How to Analyze Windows Memory Dump

Welcome back guys :)

Today here I am going to explain about how to analyze the memory dump.

As in my previous post I have describe to you: How to create memory dump and where you can find that dump file.

Let’s say you have configured a memory dump on a server and server got unexpected down with BSOD.

Now you need to go to the default location i.e. %SystemRoot%\Memory.dmp for the memory dump file.

You can find the memory.dmp as below.

This memory.dmp file is the dump file for complete dump. Now you need to analyze it ;)

There are bundle of software in the market for the same, some are free of cost and some are licensed.
Microsoft has tool that we can use to analyze the memory dump on Microsoft platforms called as windows debugger (dbg_x86_6.11.1.404). You can download it from here.

After downloading the debugger you need to do little bit configuration before analyzing the dump.

Now you need to configure the symbol path for it. Before doing it just do the following

1.      Create a folder named “symbols” without quotes in the root drive.
2.      Open the Windbg and then go to FileàSymbol file path.
3.     Set the path to “SRV*c:\symbols*http://msdl.microsoft.com/download/symbols “without quotes.

Symbol Path:- Symbol files provide a footprint of the functions that are contained in executable files and dynamic-link libraries (DLLs).Additionally, symbol files can present a roadmap of the function calls that lead to the point of failure.

Now the configuration is done, now you need to open the dump file in the debugger.

Now you need to open dump file , To do this goto File-->Open Crash Dump

After you open the Memory.dmp, it will make some calculation and load the symbols as below.

Now you need to write the command "!analyze -v " to get the details

After this command you will get the details about the reason behind the Crash :)

The reason for the crash was fltmgr.sys file.

As you all are System Admins so you must have good google search skills,Now just google it and get the reason for the same.

I have found the reason and the there is some Hotfix from Microsoft for this error.

http://support.microsoft.com/kb/955087

This is How we can Analyze the dump.

Read More

How to enable memory dump on a windows server

It is very often we see the blue screen on the Microsoft based OS.Basically we called this blue screen as 
Blue Screen Of Death (BSOD).

I have asked the question "what is BSOD" from many guys during the interviews but usually they replied
that it happened due to RAM or HDD failure, they simply reply that in this case they will replace either RAM or HDD to fix this issue on the server. 

So today i will give a idea about this BSOD and how to analyze this issue on windows platform.

->What is BSOD ?
->The Blue Screen of Death , displayed by the Microsoft Windows family of operating systems upon encountering a critical error,of a non-recoverable nature, that causes the system to crash.Stop errors are hardware or driver related, causing the computer to stop responding in order to prevent damage to the hardware or data.

->Type of memory dump ?
->There are three type of dumps created

1. Complete Memory Dump
2. Kernal Memory Dump
3. Small Memory Dump

1. Complete Memory Dump:-A Complete Memory Dump is the largest kernel-mode dump file. This file contains all the physical and virtual memory for the machine at the time of the fault.If you select the complete memory dump option, you must have a paging file on the boot volume The Complete Memory Dump file is written to %SystemRoot%\Memory.dmp by default.The Complete memory dump option is not available on computers that are running a 32-bit operating system and that having 2 gigabytes (GB) or more of RAM (by default).

2. Kernal Memory Dump:  A Kernel Memory Dump contains all the memory in use by the kernel at the time of the crash.The dump file will be around one-third the size of the physical memory on the system. This dump will not include unallocated memory or any memory allocated to applications. It only includes memory allocated to Windows kernel.The Kernel Memory Dump file is written to %SystemRoot%\Memory.dmp by (default)

3. Small Memory Dump:- A Small Memory Dump is much smaller than the other two crash dump files. It is exactly 64 KB in size (128KB on 64-bit systems) .This kind of dump file can be useful when space is greatly limited. However, it contains very less information for the reason of the crash.

                              How to enable memory dump on a windows server

Here i am going to configure the memory dump on Win-7/server 2008

1. Right click on my computer and click on properties then click on 2. Advance system setting option on left side ,then click on 3. Advance tab, Now click on 4. setting under Startup and recovery.Below are the screenshot

Same you can configure from the registery as well from the location as mentioned below

HKLM\System\CurrentControlSet\Control\CrashControl
All the things that you can configure via GUI can be configured via registery as well.

• Write an event to the System Log checkbox = LogEvent
• Automatically Restart checkbox = AutoReboot
• Write Debugging Information drop-down = CrashDumpEnabled
• Dump File text box = DumpFile
• Overwrite any existing file checkbox = Overwrite 

                              How to Crash the server manually using keyboard

Now you have configured the memory dump on the server and now you can check as well if it is creating the memory dump file on the server or not.Also when you need to create memory dump file manually after a crash ,do the following to configure the same.

Using PS/2 keyboard :-


1. Start Registry Editor.
2. Locate the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters

3. On the Edit menu, click Add Value, and then add the following registry entry:

Name: CrashOnCtrlScroll
Data Type: REG_DWORD
Value: 1

4. Exit Registry Editor, and then restart the computer.


 Using USB keyboad:

1. Start Registry Editor.
2. Locate the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters

3. Make sure that the following registry entry is enabled:

Name: CrashOnCtrlScroll
Data Type: REG_DWORD
Value: 1

4. Exit Registry Editor.

If You can generate a system memory dump by holding down the right CTRL key and pressing the SCROLL LOCK key twice. (Ctrl+Scroll lock twice)

Note: Pressing left CTRL key does not generate the system memory dump.



Will come with new Blog shortly on How to Analyze the memory dump....... ;)

Read More

Enable or Disable Hibernate

Enable or Disable Hibernate Through Command Prompt
Using the Command Prompt might be the easiest way to enable or disable Hibernation. Click on Start and type CMD into the search box and it will be listed under programs. Right-click on the icon and select Run as administrator.

The Command Prompt opens and you will use the following to enable Hibernation.

powercfg /hibernate on

Type in the following to disable hibernation.

powercfg /hibernate off

Disable Hibernate Through Regedit
Note: Changing registry values can cause your computer to become unstable or stop functioning and is only recommended for experienced users.
Now that the disclaimer is out of the way…you might want to completely disable Hibernate mode through a registry edit. Open the Registry and browse to HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Power and change both HiberFileSizePercent and HibernateEnabled value data to zero. After you’ve made the changes close out of the Registry Editor and restart the machine.

 

Read More

Windows uses 20% of your bandwidth Here's how to Get it back

A nice little tweak for XP. Microsoft reserve 20% of your available bandwidth for their own purposes (suspect for updates and interrogating your machine etc..)

Here's how to get it back:

Click Start-->Run-->type "gpedit.msc" without the "

This opens the  group policy  editor. Then go to:


Local Computer Policy-->Computer Configuration-->Administrative Templates-->Network-->QOS Packet Scheduler-->Limit Reservable Bandwidth


Double click on Limit Reservable bandwidth. It will say it is not configured, but the truth is under the 'Explain' tab :

"By default, the Packet Scheduler limits the system to 20 percent of the bandwidth of a connection, but you can use this setting to override the default."

So the trick is to ENABLE reservable bandwidth, then set it to ZERO.

This will allow the system to reserve nothing, rather than the default 20%.

I have tested on XP Pro, and 2000

Read More

How to turn on automatic logon in Windows XP

Method 1:

You can use Registry Editor to add your log on information. To do this, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate the following registry key:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
3. Using your account name and password, double-click the DefaultUserName entry, type your user name, and then click OK.
4. Double-click the DefaultPassword entry, type your password under the value data box, and then click OK.
   
   If there is no DefaultPassword value, create the value. To do this, follow these steps:
   1. In Registry Editor, click Edit, click New, and then click String Value.
   2. Type DefaultPassword as the value name, and then press ENTER.
   3. Double-click the newly created key, and then type your password in the Value Data box.
   Note: If the DefaultPassword registry entry does not exist, Windows XP automatically changes the value of the AutoAdminLogonregistry key from 1 (true) to 0 (false) to turn off the AutoAdminLogon feature after the computer is restarted.
5. Double-click the AutoAdminLogon entry, type 1 in the Value Data box, and then click OK.
   
   If there is no AutoAdminLogon entry, create the entry. To do this, follow these steps:
   1. In Registry Editor, click Edit, click New, and then click String Value.
   2. Type AutoAdminLogon as the value name, and then press ENTER.
   3. Double-click the newly created key, and then type 1 in the Value Data box.
6. Exit Registry Editor.
7. Click Start, click Restart, and then click OK.

After your computer restarts and Windows XP starts, you can log on automatically.

If you want to bypass the automatic logon to log on as a different user, hold down the SHIFT key after you log off or after Windows XP restarts. Note that this procedure applies only to the first logon. To enforce this setting for future logoffs, the administrator must set the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Value:ForceAutoLogon
Type: REG_SZ
Data: 1

Method 2:

You can also turn on automatic logon without editing the registry in Windows XP Home Edition and in Windows XP Professional on a computer that is not joined to a domain. To do this, follow these steps:

1. Click Start, and then click Run.
2. In the Open box, type control userpasswords2, and then click OK.
   
   Note When users try to display help information in the User Accounts window in Windows XP Home Edition, the help information is not displayed. Additionally, users receive the following error message:
   Cannot find the Drive:\Windows\System32\users.hlp Help file. Check to see that the file exists on your hard disk drive. If it does not exist, you must reinstall it.
3. Clear the "Users must enter a user name and password to use this computer" check box, and then click Apply.
4. In the Automatically Log On window, type the password in the Password box, and then retype the password in the Confirm Password box.
5. Click OK to close the Automatically Log On window, and then click OK to close the User Accounts window.

Read More

Password Protection for Windows Password

With Following steps your windows password would not be cracked with any password cracking tools which are mostly used to crack windows passwords.

So let's start:

Step 1. Goto Start>Run.

Step 2. Type syskey.exe and then click Ok.

Step 3. A dialog box is open then Click on Update.

Step 4. Then enter your password.Then click OK.
Now its done......

Stay Safe

Read More

Share Files and Printers between Windows 7 and XP

If you have a home network and are running Windows 7 and have XP on other PC(s) you might want to share files between them.  Today we will look at the steps to share files and hardware devices like a printer.

Sharing Files In Windows 7 and XP

Sharing folders between two Windows 7 machines with the new HomeGroup feature is an easy process, but the HomeGroup feature is not compatible with Vista or XP.  For this tutorial we are using Windows 7 x64 RC1 and XP Professional SP3 connected through a basic Linksys home wireless router.

First make sure both machines are members of the same Workgroup which by default is named Workgroup.

On the Windows 7 machine go into Control Panel \ All Control Panel Items \ Network and Sharing Center then click on Change advanced sharing settings.

You will want to verify the following settings under Advanced Sharing Settings for the Home or Work and Public profile.

If you want any user to have access the public shares turn off password protection.  This is located in Advanced Sharing Settings toward the bottom of the list.

If you want to keep it enabled make sure there is a log in account for the other XP machines and they have a password.

Now if you go into Network in Windows 7 you should see your XP machine and the Windows 7 as well which in this case is Mysticgeek-PC.

To share the printer on the Windows 7 machine go into Devices and Printers from the Start menu and double click on the printer icon.

Next double click on “Customize your printer”.

In the Properties screen click on the Sharing Tab and check the box to share the printer and type in its share name.

If your XP machine is an x86 OS you can install Additional Drivers before setting up the XP machine.

To find the shared folders and devices double click on the Windows 7 machine icon under Network.  Here you can see the printer connected to my Windows 7 machine is shared and also the Users Folder.

Continue into the Users folder and Public to see the shared folders, here I also created a folder called XP Share just to keep everything in central location.

Over on your XP machine open up My Network Places to find the Windows 7 (mysticgeek-pc) shared folder.

Double click on the Share folder to find a list of shared folders in the Public folder on Windows 7.  If you have password protection enabled you will need to type in the username and password of the user account on the Windows 7 machine first.

Setup XP With Shared Printer

To set up the shared printer in XP you will need to go into Printers and Faxes from the Start menu and kick off the Add Printer Wizard.

Now select “A network printer, or a printer attached to another computer” then hit Next.

Next select “Connect to this printer…” and type in the path for the printer connected to the Windows 7 machine and click next.  

Now click Yes to the confirmation message.

Then click Finish the printer to install and complete the Wizard.

In some cases you will need to install the x86 XP drivers for the shared printer because the Windows 7 drivers are not compatible with XP.  When everything is installed open up Printers and Faxes to find the shared printer.

This should help you get started with sharing your files and other devices with your Windows 7 machine.  When I first started I was able to see the printer on XP right away because I had a HomeGroup set up, but once I deleted it I needed to share the printer like you would for a workgroup.  You might also have to do a couple restarts of the XP machine for it to see the shared resources on Windows 7.  If you have had any experiences with sharing between Windows 7 and XP leave us a comment!

Read More

Windows 7 Tricks

Windows 7 is the most updated and an excellent operating system. But to work well with windows 7, you must know some tricks. I am discussing some of the windows 7 tricks here.

Windows 7 Trick 1:

In general, when you want to create the zipped version of any file or folder, you just right click on that file and use the send option from the drop down list. But in the case of Windows7, you do not able to get options in the ‘send to’ menu. Here you have to use this trick to get the option in ‘send to’ menu, which is hidden in Windows7. To get them, simply press the Shift key on your computer keyboard and hold it. Now, right click on that file or folder; go to ‘send to’ option, you can get those option.

Windows 7 Trick 2:

If you want to open any command prompt from any folder, just press the Shift key on your keyboard and hold it. Then right click on any folders from anywhere in your commuter; then you get an option from the dropdown list “Open command window here”, select this option and you will get a command prompt with that folder as the default path.

Windows 7 Trick 3:

In Windows7, if you want to cascade two or three opened windows in the task bar or tile them and view side by side, you should know this trick. To do this, at first you have to open the task manager. Then simply press the Ctrl key on your keyboard and hold it. Then select the open windows, you will get a pop up list; from that, just choose “cascade/show windows stacked” option from there.

Windows 7 Trick 4:

There are some shortcut keyboard tricks for Windows7:-

• Magnifier:- “Windows” + “+” or “Windows” + “-“

This shortcut key zooms in or zooms out your computer screen and activates ‘Windows Magnifier’.

• “Windows”+ “SHIFT” + “1” through “Windows” + “SHIFT” + “9”

This is used to start new instances of the respective taskbar icons.

• “Windows” + “B”

By this you can focus on the “show hidden icons” on the system tray.

• “Windows” + “1” through “Windows” + “9”

This launches 1st through 9th icon on the taskbar.

• “Windows” + “Ctrl” + “1” through “Windows” + “Ctrl” + “9”

This toggles through the multiple instances of the icons.

• “Windows” + “SHIFT” + “right arrow” or “Windows” + “SHIFT” + “left arrow”

This can be used to move any selected icon, from one monitor to another.

• “Windows” + “P”

This is used to select “presentation display mode”.

• “Ctrl” + “Alt” + “D”

This switches to “docked mode”.

• “Windows” + “T” or “Windows” + “SHIFT” + “T”

This will help you to move focus to front/back on the taskbar.

• “Windows” + “Esc”

The magnifier view can be exit by this.

• “Windows” + “Alt” + “1” through “Windows” + “Alt” + “9”

This is used to open jump list for respective icons.

• “Ctrl” + “Alt” + “L”

This is used to switch to “lens mode”.

• “Ctrl” + “Alt” + “F”

This can be used to switch from ‘Docked’/’lens’ mode back to ‘Full Screen’ mode.

• “Windows” + “G”

This toggles through desktop gadgets.

• “Ctrl” + “Alt” + “I”

You can invert colors by this.

• “Windows” + “X”

This shortcut key is used to launch ‘Windows Mobility Center’ especially useful for laptop.

Windows 7 Trick 5:

If you want to add any folder to the start menu, you can follow this trick. To do this, simply right click on them and select the ‘pin to start menu’ option. Or you can also drag that folder to the location you want.

Windows 7 Trick 6:

In Windows7, if you want to see the Alt-Tab prompt like XP, just press one Alt key on your keyboard and hold it, simultaneously press and release the other Alt key on your keyboard; then press the tab key. By using this trick you can able to see the XP Alt-Tab prompt in your Windows7.

Read More

How to Enable God Mode in Windows 7

Windows 7 is the smarter and faster operating system developed by Microsoft. There are many setting options available in the Control Panel of Windows 7, but sometimes it is difficult to find the perfect setting option. If you have to change a lot of settings in your Windows 7, then it will take a lot of time in Control Panel, so here I am sharing a trick in which you can do all the settings of Windows 7 like you do in the Control Panel directly from a single window. The trick is very easy, you just have to create a folder and that folder will work as Settings pane. People call this trick as Windows 7 God Mode.

The trick begins here:

1. Create a new folder and name it anything.
2. Now, rename the folder by pressing F2 or Right-click>>Rename and give it this new name: Settings.{ED7BA470-8E54-465E-825C-99712043E01C}
3. After renaming the folder, its icon will be changed. Double click the folder to open it.

Now, you will see a screen like below. Here, you can change all the settings of your Windows 7 OS.

Read More

How to Shrink a Partition on Your Hard Drive

If you have your hard drive partitioned and want to change the size of the partitions or the amount of partitions you have on your computer, you can. It is still going to wipe your data but if you backup your files to the main partition just while you are shrinking the other partition then you can move it all back after. 

How to shrink a partition?

In this tutorial I have 3 partitions on my hard drive. The first is C: drive, then D: drive, and finally E: drive. You can see this in the screen shot below. The first thing I am going to do is shrink E: drive. Now we must open the disk management tool in Windows Vista.

I cannot guarantee this will work in Windows Vista Home and Windows XP as this was done using a higher version of Vista.

Yes they could be depending on what version of Windows you are using. Be warned that I strongly suggest you backup any data or files that your partition has on it.

If you leave files on there and decide to shrink the partition some versions will clearly not let you do this, while others will but we all know accidents can happen. Its always better to be safe than sorry.

If I shrink a partition will the files be lost or wiped clean?

If you use partition software then you can basically shrink a partition with the files on it.

How to open disk management to shrink a partition?

1. Go to the start menu.
2. Right click on my computer or computer for Windows Vista.
3. Choose manage from the menu.
4. Choose storage.
5. Then click on  computer management.
6. Choose Disk Management in the left side menu. Then you see all your drives listed in the right side.

When you open disk management you will see the partitions I have on my computer. Now to continue to shrink drive E:

1. Right click on Drive E: as shown in the screenshot below.
2. Choose Shrink Volume from the menu.

• Now a box will appear. It will automatically choose the size to shrink the partition by.
• change the size of the shrink by changing the amount in the box that is highlighted blue.
• When you are happy with your size press Shrink.

Now see the screenshot below. My E: partition was 116mb and now it is 58.27mb. The data and files that was on there is gone. And now I have 58.17gb of free space. To use this free space we need to right click on that area and choose to create a new volume. We can also extend E: back out to 116mb by using the free space.

Shrink a Partition in Windows Seven

In Windows Seven you can decrease the size of the main partition without removing files first. You are restricted by the position files. It is probably a good idea to defrag your files to place them in an organized state, ready for the partition shrink. You can shrink the existing partition from the end of the volume to create new unallocated space. Then you can label the drive and start loading it up with files.

Easily Resize, Copy, Move hard disk partitions without losing data!

Notes on shrinking a partition

• You can experiment with any of your partitions but not C: drive. (except Windows seven)
• You cannot shrink C: drive unless you use another program likePartition Magic
• You can shrink any other partitions but you will still loose the files on it.

Read More

Tabbed Remote Desktop / VNC Client for Windows

Anybody that works in a multiple server environment knows that it can be annoying to have half a dozen remote desktop windows open at any given point. Thankfully there’s a slick application called Terminals that gives you tabbed remote desktop capabilities.

Not only can you do Remote Desktop, but you can use VNC or even Citrix if you choose, and all within the same tabbed window.

When you first install the application you’ll be prompted for a master password, which is probably a good idea:

You can create a new stored connection of any supported type:

I’m connected to my Kubuntu Linux server box here in this tab…

And also connected to an ancient server at work…

One of the rather cool features is that you can have the terminals window minimize to the system tray.

There’s dozens of other features in this application, including the ability to upload screenshots directly to flickr.

It’s definitely worth a look, although I did have a few problems with it crashing on me. Since it’s in active development, I assume these issues will be worked out over time.

Download Terminals from codeplex.com

Read More