Windows XP Boot Log

[secman]

We are looking at what loads and runs during a normal boot process and logon on our curriculum PCs. Does anyone know how we can see exactly what loads and runs? There used to be a Boot.ini file in earlier versions of Windies that showed this info.

We are happy to run a utility if there is nothing inbuilt.

We have XP Pro SP2 on the dessktop and run WinSuite 2000 at the moment.

Any ideas would be appreciated.

[ChrisH]

There is a program for this to help speed up windows loading and see what is happening I think it's called bootvis or something.

[Geoff]

If I recall, you can press F8 before the Windows XP loading screen appears on bootup. One of the options allows you to boot normally with logging. A text file will be produced on the root of the C drive called Bootlog.txt I think.

[kingswood]

Geoff is right- you can enable safe mode bootlogging which will (of course) put everything into a juicy file on your drive. It's called ntbtlog.txt file and found in %systemroot% folder.

 

Paul

[ChrisH]

I seem to have replied to the duplicate post!!!!! There is a tool called bootvis that will show you this as well it's MS own.

 

[ sorted :D - tarquel ]

[Dos_Box]

Not exactly a logger, but Startup Cpl is a nice free app to prevent programs etc from starting when you don't want them to. It's a bit like MSCONFIG on steroids.

 

http://www.mlin.net/StartupCPL.shtml

[tarquel]

[identical topics merged - please be careful not to double post or start two topics of the same thing - cheers ]

[secman]

Thanks to one and all.

 

The Bootvis app produces a wonderful array of graphs and F* - Boot logging does what if says on the tin ... log the boot process. We would laso like to see what loads etc during the logon process. We are seeing some wildly different logon times on identical PCs (Same machine same build, same user!) Haven't had a look at the MSConfig like app yet.

So if anyone has any more ideas.?

 

Thanks

[Geoff]

The GPMC will give you an overview of what Group Policies are supposed to be applied (via GP modelling on 2k3 only). It'll also tell you whats really happening (via GP Results).

 

Other things to try are to run netdiag on the client PC and also check the basic network settings. DNS server settings, default gateway and netmask are obvious ones. Finally, check the machines system time is correct.

[secman]

The GPMC will give you an overview of what Group Policies are supposed to be applied (via GP modelling on 2k3 only). It'll also tell you whats really happening (via GP Results).

 

Other things to try are to run netdiag on the client PC and also check the basic network settings. DNS server settings, default gateway and netmask are obvious ones. Finally, check the machines system time is correct.

 

Geoff,

 

We are not using Group Policies or 2K3 at the moment. Anything similar we can try?

 

Thanks

[eejit]

Try BootlogXP it will give you a graphical breakdown on how long every file and service took to get running during the bootup process.

[tarquel]

We are seeing some wildly different logon times on identical PCs (Same machine same build, same user!)

 

Silly suggestions but what about defragmentation differences causing different access times?

 

Another one is the HDD's are the same make/model/revision correct? could be access times of the hdd that fluctuate, but i wouldnt have thought that it would have made substancial differences anyhow lol

 

Just a few wild thoughts

 

N.

[DMcCoy]

We are seeing some wildly different logon times on identical PCs (Same machine same build, same user!)

 

Silly suggestions but what about defragmentation differences causing different access times?

 

Another one is the HDD's are the same make/model/revision correct? could be access times of the hdd that fluctuate, but i wouldnt have thought that it would have made substancial differences anyhow lol

 

Just a few wild thoughts

 

N.

 

 

Just in case anyone is interested in defragmenting Raxco

 

Did you know that defragmenting doesn't actually affect the physical location of files on the disk? Just the logical placement in the filing system. I know I didn't until a few years ago

 

Back to the topic. Are the machines on different switches/hubs?

[secman]

Thanks for the suggestions one and all.

I think it is necessary to explain a bit more about our setup.

 

We have 350 PCs most in 6 computer suites. 3 with 32 PCs and 3 with 22.

Each room is equipped with the same type pf PCs. We have Dell SX270s in 2 rooms, GX240s in 2 rooms and GX280s in 2 rooms. No PC is more than 3 years old.

Each room is served by room switches providing 100Mb links to the desktop. These are uplinked to main switches at 100Mb that are in turn uplinked via 1Gb fibre links to a central switch. The main logon server is connected directly to the central hub at 1Gb.

 

Logon time differences are not confined to a single room or to a set of PCs. We can see the same PC having problems with one user and not another.

 

We are planning to look at the desktop setup in great detail in the next few months and would appreciate any suggestions

 

Thanks again

[DMcCoy]

Thanks for the suggestions one and all.

I think it is necessary to explain a bit more about our setup.

 

We have 350 PCs most in 6 computer suites. 3 with 32 PCs and 3 with 22.

Each room is equipped with the same type pf PCs. We have Dell SX270s in 2 rooms, GX240s in 2 rooms and GX280s in 2 rooms. No PC is more than 3 years old.

Each room is served by room switches providing 100Mb links to the desktop. These are uplinked to main switches at 100Mb that are in turn uplinked via 1Gb fibre links to a central switch. The main logon server is connected directly to the central hub at 1Gb.

 

Logon time differences are not confined to a single room or to a set of PCs. We can see the same PC having problems with one user and not another.

 

We are planning to look at the desktop setup in great detail in the next few months and would appreciate any suggestions

 

Thanks again

 

Is dns setup correctly (that the first one everyone mentions). Is it 2003/2000 with XP clients? Look at the event logs for gpo and userenv errors. Are dcdiag and netdiag ok?

[Dos_Box]

As has been suggested above, it will most likely be a DNS problem. Below are some DNS pointers and tips to look for. Some will be obvious and some not.

 

1. Your DNS server should look at themselves for DNS i.e in their TCP\IP properties their own IP address should be listed in the DNS servers section. This goes for all DNS servers on your LAN. Alll domain controllers on a Windows 2000 - 2003 active directory network should have DNS running.

 

2. Forwarders. In the forwarders section of your servers DNS admin tool you should list your LEA's or ISP's external DNS servers. Do not list the other DNS servers on your network here.

 

3. Name servers. Ensure all of your domain controllers are listed here. If not add them manually.

 

4. Replication. Ensure that the replication options are set to replicate. As a failsafe measure allow your server to replicate to any other server requesting it.

 

5. DHCP settings. Ensure that you local DNS servers are set in your DHCP options. NOT your LEA's \ ISP's DNS servers.

 

6. Carry out the above steps on all of your domain controllers\DNS servers. I almost gurantee it will be one of the above things that is wrong.

[secman]

We are XP Pro SP2 clients with W2K Servers. All PCs are set up from GHOST images so all get the same settings.

 

Dos_Box, I will work through your suggestions on DNS.

 

Thanks again all for the help and suggestions.

[DMcCoy]

We are XP Pro SP2 clients with W2K Servers. All PCs are set up from GHOST images so all get the same settings.

 

Dos_Box, I will work through your suggestions on DNS.

 

Thanks again all for the help and suggestions.

 

Does the ghost image run sysprep afterwards or a sid changer? Just a thought.

[E1uSiV3]

Do you run Sophos?

[secman]

Yes we do run SOPHOS, provided via the LEA/LGFL currently on v3.99 we have not yet upgraded to v5

 

The Ghost process does not currently use sysprep. We reconfigure manually after build. We just haven't had the time to sort the sysprep side out.

 

Thanks again all

[Dos_Box]

Ah. So all of your PC's have the same SID then? That would not be a clever thing. No sysprep or any other kind of system setup runs automatically after re-imaging?

[MkII]

You can use newsid from sysinternals for a quick fix to apply unique sids to all your machines...

[secman]

After imaging the PCs are not domain members so have to have a unique name allocated, be joined to the domain and given a unique IP. Shouldn't this give them each a unique SID?

 

Thanks again all.

[MkII]

No - the SID is independant of those secman.

 

"]The SID Duplication Problem

 

The problem with cloning is that it is only supported by Microsoft in a very limited sense. Microsoft has stated that cloning systems is only supported if it is done before the GUI portion of Windows Setup has been reached. When the install reaches this point the computer is assigned a name and a unique computer SID. If a system is cloned after this step the cloned machines will all have identical computer SIDs. Note that just changing the computer name or adding the computer to a different domain does not change the computer SID. Changing the name or domain only changes the domain SID if the computer was previously associated with a domain.

 

To see if you have a duplicate SID issue on your network, use PsGetSid to display machine SIDs.

[ChrisH]

ooooo all those identical SIDs the mind boggles

 

You can use newsid from sysinternals for a quick fix to apply unique sids to all your machines...

 

I have used this a lot and have found it to be a great tool.