them. One important thing about the Registry is that all the changes made in its entries are dynamic and irreversible, even if you don't properly 'save' them.

 Registry contains records of all Control Panel settings. When we change any setting in the Control Panel, an entry is made to the Registry. Similarly, when we install a Win32 application, its setup program writes configuration information to the Registry. Before doing so, if first checks the existing configuration settings. Many such applications run only after checking information specific to them. Windows NT administrative tools such as Event Viewer, User Manager and Server Manager too, read from and write to information to various parts of the registry. Contrary to operating systems and applications that write their configuration settings only once into the Registry, information related to hardware is fed EVERY TIME Windows NT boots.

 Windows 95 used another version of registry editor called "Regedit.exe." This is included in Windows NT as well for compatibility. You can use both.

 If you have a look at the Registry (through Regedt32.exe of course), you will see that it looks like Windows NT Explorer that has a Root (C: ) and many directories connected to it in the lower order. You can further expand the directories to see subdirectories and subdirectories to see files. Registry is also constructed in the same manner. It is like a giant tree with branches and roots in the tree. There are five roots in Registry which are more precisely called as subtrees. They are:

HKEY_LOCAL_MACHINE: Stores all computer-specific configuration data.

HKEY_USERS: Stores all the user-specific data

HKEY_CURRENT-USER: Stores data for user who is currently working.

HKEY_CLASSES_ROOT: Contains all OLE and file association information.

HKEY_CURRENT_CONFIG: Stores all current hardware settings.

When we expend these sub-trees, we can see keys used to further organize information. And then again, keys are expended into sub-keys. These keys and sub-keys contain values that is the actual configuration data. Another Registry-specific term is Hive, which is a binary file containing all the keys and values within a branch of the registry. (Do open the Registry at least a couple of times to have a feel of this extremely important and delicate tool).

 It is always better to make changes in the Registry only by indirect means (such as from control panel). If you have to edit Registry then make sure to take a back up using RDISK.EXE file (Stored in %Winnt-root%\System32 directory). RDISK.EXE is used to create a emergency repair disk. Another way to back up Registry settings is to make a copy of entire branches by choosing Registry->Save Key in registry editor. Registry editor can also save a subtree as a text file. It has a specific command for it (Registry->Save Subtree As..).

 The Find tool of Regedt32.exe can only search the names of different Registry keys/ sub-keys but the Windows 95 registry editor Regedit.exe can also search their values.

Did you know: Microsoft does not provide any support for problems occurred by editing Registry directly.

Printing:

  In Windows NT networks, printers can either be attached with servers/workstations or can be directly hooked on to the network. Not every other user can install printers. On Workstations, it can be done by Administrators or Power Users; and on Domain Controllers it can be done by Administrators or Print Operators.

  The word "printer" is generally used for the hardware device that prints. But for Windows NT purposes, we will address it as "print device." Microsoft uses the word "printer" for a software construct that allows us to print our jobs on a print device. Always remember that Printer is not a hardware item but a software construct and Print Device is the hardware that prints. Let's also understand a word Printer Driver. You must be aware that all the hardware components of a computer are run by software programs. But what is the link between them? It is the Printer Driver. Drivers are applications that create a way to deal with the hardware they are related to. Similarly, Printer Drivers are applications that convert print jobs into data streams that can be processed by the printing devices. They are hardware specific. An HP printer will have a different printer driver than an Epson printer.

 Printing in Windows NT is the culmination of many different processes. Let's try to understand the steps involved in printing of a job.

 For installing a printer, we use the Printers folder in Control Panel. It is also available on the task bar. When you open the folder, you will find an Add Printer icon. Double click it to open the Add Printer Wizard. You will find two options: My Computer or Network printer server. If the printing device is connected to your computer you should select the first option. If the printing device is attached with some other computer then you should select the second option. As the next step, you will see a list of available ports. These are the ports connected to your computer, which you can use to send data for printing purposes. Ports are of two types: Parallel and Serial. Generally, for printing purposes, we use Parallel ports that are identified as LPT1, LPT2.. and so on. Serial Ports are addressed as COM1, COM2 etc. In the next step, you have to specify a printer name. Remember that Printer is the software interface that you are going to use for sending out print jobs. Here, by specifying a printer name, you are creating a printer (A printer name can be upto 32 characters). Since you are working on a network, you can share your printer enabling other users to utilize it. If you have shared it, you have to give a share name as well. You also have to select the operating systems that are going to use this printer. Now your printer driver is installed. You will be prompted to print a test page. A printer icon will be added in your Printers folder.

 If you want to connect to a remote printer already working, you should choose the Network print server option in the first step. At this, the Add Printer Wizard opens the Connect to Printer dialog box that asks for the name of the shared printer you want to connect your computer to. If you don't remember the printer's name, you may click on Browse to select from a list of available printers. The Add Printer Wizard asks if you want to make it your default printer. Now the installation is complete.

 Once your printer is installed, you can configure it. For this, right click on the printer icon in the printers folder to see a Properties window. It has six tabs: General, Ports, Scheduling, Sharing, Security and Device Settings.

 In the General tab, you can enter a comment about the printer, describe the location, and select the printer driver. You can also select a separator page or file, can change your print processor and can print a test page.

 In the Ports tab, you can select a port for using specifically for printing purposes. If you have many printing devices, you can create a printing pool by attaching them to a single port. In such an arrangement, print jobs will be divided among all the printing devices which will, in turn, provide speedy disposal of jobs. There is a binding however, that all the print devices in a print pool must use the same driver. You can also connect many ports to one printer (exactly opposite to print pool). This way, many ports will send their print jobs to one printer. This will, naturally take more time in processing.

 In the Scheduling tab, you can control the timings of a printer's availability. You can set the printer to be always available, or to be available only during certain hours of the day. You can also set priority of print jobs from this printer in the Priority section of the window. This is particularly useful if there are many printers that send their jobs to a single printing device. If these printers (software constructs) are given different priority levels, print jobs will be taken up according to their priority levels. Higher priority printers print first. You can also use Spooling options that allow you to set the printer to either spool, or not to spool jobs to disk. If you choose not to, the jobs are stored on the hard disk until the print monitor is ready to accept them.

 In the Sharing tab, you can control availability of your printer on the network. By selecting the not shared option, you can restrict printing to a certain printer to your computer. You can also configure your workstation to automatically download print drivers to computers that access your printer over the network.

 Security tab of the window contains three buttons: Permissions (from where you can assign different users permissions to use the printer or manage documents); Auditing (where you can specify if you want to track printing activities of certain users or groups); and Ownership (from where you can take ownership of the printer).

 Another tab is Device Settings tab that keeps details regarding paper-trays, loaded printer fonts, available printer memory etc.

 You can use File and Object Access audit for tracking attempts to use printers.

 If you are using a network printer, you don't need to have a print driver installed on client machines. Only the server needs to have the print driver installed. If you get a new print driver, you just install it on the server from where it will be automatically be copied on to the clients.

 If you are printing by means of OLE (Object Linking and Embedding) or any other indirect means, you need to specify a default printer.

 If your print job is not processed, first thing to check is to stop and restart the spooler service.

 If a print job is not processed- Print to a file and then copy the output file to a printer port. If this works, then the problem is with the spooler. If it doesn’t, the problem is with the application or the driver.

 By default, spooled print jobs reside in %winnt_root%\system32\spool\printers directory until completely printed.

 The disk that contains spooler directory should have enough disk space and if possible, defragmented to ensure fast processing.

 If you want to change the locatio of spool directory, you can do this by Control Panel-> Printers->Advance or by changing the path in Registry parameter HKEY_LOCAL_MACHINE \SYSTEM\ CURRENT CONTROL SET \CONTROL\ PRINT\ PRINTERS. After the location is changed, you must stop and restart the spooler service.

 If a DOS or Windows based format does not gets printed, you may need to map the printer to a port (LPT).

 Whenever a print job is sent, two files .spl and .shd are created in the spooler directory. They remain there till the job is done. Deleting them will stop the print jobs.

 Default print priority level for workstation is 7 and for server it is 9. You can increase/ decrease priority level of a printer from 3 places: Control Panel->Printers; Registry or Task Manager.

 If it is necessary to redirect print jobs to another printer, you may add another port to the printer pointing to the UNC path of the backup printer. UNC Path: You must be aware that Network Neighborhood is used to access computers and resources that are part of our network. Here you cannot access a drive with its name (Such as C: or D: ). Rather you have to access a computer's resources using its name and shared directory names (\\mycomputer\ mydirectory). This path is called UNC path. UNC means Universal Naming Concept.

 For the following clients, you need to install a printer driver locally-

 For non-Microsoft based clients to be able to send print jobs, you need to install services specific to them:

You need to install printer drivers locally on these machines.

 To connect to a printer from clients running operating systems other than Windows NT or Windows '95, you can use following command line syntax:

Net use lpt1 \\server_name\share_name

Lpr -S server_name -P Printername Filename (Unix is highly case sensitive)

Lpq -S server_name -P Printer_name -l

 There are three types of separator pages available :

Sysprint.sep - Prints a page before every job. Used for PostScript devices.

Pcl.sep - A page printed before every job. Used with HP devices in PCL mode.

Pscript.sep - No page printed before jobs. Used with HP devices in PostScript mode.

 Purging a printer removes all documents from queue and spooler.

 If you are using a HP printing device over the network, you must have Data Link Control (DLC) protocol installed on the print server.

 

...Back to Part 2/ Back to Top /Back to Home

 

Hosted by www.Geocities.ws

1