Information collected by Internet Explorer Data Collector

This article describes the information that may be collected from a computer when running Internet Explorer Diagnostics for Windows Client and Server as well as a description of the Interactive troubleshooting tasks performed.

When first launching the Internet Explorer Data collector, the user will select either the Internet Explorer Data Collector option or the Internet Explorer Troubleshooting Tasks option.

Original product version:   Internet Explorer 9
Original KB number:   2547207

Collected information when the Internet Explorer Data Collector option is selected

When selecting the Internet Explorer Data Collector option, the following information is collected:

Operating System

• Machine Name
• OS Name
• Last Reboot/Uptime
• AntiMalware
• User Account Control
• Username

Computer System

• Computer Model
• Processor(s)
• Machine Domain
• Role

Environment Variables

Event Logs

Group Policy and IEAK

Hardware:DXDiag

IEDiag

Internet Explorer Setup Log

Installed updates/hotfixes

Internet Explorer Core

Internet Explorer File Versions

Internet Explorer Zones

Networking Information

Operating System Registry

REG Export

Registry - IEAK

Windows Setup API Logs

Windows update log

Available tasks and collected information when the Internet Explorer Troubleshooting Tasks option is selected

When the user selects the Internet Explorer Troubleshooting Tasks option, the following tasks are available:

Strace

This task will install STRACE to collect the HTTP HTTPS traffic between this client and a webserver. You will be prompted to uninstall STRACE upon completion of the task.

During this collection, the Temporary Internet Files Cache will be cleared to ensure the collection contains all request between the webserver and this client.

STRACE is a socket/SSL tracer that is based on the 'detours' utility. The tool has been designed to generate LOG for Internet Explorer but it can be used with many other applications.

Using STRACE with Internet Explorer is equivalent to use a (non-full) debug build of WININET.DLL to generate a WININET LOG. The STRACE LOG contains clear text HTTP traffic (with socket information) and encrypted or decrypted SSL data.

From the STRACE LOG, you can 'replay' a full navigation scenario using the HTTPREPLAY tool. This can be useful to reproduce a problem or browse web sites offline.

Data collected

Strace network logs

ProcDump a process

This task will allow you to collect process dump of Internet Explorer or any other process.

• If you select the hang option, ProcDump will collect dumps of the process you select.

• If you select the crash option, Procdump will monitor the process you select for an expected crash.

• If you select the highcpu option, Procdump will monitor the process you select and once the CPU utilization exceeds 30% for more than 10 seconds a process dump will be collected. Procdump will continue to monitor the process and collect two additional process dumps for a total of three dumps each 10 seconds apart.

  Note

  The process must exceed the 30% threshold for 10 seconds otherwise the dump will not be collected. See ProcDump v9.0 for details on Procdump.

Data collected

Memory Dump Files

Internet Explorer WPAD

• Prompt to choose the affected user

• Prompt for user credentials

• Clear Temporary Internet Files on Internet Explorer 7 and newer, delete .pac/.dat files on Internet Explorer 6

• Start network trace (NetSh for Win7/2k8r2, NMCap for Vista/2k8, NetCap for XP 2k3)

  Note

  It will prompt and open browser to NM3.4 download on Vista/2k8 if not already installed.

• Prompt that includes information on the deletion of the contents of Internet Explorer Connections registry keys

• Save connections keys to user's desktop.

• Delete Connections key contents under HKCU, HKLM and under the Wow6432Nodes keys for HKCU and HKLM if they exist.

• Release and renew IP address

• Launch Internet Explorer as selected user

• Stop and collect network traces. For more information on what is collected by the Internet Explorer WPAD task, see the Internet Explorer WPAD SDP KB2668985.

Internet Explorer Simultaneous Fiddler and Netmon

The Internet Explorer Simultaneous Fiddler and Netmon data collection will perform the following items.

User dialog prompt to choose data collection options including:

• Initial address for Internet Explorer to access upon launch

• Select affected user

• Run Internet Explorer as selected user

• Collect Network Monitor trace

• Collect Fiddler trace

• Clear Temporary Internet Files

• Set TabProcGrowth to 0 for testing

• Reset Connection settings:

  • Prompt that includes information on the deletion of the contents of Internet Explorer Connections registry keys.

  • Save connections keys to user's desktop.

  • Delete Connections key contents under HKCU, HKLM and under the Wow6432Nodes keys for HKCU and HKLM if they exist.

• Release and renew the IP address

• Launch Internet Explorer without extensions (-extoff)

Upon acceptance of the dialog, Internet Explorer will launch to the specified address.

At this time reproduce the issue and upon closing Internet Explorer tracing will stop, TabProcGrowth, and proxy settings will be restored. The Fiddler trace, Network Monitor trace, and any log files associated with the tracing will be collected.

Data collected

Autoproxy Files

Fiddler Capture

Network Trace

Generate an AXIS log (Windows Vista+)

This task will allow you to collect an installation log during attempts to install an ActiveX control via the ActiveX Installer Service.

See Implementing and Administering the ActiveX Installer Service for details on the ActiveX Installer Service.

Data collected

AxtiveX Installer Service Logging