Do you find the Support WebCast transcripts helpful?
Let us know!

Note This document is based on the original spoken WebCast transcript. It has been edited for clarity.

William Keener: Welcome to this WebCast, "Microsoft® Windows XP®: Troubleshooting Startup and Shutdown Problems." My name is William Keener and I'm a content developer for Windows XP and Microsoft Product Support Services. In this presentation we will explore some strategies and techniques to assist you in troubleshooting startup and shutdown issues in Windows XP.

Startup and shutdown issues can manifest themselves in a number of different ways (slide 2). For example, you may receive a STOP error on a blue screen, or other error messages; your computer may restart automatically instead of shutting down; or your computer may "hang" or stop responding at startup and shutdown.

The first step in troubleshooting these types of problems is to clearly identify and document the symptoms. Under what conditions does the problem occur? Which aspects of the operating system control these conditions? What applications or subsystems does the problem seem related to?

You should also review your system's history to determine what configuration changes have occurred since the computer last worked correctly. For example, did you install new hardware or software? Did you verify that the hardware or software was fully compatible with Windows XP? If possible, you may want to temporarily remove any hardware or software that is not needed for starting Windows XP to see if the problem is resolved, or if the symptoms change.

In general, you should make only one change to your system at a time, re-test the problem, and document any change in the system or steps to reproduce the problem. Did you recently add a new user account to the system? When was the last virus check performed? Do you have the latest critical updates and service pack installed?

You can review Add/Remove Programs in Control Panel and the services management console or the System Information utility to generate a list of installed applications and running services. You may also need to check to see if you have the latest BIOS or firmware revisions for your motherboard and peripheral devices.

The System Information utility can assist you in collecting information about your system configuration. To run the System Information utility, click Start, click Run, type msinfo32, and press ENTER. You can save reports from the System Information utility during the course of your troubleshooting to help you determine which configurations reproduce the symptoms. This can help you to identify the cause of the problem.

There are a number of possible causes for startup and shutdown issues (slide 3): installing incompatible software, incorrectly changing system configuration settings, or installing faulty device drivers can cause problems, as can incompatible hardware. Hardware problems can include defective, malfunctioning, or incorrectly installed or configured devices. Additionally, missing or corrupt Windows XP files can also result in an inability to start up or shut down.

Although the immediate goal of your troubleshooting is to restore your computer to a working state as quickly as possible, you should also try to determine the root cause of the problem. Locating the root cause or source of a problem can help you to prevent it from reoccurring in the future.

As I've already stated, the first thing you want to do is identify and analyze the problem (slide 4). Is there an error message? If so, write it down or save it to a file. For example, if the error is displayed in a dialog box within Windows XP, you can press the ALT+PRINT SCREEN keys at the same time to capture the error dialog to your clipboard. Then you can paste the image into an application like Paint and save it for future reference.

You should also check the Event Viewer and other logs for any information that might be related to the problem, even if no error message is displayed on the screen when the problem occurs. If you press the F8 key on your keyboard during startup there is an Enable Boot Logging option on the Windows Advanced Options menu. This option creates a file called Ntdtlog.txt in your Windows folder. This file lists each driver that Windows XP attempts to load and whether it loads successfully. This log can be useful in troubleshooting startup problems.

Also make a note of when the problem began and what steps cause it to occur. Check the Microsoft Knowledge Base or Help and Support for any information on the specific error message or symptoms. If it is a known issue, a fix or workaround may be available; if not, you will need to further isolate and test the problem.

When and how does your computer fail? (Slide 5) This can give you clues about the root cause of the issue. For example, if the problem only occurs when a particular user logs on or logs off, then the issue is most likely related to their user account or profile. If the problem also occurs in safe mode, then it could be related to corrupt or missing operating system files, or a hardware problem.

Carefully documenting under what conditions the issue occurs will assist you in identifying the root cause and resolving the problem (slide 6). For example, if your computer starts in safe mode but not in normal mode, then a driver, service, or startup application is the most likely cause. In this case, you can use the System Configuration Utility to further isolate the problematic driver, service, or application.

We'll talk about safe mode, the System Configuration Utility, and some other troubleshooting tools in more detail in a moment. The point here is that you may need to use a number of different tools to isolate the problem. And you may need to test the failure in a number of different configurations to identify the root cause.

During the course of your troubleshooting, be sure to document any changes you make to your system configuration and the results, and then troubleshoot only one problem at a time.

Now let's look at some specific tools that you can use to troubleshoot startup and shutdown issues in Windows XP. The last known good configuration (slide 7) restores your system to the last configuration in which you were able to start Windows XP successfully and log on.

This is particularly useful in cases where the root cause is known and the failure occurs before you log on. For example, if you change your configuration or add a driver to your system and it fails to restart properly so that the problem occurs before you log on, try last known good. To use last known good, press F8 when your computer is starting up, and then select Last Known Good Configuration from the Windows Advanced Options menu. Note that after you log on successfully, last known good is overwritten. Therefore if the problem occurs after you log on, last known good is not really going to help.

A clean boot (slide 8) is useful in helping to isolate the problem to a driver, service, or startup application. If you can start Windows XP in either normal or safe mode, try a clean boot using the System Configuration Utility. To start the System Configuration Utility, click Start, click Run, and then type msconfig and press ENTER. First use the selective startup option with System.ini, Win.ini, Startup items, and with all non-Microsoft services disabled.

To disable all non-Microsoft services, click to select the Hide All Microsoft Services check box on the Services tab, and then click the Disable All button. If this works, then you can re-enable the items that you disabled, one-by-one, and see which one causes the problem to occur. For example, if the problem returns when you re-enable services or startup items, then you can use the System Configuration Utility to further isolate the issue by re-enabling services or startup items one-by-one, and testing to see if the problem returns.

Note that if you clear the Load System Services option on the General tab of the System Configuration Utility, or if you disable all Microsoft services on the Services tab, then all of the restore points for the System Restore utility are deleted. Do not do this if you plan to use the System Restore utility. We'll discuss System Restore a bit later.

If you can't start Windows XP in normal mode, try safe mode (slide 9). To start your computer in safe mode, press F8 during startup, and select Safe Mode on the Windows Advanced Options menu. Safe mode loads only a minimal set of drivers and disables startup applications and services that are not required to start Windows XP. If safe mode works, you can then use the System Configuration Utility in safe mode, as I just discussed, to further isolate the problematic driver, service, or application. If safe mode doesn't work, then you may need to use the Recovery Console or try a repair or in-place upgrade to troubleshoot the problem. We'll discuss these options in a moment.

In addition to using the System Configuration Utility or Msconfig to disable nonessential services, you can also use the Computer Management console in either safe mode or normal mode (slide 10). To open the Computer Management console, right-click My Computer and then click Manage. Under Services and Applications, click Services. Each service is listed with a brief description, a status, the startup type, and whether it's logged on with a Local System account, a user account, or a network account. You can right-click a service and stop or start it.

If you can't start Windows XP in normal mode or safe mode, you can also use the Recovery Console to disable services. The Recovery Console is a command-line environment that provides access to your Windows installation when you can't start Windows in safe mode or normal mode. To run the Recovery Console, boot your computer from the Windows XP CD-ROM. To start your computer from the Windows XP CD-ROM, it must be configured to support booting from CD, and the system setup or CMOS must be configured so that the computer attempts to boot from the CD-ROM drive. Check the documentation included with your computer or contact your computer manufacturer for information on doing this.

When you start your computer with the Windows XP CD-ROM in your CD-ROM drive, you are usually prompted to press a key to boot from the CD. When the "Welcome to Setup" screen appears, press R to start the Recovery Console.

You can also install the Recovery Console so that it appears in the boot menu. To do this, run Winnt32 from the i386 folder on the Windows XP CD-ROM using the /cmdcons switch. After you are in Recovery Console, type help for a list of available commands. To disable a service, type disable service_name. You can type listsvc to display a list of all available services and drivers. Typing exit quits the Recovery Console and restarts your computer. A description of the Recovery Console and all available commands is available in Knowledge Base article number Q314058.

System Restore (slide 11) is a tool to consider if your computer was working properly at some point in the past. System Restore takes a snapshot of critical system files and some program files and stores this information as restore points. You can use these restore points to return Windows XP to a previous state. System Restore automatically creates restore points for you at regular intervals, and you can also create restore points manually when your system is configured the way you want and running properly. Note that System Restore is not a replacement for backups.

To start the System Restore tool, click Help and Support on the Start menu and then click Undo changes to your computer with System Restore. You can run System Restore in both safe mode and normal mode, but you cannot create restore points in safe mode.

If you can't start Windows XP in either normal mode or safe mode, you can start System Restore from the Safe Mode with Command Prompt boot option by running Rstrui.exe from your Windows\System32\Restore folder. To start the safe mode with command prompt, press F8 when your computer starts up, and then select Safe Mode with Command Prompt from the Windows Advanced Options menu.

As I noted previously, a repair or re-install, also called an in-place upgrade (slide 12), is another technique that can be used if your computer does not start in safe mode or normal mode. This may be required if you suspect corrupt or missing operating system files. Note that a repair or re-install also deletes all of the restore points created with System Restore, so you may want to try System Restore from a safe mode with command prompt boot before performing a repair or in-place upgrade.

There are two ways to perform an in-place upgrade or repair. If you can start Windows XP in normal mode, simply insert the Windows XP CD-ROM into your CD-ROM drive, and on the Welcome to Microsoft Windows XP page that appears, click Install Windows XP with the option to Upgrade (Recommended) in the Installation Type box. If you cannot start Windows XP in normal mode, then you can run a repair by booting from the Windows XP CD-ROM. This runs setup again, and you first have the option to repair Windows XP using the Recovery Console, as we just discussed.

If you select the option to install Windows XP instead of to repair using Recovery Console, the next screen allows you to do a repair install. Note that you cannot perform a repair or in-place upgrade by booting with a Windows 98 boot disk and running Winnt.exe in real mode. This performs a clean install and will therefore delete all user profile data, such as My Documents, desktop items, and Internet Explorer Favorites, for all users on the machine.

Another tool you can use to check and repair file system damage or disk corruption that could prevent you from starting or shutting down Windows XP is Chkdsk. You can run Chkdsk from a command prompt within normal mode, safe mode, safe mode with command prompt, or from the Recovery Console. Use the /f switch to fix errors on the disk and include the /r switch to locate and mark bad sectors on the disk. Note that if you run Chkdsk on your Windows drive from within Windows XP, you will need to restart your computer to let it perform its checks and repairs.

Device driver issues can also cause startup and shutdown problems (slide 13). For the purposes of this discussion drivers can be treated as services, and we've already talked about disabling services. If disabling a driver in this manner resolves your problem, you may need to further troubleshoot the particular device or driver that is causing the problem. This is a separate topic in itself, and really beyond the scope of this presentation. But this slide lists some resources to assist you in troubleshooting device driver issues. [See Q310126, "Troubleshooting Device Conflicts with Device Manager" and Q314464, "How to Troubleshoot Unknown Devices Listed in Device Manager".]

If you recently installed an updated driver that caused the startup or shutdown problem, the Roll Back Driver feature in Device Manager can be used to replace the driver with the previously installed version. This, of course, is provided you can start Windows XP in normal or in safe modes. To use the driver rollback feature, simply double-click the device in Device Manager and then click the Roll Back Driver button on the Driver tab.

The Recovery Console also provides some command-line tools to repair boot configuration and corruption issues (slide 14) that prevent you from starting Windows XP in either normal mode or safe mode. If you receive an error message indicating a missing operating system, missing NTLDR, or missing NTOSKRNL file, you may need to use Recovery Console commands to repair the boot files or boot structures on the disk. For assistance, search the Microsoft Knowledge Base for the specific error you are receiving. You may also want to consult a support specialist for assistance with these issues.

For example, the bootcfg command can be used to repair or modify the Boot.ini file. The Boot.ini file provides the boot menu and tells the operating system where to find the Windows XP files. The bootcfg command can be used to scan your hard disks for any Windows NT®, Windows 2000, or Windows XP installations, and then add them to an existing Boot.ini or rebuild a new Boot.ini file if one does not exist. See Knowledge Base article Q291980 for additional information on the bootcfg command and its various uses.

If your computer hangs at an empty, black screen immediately after the power-on self test, or POST, and before the Windows logo appears on the screen, you may have a corrupt master boot record, partition table, boot sector, or boot files. You can verify that this as the problem by creating a Windows XP boot disk, as discussed in Knowledge Base article Q305595.

If the boot disk allows you to start Windows XP in normal mode, you can use the fixboot command in Recovery Console to repair the Windows XP boot sector code on the system partition, and you can use the fixmbr command to repair the master boot record. This procedure is discussed in Knowledge Base article number Q314503.

Another example of where you may need to use the fixboot command is when the MS-DOS® or Windows 98 sys command has been used to overwrite the Windows XP boot sector code. In this case your computer may boot to Windows 98 or to a command prompt with no option to start Windows XP. The fixboot command can be used to restore the Windows XP boot sector code so that you can start Windows XP again.

Another possible symptom is your computer automatically restarts at shutdown (slide 15). This may be the result of a STOP error. By default, Windows XP is configured to automatically restart during a fatal error or a STOP error. In this case you should use the system log in Event Viewer to obtain details on the error and then troubleshoot the specific STOP error you're receiving by searching for information on it in the Microsoft Knowledge Base.

Windows XP also provides the ability to send error reports to Microsoft over the Internet. This functionality is enabled by default. When a STOP error occurs, you are prompted to report the problem to Microsoft after you restart your computer. If you choose to report the error, technical information about the problem is sent to Microsoft over the Internet, so you must be connected to the Internet to use this feature. If a similar problem has been reported by other users, and information about the problem is available, you receive a link to a Web page that contains information about the problem, including a fix, if available, which could involve installing a patch or upgrading a third-party driver or application.

Note that the information you report to Microsoft in this manner does not intentionally contain any personally identifiable information. As a result, if you contact a Microsoft support professional about the problem, they may ask you to upload error details to them again in the form of Event Viewer log files or a memory dump.

One last thing I'd like to mention, if you receive an End Task dialog every time you shut down your computer (slide 16), it may be a result of an application or service that is taking a long time to clean up after itself. Note that you can also press CTRL+SHIFT+ESC [Editor's note: Key sequence corrected per discussion in Q&A] to open the Task Manager and manually end tasks on an unresponsive application that is preventing Windows XP from shutting down properly.

In this case you would want to use a clean boot to determine which application is causing the problem, and then check with the manufacturer to see if an update is available. As a last resort, you can increase the WaitToKillAppTimeout value in the registry, as discussed in the Knowledge Base article referenced on this slide (Q305788).

Finally, here are some additional resources (slide 17) for you to use in troubleshooting startup and shutdown issues in Windows XP (Q308041, Q308029), and this will conclude our presentation. Before I turn it over to Otto for the question-and-answer session, I'd like to introduce Jonas Svensson and Charles Erwin. Jonas and Charles are Technical Leads with our Windows XP Support Team. Thanks for joining us, guys.

Charles Erwin: My pleasure.

Jonas Svensson: Thank you.

William: Now we'll try to answer any questions you might have on the topics I've discussed today. With that, I'll hand it over to Otto.

Otto Cate: Excellent. Thank you very much for the presentation. Just a reminder, the Q&A portion of the Support WebCast is intended to encourage further discussion of the topic today. One-on-one product support issues that require some more complex technical assistance are outside the scope of what we're able to address. So if you do need some technical assistance of that nature, please submit an incident on the Web or contact Product Support Services directly by phone.

Okay, the first question: I'm experiencing intermittent hangs when I'm using Fast User Switching and logging off from any user ID. What could cause that problem?

Jonas: Fast-user switching is a new feature in Windows XP, and it's based on the Terminal Services core. As such, some third-party applications have a difficult time handling the switch from one user to another. That could definitely lead to hangs on shutdown. The best way to help isolate this issue is, again, to use the Msconfig utility, limiting your startup options, and limiting your services that run at boot to only those that are necessary for use of the computer. To sum up this answer here, the Fast User Switching is based on Windows NT Terminal Services, it's a new feature in Windows XP, and as such, some third-party programs have not been fully configured to take advantage of the new features and do cause some incompatibilities.

Otto: Okay excellent, thank you. Next question: I've had a lot of issues where upon startup Windows XP was very slow, even though the system was well equipped. Is the solution to disable SSDP services?

Jonas: The SSDP, or Simple Service Discovery Protocol, is a portion of the Universal Plug and Play subset with Windows XP. The symptom that you're experiencing is basically the SSDP service crawling the local area networks to see if there are any UPnP devices available. Now it may not be the root cause of the issue, but again, using Msconfig, starting up in safe mode, and disabling other applications — non-required services, and non-Microsoft services — is the first way to go to see if this issue can be isolated down to that service. So again, this SSDP is a Simple Services Discovery Protocol, and it's a subset of the Universal Plug and Play functionality of Windows XP. It certainly may be a portion of the issue, but without further isolation, using Msconfig, the safe mode boot options, you couldn't really narrow it down off the top to just the SSDP.

Otto: Okay, excellent. Next question here: Is there a list of utility programs and file names mentioned during the presentation?

William: Some of the utilities are mentioned on the slides, and I apologize that not all of them are listed. I'll and have the transcript updated with hyperlinks to Knowledge Base articles on those particular commands. [Editor's note: The transcript has been updated with the relevant links.]

Jonas: I'd like to add that the Help and Support Center is also a good place to go to get different support tools. While you were answering that question, I brought up Help and Support. At the top of the page, click the Support icon, and you will get a listing of several different utilities, including the System Configuration Utility, to help you take a look at the configuration of my machine. Also, the System Information utility, Msinfo32, has a menu item at the top called Tools, and it has some of the tools that were mentioned, including System Restore.

Otto: Great info. Thank you very much.

Okay, moving on to the next question, this one might be a little general: I have a basically home-built system, with an Asus P2B-L motherboard, in which I'm experiencing shutdown problems, and it will reboot when I want to shut down. Is that possibly a BIOS issue?

William: Probably not. I guess it could be, but I discussed this on slide 15, and Windows XP is configured to automatically restart your computer if a STOP error occurs, or a fatal error. So if a STOP error is occurring at shutdown, the symptom that you would experience would basically be the machine would restart instead of shutting down. In that case, you want to look at the Event Viewer and see if there is any information in the system log to indicate that there's a STOP error or some other kind of error occurring at shutdown. Then, of course, you would troubleshoot the problem according to the specific STOP error that you're experiencing.

Charles: I'd also like to add to that. I'm familiar with that particular Asus board and chipset. That's an old standard of theirs that they've had out for a long time, and I will tell you that, like most motherboards, they've put out any number of BIOS updates for it over the years. It's always good, whenever you're upgrading to a new operating system, to run over to the different Web sites, that one is just http://www.asus.com/. [Note: This Web site resolves external to the Microsoft domain, and Microsoft is not responsible for its content.] Look up the motherboard and see what BIOS updates are available and what they say about the products for different operating systems. You always want to be more educated when you upgrade your operating system.

Otto: Excellent, thank you. Concerning last known good configuration, it was indicated that it's only useful if the problem occurs before logon, but I have a single-user home environment, and I never actually get a logon prompt. How could I tell if last known good condition there would be useful?

William: I suppose the easy answer is if you get to your desktop, then last known good is not going to be useful. So if there's some sort of problem that prevents you from getting to your normal desktop, then last known good may be a viable option to try. If you get to your desktop, you are essentially logged in at that point, and last known good has been overwritten.

Charles: I wanted to address the logon question real quick. This is often something that customers will ask us. When it's booting up and it's getting to the desktop, it really is logging you in, but it's logging you in without a prompt. Most people don't want to have that extra keystroke in there, and they just want to get right up and into business. So you are actually logging on there. And, as William said, when you log on, last known good really isn't an option at that point.

Otto: Okay. My laptop keeps shutting down right in the middle of working on a document. I've changed the settings in the setup to "never" in the shutdown options — I'm not sure if they're talking about power management there, it's not very clear — but it keeps losing those settings. Is this something that you guys have seen before, or do you have some general suggestions?

Jonas: I'll take a stab at that one. With laptops it can be quite difficult to track down power management issues. It sounds like, from your question there, that you checked the power management issues or settings that were in Control Panel. However, with laptops you're sometimes dealing with an external power source and sometimes with battery power. If it is the case, where it's shutting down without any warning, that leads me to believe that it may be something physical — the power supply or the battery.

However, because laptops run in different power states, they may have an internal BIOS-level power management utility. So without really diving deep into this issue, I would definitely check to make sure that the BIOS is the latest version from the manufacturer and that the shutdown symptom reproduces both on battery power and on AC power. And I would also take a look and see if ACPI is enabled on the machine.

Again, with a laptop, there are a lot of different power options, much more so than a desktop PC, so there would be a few more steps involved in tracking that down. It can certainly be a device or an application doing that as well.

Otto: Great, thank you. In Windows XP Home Edition, where is the Recovery Console administrator's password setting changed? Or is that an option for Windows XP Home Edition?

William: The administrator password for Recovery Console is the administrator password for Windows XP. So in Windows XP Home Edition, you would need to boot into safe mode, log in as administrator, and change the administrator password in safe mode.

Otto: Okay. Could you possibly give us that KB article number that covers the system Recovery Console commands?

William: The Knowledge Base article for the Recovery Console commands is Q314058.

Charles: I want to recommend the Windows XP Help and Support Center. We've spent a lot of time on making it very robust. If you pull it up and search for Recovery Console, you're going to get a whole list of items, and I think the third choice that came up here is Recovery Console commands. Click that, and you're going to get a list right in Windows XP.

William: We should also note that if you're in the Recovery Console you can just type help to get a list of commands, and then, for the individual commands, you can type the name of the command, a space, and a forward slash question mark (command_name /?) or just question mark and get the syntax for any particular command within the Recovery Console itself.

Otto: Excellent, good detail. Thank you, guys. Next question: You mentioned some paths that could be entered on a command line for the System Restore to activate. Could you go over that a little bit more?

William: The command line to start the System Restore utility from a safe mode with command prompt boot is in your Windows\System32\Restore folder, and the file name is Rstrui.exe.

Jonas: If I could add to that, there is a Microsoft Knowledge Base article, Q304449, that has that same information.

Otto: Great. Can you set up Windows XP to automatically create the boot log on every start?

Charles: Actually that is a feature in the Msconfig utility. All you have to do to bring it up is click Start, click Run, type Msconfig. You'll see on the BOOT.INI tab you can check /BOOTLOG, and it'll create it on every boot.

Otto: Okay, great. During the presentation you mentioned that to open Task Manager you could use the key combination CTRL+ALT+ESC. [Editor's note: The correct key combination is CTRL+SHIFT+ESC.] There are a couple users who are wondering if that's correct, or if there are instances where that might not work? They're able to get to Task Manager from CTRL+ALT+DEL, but it looks like CTRL+ALT+ESC is not working.

William: In that case you would use CTRL+ALT+DEL, and there's a Task Manager button from the CTRL+ALT+DEL dialog that will let you run Task Manager. I don't know; do you guys happen to know?

Charles: You might be right. CTRL+ALT+DEL would be the good alternative that should bring it up on a pretty regular basis.

[Editor's note: The correct key combination is CTRL+SHIFT+ESC.]

Otto: Is it possible to use restore with Recovery Console?

William: No, you can start the System Restore tool from a safe mode with command prompt boot, but you cannot run it from Recovery Console.

Otto: Okay, next question here: You mentioned installing Recovery Console to run from a command prompt. Can you repeat the procedure for extracting the file from the CD, the /cmdcons?

William: Yes. Basically in this case you're going to run the Winnt32.exe followed by a /cmdcons, you put your Windows XP CD into the CD-ROM drive, and you could go to a command prompt and navigate to the i386 folder and just run Winnt32 /cmdcons. That will install the Recovery Console on your system and add it to the boot menu.

Otto: Okay. This one might be a little outside the scope of the presentation: Can you speak to the F2 option, the Automated System Recovery, how that works and how that might tie in to our topic today?

William: It's probably a little bit beyond the scope of this presentation, but we could provide follow-up afterward. There are a number of Knowledge Base articles on Automated System Recovery. I think there is a white paper on Microsoft.com. I would have to check, but we could provide that.

{Follow-up answer: The Automated System Recovery (ASR) tool is an advanced option of the Backup Tool (Ntbackup.exe) and is only available with Windows XP Professional. It replaces the emergency repair disk found in Windows 2000 and Windows NT 4.0 and can be used to restore your system to a previous state if other disaster recovery tools (for example, safe mode, Recovery Console, and last known good configuration) are unavailable. Note that ASR formats your disks as part of the restore process (booting from the Windows XP CD-ROM and pressing F2). As a result, personal data or application files are not restored. Therefore data loss is possible when using ASR. Always try System Restore and other disaster recovery tools before resorting to ASR. For more information about ASR, see Windows XP Professional Help and Support Center. }

Otto: Okay, sounds good. Next question here: Event Viewer creates an error code. We're wondering if there's a list of error codes on the Microsoft Web site with possible resolutions, or some general information?

William: I think one of the resource kits — I'm not sure if the Windows XP Resource Kit includes a list of your error codes; the Windows 2000 Resource Kit may, but I'm not aware of a master list on Microsoft.com. Typically what you'll find is individual Knowledge Base articles about specific error codes in Event Viewer and how to troubleshoot them.

Charles: I don't think we have a master list anywhere. The best thing to do is, when you receive an error code, search our Knowledge Base with it, and see what you get.

Otto: Okay. Next question: Windows XP was pre-installed on my laptop. How do I install Recovery Console on it, and other preinstalls in my company? Could I install it from an upgrade disk that I have for other machines?

William: Yes, using the command line that I mentioned previously, Winnt32 /cmdcons, from the i386 folder on the upgrade CD would work fine to install Recovery Console.

Otto: Okay. I'm experiencing hangs whenever I attempt to shut down Windows XP Professional when my dial-up connection is active. Is that something that you guys have seen before?

Jonas: That can definitely be the case. Dial-up connections, a lot of times, will use a serial port. And either through the design of the application or through the design of the support for the serial driver, they don't respond to a shutdown request as expected. So for instance, you're dialing up and you shut down Windows XP Professional — the operating system sends shutdown signal to applications and drivers notifying them of impending shutdown. Legacy applications or older applications that work with serial ports may not respond to that, or the hardware itself may not respond to the shutdown request gracefully. Yes, it is something that has been experienced. Again, to troubleshoot that, get back to the isolation, Msconfig, and try it without the dial-up active.

Otto: Okay. We have a follow-up to the Task Manager question that was asked a little earlier. It appears that the keystroke combination for Task Manager is CTRL+SHIFT+ESC. That seems to work perfectly on my end as well.

Okay, next question: We see long startup and shutdown times, like 5 or 10 minutes where the Boot.exe program takes about 99 percent of the resources. This is a common killer for new installs for Windows XP and Windows 2000. Do you know what might be the cause in that case? It looks like it's something about Boot.exe program. I'm not sure if it's something you guys are familiar with.

William: I just did a quick Knowledge Base query, Otto, and it looks like Boot.exe is a program file used by Microsoft's Revenge of Arcade. This Knowledge Base article is not related to the problem that's mentioned here, but at least that's where the boot and key file is coming from. In terms of troubleshooting the issue, I think I would probably start with the Msconfig utility and a clean boot environment to see if the problem reproduces itself there.

Otto: Okay. A follow-up to the first question that we had addressed concerning Fast User Switching: I not only get slow user switching and shutdowns, but also it's very slow in opening applications and accessing files. This problem seems to be connected with only one user on the system; it may not happen in other profiles. Is there any troubleshooting you guys can suggest on that?

Charles: If you find that these problems are focused on one particular profile, it is possible that some of that profile information has become corrupt, either by circumstance or by application. What you'd want to do is to create a second profile, a test profile, and run your test applications to see to what you need to do with it. If you decide that it's running fine, all you want to do is transfer your files and information over to your new profile, and you'll be off and running.

Otto: Great, thank you. Next question here: Windows XP is causing an abnormal shutdown and pops up with the message that, of course, the machine had an abnormal shutdown. This only seems to happen, though, when I use the Shut Down option. If I use Log Off and then Shut Down, it's fine. Any suggestion on that?

Charles: It sounds like it is just a standard shutdown issue. What's happening is you're changing the sequence of how the computer shuts down applications and how it shuts down hardware. By logging off first, you're telling the computer just to free up the resources that applications have been using, and then you proceed to go to the hardware instead of doing it in one fell swoop. You probably still have either a hardware device or an application that is causing the issue and, again, you're going to want to do standard Msconfig troubleshooting. Try it in safe mode; try it using clean boot or by disabling non-Microsoft services. We sound like a broken record sometimes when we say use the clean boot troubleshooting and Msconfig, but it's exactly what we do every time.

Otto: The user is having problems with slow shut downs. There are no errors; it just takes a long time to shut down. They're wondering if there are any other options besides safe mode selective startup. That's something they haven't tried yet — they're planning on it, but they're just wondering if there are any other general causes that are for the slow shutdown.

William: At the risk of being Charles' broken record, I think a selective startup with Msconfig is probably the best approach to take in troubleshooting this problem. As I mentioned late in the presentation, if an application is taking a long time to clean up after itself, that can cause the shutdown process to be very slow. In that case I think a clean boot or selective startup with the Msconfig utility would probably be the best way to isolate the problem.

Otto: Okay, great. When I'm bringing down a Windows XP image to a machine, I sometimes have a blank screen before the splash screen and also after boot. I was assuming that Bootcfg would fix it, as stated earlier in the WebCast. Will Bootcfg help on images where I happen to have two different operating systems?

Jonas: With the blank screen troubleshooting issues, a question I would ask is, does the operating system, Windows XP in this case, work in safe mode or in VGA mode? Sometimes we're seeing issues where because of user error or misconfiguration, a change of settings in the display will cause Windows XP to start back up and get up to the desktop, but the user is not able to see that because the refresh rate and resolution is out of the range of the display of the monitor. So, in effect, you have a blank screen, but Windows XP is up and running. One of the ways to troubleshoot that would be to go into safe mode or into VGA mode and test at a lower resolution to see if that is the case.

As far as multiple boot images, fixboot, depending on what the operating system is, could possibly fix it if that is the issue, but that's definitely an issue that will take a little bit of additional research to get to the bottom of.

William: I would just add, when he says image here, it makes me think that we're using some sort of imaging software to image the whole drive, in which case it sounds like the imaging software itself may not writing in the boot sector or boot files correctly on the drive. The bootcfg command, you would use that to rebuild the Boot.ini file. The fixboot command is the command that would rewrite the boot sector code on the drive. The fixmbr command could be used to write the master boot record. It's certainly worth a try, but I think if we're using imaging software to create an image on this drive, we may want to look at that imaging software to see if we can figure out why it's not writing the image correctly on the drive, with respect to the boot sector, partition table, or what have you.

Otto: Okay. We have a follow-up on that question as well. It looks like the Windows XP operating system does boot after a pause. I'm wondering if it's the other operating system that's coming up with a blank screen, or possibly it's just a blank screen pause situation, and then it goes in?

Charles: For this particular issue there are a lot of questions that we'd be asking about how he has the dual boot set up and what type of hardware he has. This might be more in depth than we can get into on this WebCast. I would suggest going through our Knowledge Base on http://support.microsoft.com/, typing in a few keywords with the problem you're having, and seeing if you can find out yourself.

Otto: Okay. Yes, that one sounds like it might be a little more complex than what we can handle during the show today. So definitely submit an incident on the Web, or contact us by phone and speak to a support professional. Next question: Is there an easy way to tell if all shutdowns are done correctly, even though there are intermittent problems with the computer hanging as it's shutting down? How can you tell what the problem was that caused the computer to every once in a while hang during shutdown? Maybe Event Viewer or something like that might be an option.

William: Yes, I was thinking of Event Viewer. I think that'd be the first place I would look, is in the Event Viewer. Obviously, intermittent problems are very hard to troubleshoot because they're intermittent, so you can try the troubleshooting steps. For example, you could try a selective startup in Msconfig. But if the problem only happens every other Tuesday, you might have a while to wait, and you might not want to wait in a selective startup for the next time.

I think the first thing I would do is look at the Event Viewer and see if there are any errors in there that coincide with the times I've experienced the shutdown problems. Otherwise, I think you have to go back to the standard troubleshooting strategies, even though it's intermittent, and look at Msconfig, and selective startup, or at least at minimizing the configuration as much as possible to remove as many variables as you can, to see if the problem reproduces itself. I think that's probably the best approach. Do you guys have any other ideas?

Jonas: Yes. Along those same lines, for those of you not familiar with the Event Viewer, I'm going to give another plug for Help and Support. It does have very easy access to a quick rollup of the different errors and events from the event log. To get there you click the Start button, click Help and Support, then when that comes up you click the Support icon at the top, and then at the lower left of that screen you'll see four options: About Support, My Computer Information, Advanced System Information, and System Configuration Utility.

If you click Advanced System Information, you'll be presented with another screen that gives you some options, and the second one up from the bottom is View the error log. Click that and Help and Support will look at the contents of your event log, put them into a nice, easily readable format, and display them for you. So if you're not comfortable with the event log viewer in Control Panel or in the management tools, the Help and Support Center has a nice, easily readable interface to give you similar information.

Charles: Again, Help and Support Center is a great tool. We love being advocates of its use. For intermittent problems, I want to suggest something a little bit old-school. I've had customers who had problems that didn't show up very often. I tell them to keep a pad of paper and a pen next to the computer, and as soon as the problem shows up, write down what you just did since you turned the computer on. After you do that a couple of times, you might be able to find a pattern that will allow you to repeat and be able to produce the error on demand. As soon as you can produce the error on demand, now you can go back to Msconfig, do the troubleshooting, and locate the problem. So yes, keep a pad of paper and a pen next to the computer.

Otto: Excellent. We have a follow-up on the mysterious Boot.exe question from a little earlier. It looks like it's not Boot.exe, it was Winlogon.exe consuming 99 percent of the resources. Does that give you guys any further insight on what might be causing that problem?

Jonas: That's a good question. Without knowing a little bit more about the environment, whether it's a domain environment, a joined computer, or an unjoined computer, with the types of applications that are running, it's very difficult to tell. Some of the things we'd look for would be a roaming profile situation, if it is in the domain. With that issue, I'd definitely have to say we'd need to get a little bit more information about the environment.

If it's just a local machine and you're trying to log on and it gets that kind of resource issue, try using another user profile, and again try the Msconfig troubleshooting utility, or try it in safe mode. That way even if it is joined to a domain, if you try it in safe mode no networking will be available, and you'll see if it still hangs.

William: I would also add, I just did a quick query in the Knowledge Base, and there is a hotfix available for a Winlogon.exe issue involving shutdowns after using Fast User Switching. That article number is Q320008. That may be something to look into. You should obviously talk to a Microsoft support professional about the particular problem, though. If they think it's necessary, they could send you the hotfix.

Otto: Okay, great. Next question here: Can I turn off the alternate user input completely? I'm not exactly sure what they're referencing.

Jonas: Without further information, I'm going to assume that you're talking about the on-screen keyboard or the narrator. One of the quick ways of accessing that suite of utilities is through the Utility Manager. Pressing the Windows logo key+U will bring up the Utility Manager, and it will let you turn the Magnifier on and off, or the Narrator, or the On-Screen Keyboard. So if that was the alternate input that you meant, that would be something to look into. Other than that, I would look at the regional and language settings in Control Panel, to see if it's a locale or a localization issue.

Otto: Okay, great. We've experienced several problems with shutdown and startup when third-party software Easy CD Creator 4 has been involved. Are there any references or public information on what causes those errors and how to troubleshoot it?

Charles: The main difference is Easy CD Creator was designed prior to the release of Windows XP, and it was really designed for what we call the Windows 9x (Windows 95, Windows 98, Windows Millennium) environment. The way Windows XP and the Windows 9x environment communicate with hardware, especially with CD-ROM or CD-RW devices, is quite different. To throw out a buzzword, it's the hardware abstraction layer that's causing the issue there.

I have to tell you that Roxio, the developer of Easy CD Creator, has done an excellent job in providing updates and information about issues that come up. I really suggest going to their Web site, I believe it's http://www.roxio.com [Note that this Web site resolves external to the Microsoft domain, and Microsoft is not responsible for its content.], and searching for Windows XP, or your version, and you will deluged with information.

William: I would also point out Knowledge Base article Q311806, which has a link to the Web site that was just mentioned. It also notes that it's not just version 4, but Roxio Easy CD Creator version 5 can also cause shutdown issues, and Roxio has an update available to address the issue.

Otto: Great, thank you. I currently have a laptop with the latest BIOS and drivers. The computer seems to take a very long time when booting, and when the message comes up it says "loading user settings." Occasionally it may hang somewhere in that section as well. This is recovered by powering off and on. Do you have any suggestions, other than possibly clean boot?

Charles: So it recovers by turning the computer off and on as it's hanging at the user? I'm just clarifying the question quickly. I think that besides our broken record of using Msconfig, this is another where we might consider looking at a different profile. Let's create a different user and try logging on. Sometimes user profiles, because of software that's not completely compatible with Windows XP, can collect some miscellaneous information that will cause hangs or cause very slow logons. So create a new user profile, run some tests on it, and see if that addresses the issue.

Otto: Okay great, thank you. The next question here: I currently have a Windows 2000 computer with mirrored drives. The primary mirror went down and I was unable to boot the secondary mirror drive. Does Windows XP address this potential issue a little bit differently and possibly better? Are there any suggestions that you might be able to give, as far as how the upgrade is concerned there? It might be a little outside the scope.

William: I think it is. I would refer to a Knowledge Base article for information on basic and dynamic storage in Windows XP, which is article number Q314343. Otherwise, I do think it's outside the scope of troubleshooting startup and shutdown issues.

Charles: One of the things I always like to make clear when we're talking about things like mirrored drives — the industry buzz for this is RAID — there are two types of RAID; we're seeing an influx of RAID hardware controllers. They're being built on the motherboards and being included with systems now. If those controllers are doing the jobs they're designed for, that should be completely transparent to the operating systems. So that kind of setup actually is done on the hardware level with the controller. If you're talking about software RAID, you would then be talking about Windows XP Professional and doing disk management with that type of thing.

Otto: Okay. Next question here: Is there any way to get to a system root, like c:\, from the default doc and setting of users running Recovery Console?

William: Well, there are limits to what you can do in Recovery Console. You can access the root of the system drive, though, from Recovery Console. There are limitations with respect to you can't copy files from the volume to another location, but you should be able to access the system root by typing cd\.

Otto: Okay. There's a clarification question here on System Restore: When using System Restore, and it's finished, after choosing earlier date, some of the folders are duplicated. For instance, I have a folder called Creative under Program Files. When I run System Restore, it's made a new folder called Creative(1). Is that something you have seen before?

Charles: Without more detail, my opinion of that description is there is software running that doesn't completely understand how System Restore works. Let me give an example: we are running the computer, we have installed a piece of software, and we have done something with that software that made it create a folder. We're now going to restore back a few days.

After we've done that we can run that piece of software again, and when we run that software it's going to create that folder again. But now, because there's already a folder there, it's going to create a second one or a copy of it. Basically the application doesn't realize that there's already a folder that has been created by itself in a previous version, prior to running System Restore, and so it's going to create a second one. This is one of the side effects of running System Restore. If you install software or run software that causes changes to the system, and then you restore back, that software obviously doesn't know what has been performed, and it may repeat some operations.

Otto: Great, thank you. Currently I am having a power-down problem in Windows XP. It completes the shut down, but I have to physically turn off the computer with the power button. Is this something that's directly related to power management?

William: Yes, I think so. If by that we mean that the computer, when you choose Shut Down, you get to a screen that says it's now safe to turn your computer off, then I think it is power management related, and the issue is that you're on an older machine that uses Advanced Power Management instead of the newer ACPI specification. And by default, we do not enable Advanced Power Management in Windows XP. You have to go into Control Panel, Power Options, and on the APM tab there's a check box to enable Advanced Power Management support. That would allow us to shut the machine down instead of taking you to a screen that says it's now safe to turn off your computer.

Charles: For some additional information, again, I'm going to point you to Help and Support Center. Type in power options in the search window to come up with a number of options, including common task power options. A lot of times this happens, as William mentioned, when we have an older computer. They used to make computers what they called with AT-style power supplies, which often exhibit this. One way you can tell, especially if it's a desktop, is if you have what they call a hard power button rather than a soft one. When you press the power button on the front of the case do you hear a nice solid click and then everything goes dead, or is it the type of button that when you press it, it causes software to actually shut it down? If it's a hard click, usually the power option is going to ask you to shut it down yourself.

Otto: Great, thank you very much for the clarification there. I'm not sure if this is within the scope, either. I'll throw it out here, just in case: Chkdsk seems to return different results when run from a command line, versus from Windows Explorer; both run in RO mode. Is there a reason for that, or is it abnormal, or is it maybe specific to my PC?

Jonas: That's another good question. One thing that sticks out in my mind is why you may see different results. Running Chkdsk from the command prompt and the Recovery Console is always a real-mode operation, and running it from inside of the UI, inside of the operating system, is a protected mode operation, and therefore it has different access to the hard drive. As far as reporting results, the thought could be that you run it once, it does fix some errors; you run it again, and those errors are no longer there. As far as any other inconsistencies, the only thing I could think of there would be the real-mode versus protected mode: two different applications running two different modes. That's about all I can add to that.

Otto: Okay. A follow-up the to the laptop shutdown issues question that we addressed a little earlier: Could this also be caused by hardware acceleration on the video driver? If it's set to none, it looks like it occasionally fixes that issue.

Jonas: It definitely could, again depending on the laptop — there are so many different kinds of variables involved there. It may be something as simple as a dual-head video card. As far as the video involved, turning down the acceleration — it may be a case where the laptop is using the internal display, and then for some unknown reason it's kicking off and going to the external display, making the screen go black. It appeared to be shut down, but it's not actually shut down.

As far as triggering the machine to shut down by itself, that is kind of an odd behavior. But the video card does control the display; so if the screen goes black, it is controlled by the video card. However, I would definitely check to see if the power supply is still going at that point. Again, that's kind of a difficult issue to track down, and some troubleshooting time would be needed to get a solid result.

Otto: Okay. This is another follow-up on Chkdsk: The only reason I want to bring it up is I've seen instances where if it hangs, if Windows XP hangs or whatever the case may be on boot, you'll be prompted to run Chkdsk. Is there any way to view the summary results of Chkdsk? It seems to disappear too quickly to read it. Basically I'd just like to see the results for things like bad sectors, for example.

William: On the restart — I may ask Jonas and Charles here on this one — I don't think there's a way to capture the output from the Chkdsk, the auto check that runs on the restart. Are you guys aware of anything?

Jonas: Without doing a little bit of research and hitting the KB on Chkdsk, I can't think of a way to do that. I do remember there was a Scandisc.ini back in the Windows 9x days where you could cater the Scandisc. But for Chkdsk, off the top of my head, I don't know how to set that log up, or if there is even the option to do that.

Otto: It this just something we could follow up with offline?

Jonas: Oh, sure. {Follow-up answer: Chkdsk can not run on a volume with open files (for example, your Windows drive). In this case, you are prompted to schedule Chkdsk to run when the computer restarts. On the next restart, Autochk is run and it does not pause long enough for you to review the results. It does log an event in the application event log, however, so you can view the results in the Event Viewer (Source=Winlogon, EventID=1001). Here is an example of the results from a Chkdsk /f:

For more information, see the Help and Support Center.}

Otto: Okay. If your Windows machine does not start, is it caused by the System\Config file, is it corrupt or missing? If that's the case, can you use fixboot to fix that problem?

Charles: I don't believe fixboot touches the config file. We do see this kind of thing — applications that, again, weren't designed for Windows XP at times want to write to a config file. The config file may not be there because Windows XP doesn't necessarily need it. What you'd want to do is take a look at what is actually causing that error message using clean boot and see if there's an update for the application, maybe check the vendor of the application.

Otto: Okay, great. We have a startup issue here that's directly related to user profiles: In Windows XP Home Edition, we're using a number of limited users on the system, and occasionally we run into a problem where a limited user profile, when logging in, gets an error message that says, for instance, "Trayapp cannot read the registry." Trayapp is a third-party application from 3Com for our ASDL modem. This works fine in admin profiles but not the limited user profiles. Are there any specific solutions to these types of issues where you can give access to one specific application, for example?

Jonas: While this isn't specifically a startup or shutdown issue, it is a profile issue. Basically there are ways to customize access to the registry based on applications. It's not something that the normal typical home user would want to get into. Your best bet there is to contact the independent software vendor and see what their recommendations are for running the software. It may be that they don't recommend running it as anything but an administrator.

Without a little bit more information on that — it's not a case where you'd want to use Msconfig, but you would definitely want to contact the independent software vendor, in this case 3Com, and see what they say about user profiles and their application to the definitive answer.

Otto: Great thank you. Next question here: In Windows XP Professional the computer hangs when restarting. I tried targeting an application using Msconfig selective startup, but it only occurs with the Windows basic services loaded. Would this be a situation where we'd be looking at like a repair installation or an in-place upgrade to fix that?

Jonas: If the symptom does appear in a full clean boot, one of the first things that I would want to know is does it appear in safe mode as well? The services that are listed in Msconfig are some of the ones that are listed right there, but that doesn't include the hardware device drivers that do run as services. There are a couple of other steps involved and some places you have to look, including the registry, to find out which services are running.

I believe William mentioned in his presentation that you can run listsvc in the command line to see what is running and to disable individual services from the Recovery Console. Without a little further troubleshooting, the first thing I would do would be to go into safe mode and see if it reproduces there, and then from that, possibly the Computer Management console, Services, and then start eliminating services one by one. A repair install is certainly not out of the question. It is an easy option, but again, some additional troubleshooting would be required there.

Otto: Okay. I'm not sure if we have addressed this or not: Is there a Knowledge Base article that's related to the device driver startup logging feature?

William: Yes, it's Q315222.

Otto: Excellent, thank you. Next question here: When running recovery from the Windows XP installation CD, I tried to install Windows XP but I don't have an administrative password. What's the best method of continuing without having to do a clean install in that case?

William: Okay, so we're recovering from the Windows XP installation CD, and I'm assuming we're doing a repair install with no administrator password. Short of an administrator password, there's not really going to be a way around this. For security reasons, you're going to need to have an administrator password. Otherwise I think the clean install is the only option. Jonas, Charles, do you agree?

Jonas: Yes, definitely.

Otto: Okay, moving on to the next question here, kind of a follow-up to a previous question where we were talking about power management: Could the "It is now safe to turn off your computer" shutdown situation be resolved by installing a different HAL, hardware abstraction layer, during the original setup process?

Charles: If the computer will take a HAL that uses Advanced Power Management, you can certainly run Setup and install a new HAL. You have to be careful, though, that if the operating system doesn't see that Advanced Power Management HAL as appropriate, then if you force it to install one, it's possible that you can put the computer into a no-boot situation. If you're able to update the BIOS of the computer and the motherboard manufacturer now says it's Windows XP compatible, what you can typically do is just re-run Windows XP setup, and it will detect an update in the power management and install the proper HAL.

Otto: Great, thank you. During the boot up, what is the function of the Svchost.exe that's listed there in the Processes tab?

Jonas: That's a great question. The Svchost is kind of a shell for other services that do run at startup. So it's not just one particular function that it is running, and it could run various different services within it. The best way to see what is contained within the Svchost.exe that's running is in the Help and Support Center. Again, you click the Start button, click Help and Support, then click the Support button in the top menu. Then you'll see a list of four options in the bottom About Support, My Computer Information, Advanced Support Information, and System Configuration Utility.

If you click Advanced System Information you'll get another list of options, and one of those options is View running services. When you click that your machine will take a second to think and gather up all the information about the services that are running on your machine and it'll present them in a list. This list is a little bit different than the Task Manager in that it breaks down the service, the executable, the status, and the startup. So not only is just the service listed, but the executable that hosts that, in this case Svchost, is listed as well.

So the answer there, what is Svchost, what is it doing? The answer is many things, and the best way to get an idea of what's exactly going on is to use Help and Support and view the services that are running. It'll give you a great, easily readable list of exactly what's contained within Svchost.

Otto: Great info, thank you.

Charles: I'd like to do a quick follow-up on the HAL question. I did have a second to find the KB article titled "How to Force a Hardware Abstraction Layer During an Upgrade or New Installation of Windows XP." It's Q299340. So if you'd like the exact keystrokes and the methods for doing that, you can take a look there.

Otto: Excellent. This is kind of tied into that: Can you briefly talk about the differences between a restart and a cold boot? For example, I have a system that will load the sound driver with cold start, but on reboot, it will not load the driver.

Charles: I'll try to tackle that. Of course the main difference between a restart and a shutdown is that we are now skipping all of the motherboard testing of memory and it's quite possible that the motherboard is assigning what they call interrupts to devices and distributing resources. When we do a restart, we're asking things to be done in a little bit of a different order and a little bit of a different sequence. Often, if you're having a device issue that only happens either during a cold boot or during a restart, it's because now that we've put that sequence into a little bit of a different order, it's having trouble, probably because of resource management. The restart is actually distributing the interrupts and distributing memory addresses differently.

You might want to consider running the tool Msinfo32 and taking a look at your hardware resources, interrupts, and memory requests, and see what is being shared by that sound card. Maybe there's another pesky device there that you don't need to have loaded. It's very common, by the way, that motherboards have sound devices built on to them, but people want to buy the most fancy and the greatest new sound card. They forget to disable the one that's built on to the motherboard. When the computer tries to install two sound cards, it really doesn't know what to do, and you can get this kind of erratic behavior.

Otto: Excellent information, thank you. I had a situation when troubleshooting a Windows Millennium to Windows XP upgrade where I pressed F8 and selected logging. After the boot, I could not seem to find the log file anywhere. My recollection is that the option indicated that a log file would be sitting in the root directory, but I'm still unable to find it. Is this something you guys have seen before, or is it possibly a hidden file or something of that nature?

William: It should be in the Windows directory instead of the root. This is the Ntbtlog.txt file that we were talking about earlier. It should be created in the Windows folder.

Otto: Okay, great. Now we have a follow-up to one of our previous questions concerning Config\System, kind of a further clarification: If Windows does not start and shows either a STOP error or %systemroot%\System32\Config\System, or its log or alternate is corrupt, absent, or not writeable (it sounds like an error message, I suppose), is that something that could be addressed with fixboot, or are there other options for that?

William: Fixboot is not going to help here. I think what we have here is a corrupt registry. I'm going to give you a KB article to reference for this specific problem, which is Q314874. Basically the last known good is going to be the first step to try. If that doesn't work, then you're going to need to use the Recovery Console to restore your registry files.

Otto: Great, thank you. Okay, I'm not exactly sure what they're referencing. It sounds like it's possible that they're referencing something about power management here: What about setting the Plug and Play OS to on in the system BIOS?

Charles: Setting the Plug and Play OS to on in the system BIOS basically is telling the motherboard "Don't assign resources; we're going to let the system handle it." That's something that we really started to implement with Windows 95, and we have gotten better and better as the operating systems progress. There are times, though, where we have devices that within the operating system do not like to play well with each other. We might want to go in to the BIOS, turn the Plug and Play OS off, and consider assigning resources manually. You do that at your own risk, and I always recommend that people check with their hardware vendors for exactly about how to do that. Typically, though, you can leave Plug and Play OS on, allow Windows XP to handle resources, and you'll have a good outcome.

Otto: Okay, We have a follow-up to the boot log question here: I attempted a search of the entire drive for the file name of the boot log file there, and it simply was not there. Have you run into any instances in which the boot log file itself may not be created?

Charles: Let me address this quickly. First of all, we've all encountered times when we've tried to find a file. We know it's there; we cannot find it. It's extremely frustrating, like trying to find your car keys when you're trying to go out. What we want to do is open up My Computer. Basically open up Windows Explorer, just to be certain that there is no hidden attribute or something on there. What we'd like to do is make sure that we're showing all files. Also you want to make sure that when you're doing the search you're using Advanced Search, and you're making sure that it's searching on all computer system files.

The second thing to do is to try creating that log file in a different way. For the boot log, if you want to, you can bring up Msconfig, check /BOOTLOG on the Boot.ini tab, reboot, and search for it again. That's going to be a second way to see if you can get it created. My recommendation is to try that second way; let's verify that we're looking at all files.

William: I just did a quick query here as well, and I think this could, depending on the situation, be the issue here. That is that the boot log file is not actually created until you get to the "Preparing network connections" dialog during the boot process. The boot log is committed to the registry, and isn't flushed to the disk until that stage in the boot process. So if the boot process hangs before that, you're not going to get a log file.

There's a Knowledge Base article on this, Q275735, and unfortunately there's no workaround. There's a really good explanation in this article of why this occurs and why you wouldn't get the boot log file. But if the system hangs before preparing network connections, you're basically not going to get the boot log file.

Otto: Okay, thanks for all that information. With that, it appears that we've answered all the questions that have been submitted today, so I'm going to wrap up the session. I want to thank everyone for joining us. I hope that this information was useful. I want to thank William, Charles, and Jonas for coming out and giving us a great presentation and answering some really great questions.

[If you happen to have any suggestions for future topics, general comments about the session today, or comments about the WebCast program as a whole, feel free to send us e-mail at supweb@microsoft.com. We sincerely appreciate the feedback.]

We hope that everyone has the opportunity to tune in again in the near future. Thanks, everyone. Have a great day.