Do you find the Support WebCast transcripts helpful?
Let us know!

Note This document is based on the original spoken WebCast transcript. It has been edited for clarity.

William Keener: Welcome to today's WebCast presentation on maintaining your Microsoft® Windows® XP system. In this presentation we will examine some best practices for keeping your Windows XP system up-to-date, running smoothly, and easily recoverable. Some of the specific topics we will discuss include System Restore, backup and restore, antivirus, firewalls, and keeping your software updated.

To frame today's discussion I want to start out with some questions for you, which are on slide 2. If you can answer "yes" to all of these questions, then you should already have an up-to-date Windows XP system that is running smoothly and is easily recoverable. If you answer "no" to any of these questions, then you know where your system maintenance is in need of some attention.

For example, if you haven't scanned for viruses lately, then you may have a virus and not even know it. There are at least 60,000 known viruses, and new ones are written every day. About 95 percent to 98 percent of viruses come through e-mail and instant messaging. Often they arrive in an e-mail message disguised as something entertaining, like pictures, music, or greeting cards. Sometimes the e-mail is from someone you know. On any given day, tens of thousands of virus-infected e-mail messages are sent through the Internet.

A virus can make copies of itself (possibly filling up your hard drive), send itself to everyone else on your e-mail list, or reformat your hard drive and/or delete your files and programs. A virus can also install hidden programs, such as pirated software, that can be distributed and sold using your machine, or it can allow intruders to hack into your system.

Viruses and other malicious software can also exploit known security vulnerabilities in your programs. Vendors regularly release updates or patches for known security issues, and unless you already subscribe to some type of automatic updates for your software, the chances are there is a software fix available for at least one product on your computer right now.

Depending on how you connect to the Internet, a firewall may also be needed to prevent malicious attacks on your computer, and a current backup is the best insurance against the loss of any important data on your system.

Finally, regular disk maintenance is also an important part of maintaining your system. And you should have some plan to recover your system in the event of a catastrophic failure.

Now let's look at each of these best practices in more detail. If you don't do anything else to maintain your computing environment, you should always take prompt advantage of software updates (slide 3). These updates, known as fixes, patches, service packs, or security rollup packages, help you to protect your computer and your personal data from exploitable security flaws. Sometimes these updates introduce additional security features as well.

The Windows Update site is available to help you keep Windows XP and its related components up to date. Windows Update is an online extension of Windows designed to deliver updates specific to your configuration. It has a central catalog, called Product Updates, which includes new product enhancements such as updated system files, service packs, and new Windows features, as well as third-party device drivers that are certified by our Windows Hardware Quality Lab.

These updates are recommended to you based on what is needed for your specific hardware and software configuration. When you access the Windows Update site, it checks your installed software and hardware against a list of current versions and lets you know whether new versions are available. This is accomplished using an ActiveX® control that is downloaded to your computer the first time you access Windows Update.

You can also download Windows updates, enhancements, and device drivers to install later or on more than one computer by using the Windows Update Catalog. The catalog lets you download updates for other Windows operating systems as well. For example, if you have a Windows 98 computer, you could use your Windows XP computer to download the updates for the Windows 98 machine.

The Office Update site and Office Download Center are available for Office updates. Other programs may have their own update mechanisms. For example, while updates to the Windows Media™ Player are generally available from the Windows Update site, Media Player also has its own automatic updates feature that you can configure by clicking Tools, then clicking Options in Media Player. Other programs may have similar update features, or they may require manual updates.

Finally, the Microsoft security site offers a number of tools and resources specific to security. This includes a security notification service, which sends you an e-mail message whenever Microsoft releases a security update for any of our products. You can also read the security bulletins online at the Web site. The site also includes a variety of security white papers and "How To" documents, including baseline security checklists with instructions for configuring your system for a baseline level of security.

A number of security tools are also available at this site. For example, the Microsoft Baseline Security Analyzer (MBSA) is a graphical and command-line tool that can perform local or remote scans of Windows XP and Windows 2000 systems to identify common system misconfigurations. MBSA also uses the Hfnetchk tool to scan for any missing security updates and service packs for Windows, Internet Explorer, Internet Information Server, SQL Server™, Exchange, and Windows Media Player. The MBSA tool creates and stores individual security reports in an XML format for each computer you scan, and it can display the reports for you in HTML format in the Tools interface.

The security site and the Windows Update Catalog are great resources for IT professionals and power users, but if you're not an advanced user then Windows Update and the associated Automatic Updates service is really all you need to keep your Windows XP system up to date and running smoothly.

You can access Windows Update from the Start menu, or click Windows Update on the Tools menu in Internet Explorer (slide 4). On your first visit to the site you will be prompted to install an ActiveX control. Then you can scan your system for updates, review the updates, and install them directly from the Web site.

To avoid having to manually go to the Windows Update site on a regular basis to install critical updates, Windows XP also includes an Automatic Updates feature (slide 5) that you can configure by right-clicking My Computer and selecting Properties. You may have also seen a message in the notification area of your taskbar asking you to configure Automatic Updates. You can configure this feature in Windows XP to prompt you when updates are available to download, or you can configure it to automatically download the updates while you are connected to the Internet, and then prompt you when the updates are downloaded to your computer and ready to be installed.

This feature has also been updated so that you can now use it to specify a schedule that Windows follows to automatically install the updates on your computer. This updated feature is included with Service Pack 1 for Windows XP, and is also available separately on the Windows Update Web site. When critical updates are detected, it automatically downloads them in the background while you are connected to the Internet. After the download is complete, it waits until the scheduled day and time and then installs the updates automatically, unless an administrator is logged in and cancels the installation. This makes it possible to configure your system to automatically update itself without any interaction on your part. Note that most critical updates require your computer to be restarted, so if you configure scheduled updates you should also make sure that you save any open files before the scheduled day and time of the update, in case your system needs to be restarted after the updates are installed.

Here is the dialog box (slide 6) used to configure Automatic Updates. The first setting tells Automatic Updates to notify you when updates for your system are available for download and then to notify you again when they are ready to be installed. This notification occurs by a message in the notification area on your taskbar.

The second setting lets Automatic Updates download the updates quietly while you're connected to the Internet and then notify you when they're ready to be installed.

The third setting is the schedule option, where the updates are downloaded automatically while you're connected to the Internet, and then installed on the day and time that you specify.

At the scheduled time all logged-on users will receive a dialog with a five-minute countdown timer. As I mentioned, if an administrator is logged in, they can cancel the install. Otherwise, the updates are installed automatically, and your system will be rebooted if needed.

IT professionals can leverage Windows Update and the Automatic Updates service to configure a server on their corporate network to provide critical updates to corporate servers and clients (slide 7). This can be useful in environments where some clients or servers don't have access to the Internet or to the Windows Update site, or where the environment is highly managed and the corporate administrator must test the updates before deploying them. The Software Update Services tool is available for download from the Web site listed on slide 7 (http://go.microsoft.com/fwlink/?linkid=6928).

As I mentioned previously, other programs may have their own update services (slide 8). For example, Microsoft Office has its own update site, and some programs, like the Windows Media Player, have a built-in Automatic Updates feature.

Regularly updating your antivirus program is also critical to your computer's maintenance. For information on updating other third-party programs, you should register the product and contact the manufacturer of the program for information on updates. You can also consult the documentation for the program.

As I noted previously, viruses are a growing threat (slide 9). If you don't have an antivirus program, I strongly encourage you to get one and keep it up to date. Microsoft does not provide software that can detect or remove computer viruses, but there are a number of programs available from third parties, such as McAfee, Symantec, Computer Associates, and TrendMicro, to name just a few.

You should schedule weekly disk drive scans or manually scan your system at least once a week. If possible, configure your antivirus program to automatically scan incoming e-mail and attachments or files that you download from Web sites or exchange through chat or instant messaging. If your antivirus program doesn't support automatically scanning attachments or downloads, then all users should manually scan files before they open them.

Again, be sure to keep your antivirus program up to date. You can sign up for automatic updates with many antivirus vendors. Some of these programs allow you to schedule the download time for updated virus definitions or signature files. The signature file contains the patterns or signature that the antivirus program uses to find a virus infection. When a new virus is discovered, the signature file has to be updated so that your virus scanner can detect it. Therefore, you should update your signature file each time you scan your system.

If your computer slows down unexpectedly, you notice a very large amount of unexplained Internet activity, your programs behave erratically, or you files appear scrambled, then you may have a virus. If you do, remove your computer from the Internet or any other network and make sure that you have the latest virus signature file. Scan your system immediately and let your antivirus program clean or delete infected files. Then inform anyone else you may have infected. In some cases you may also need to download a separate utility to remove a virus and clean infected files. In rare cases you may need to obtain some manual removal instructions for the virus. Contact your antivirus vendor for information on this.

You should also make sure that your Windows XP computer is safe and secure while you are on the Internet. Potential intruders can scan your computer over the Internet and probe and open TCP ports where they can break and enter.

A firewall (slide 10) is like a security system in that it can block unauthorized entry as well as restrict outbound traffic (321050). Windows XP has a built-in Internet Connection Firewall that you can use, and companies like Symantec, McAfee, Zone Labs, and Sygate also provide personal or software environment firewall products. Hardware routers and firewalls are also available for a slightly higher cost. You can check the Windows Catalog for information about firewalls that are compatible with Windows XP.

You should use a firewall on any computer with a direct connection to the Internet, particularly computers that use a cable modem, DSL, or other "always-on" connections. Note that if you use Internet Connection Sharing, you only need to install a firewall on the computer that actually connects to the Internet. Installing a firewall on every machine in a home or on a local area network configuration will prevent file sharing between these machines.

Also note that the log files that your firewall creates can be used to see how much and what kind of traffic it is repelling. You may need a network administrator or a support professional to assist you in reading the logs, but with their experienced eyes, they can give you an indication of what types of attacks are being mounted against your machine.

Don't forget to keep your firewall up to date with any needed patches or updates. Finally, if you have an always-on connection to the Internet, you can make it less susceptible to attacks simply by turning it off when you don't need to be online.

Another important part of computer maintenance is a good backup strategy (slide 11). If you don't back up your system, there's really no way to recover it in the event of a catastrophe. Although you can reinstall your operating system and all your programs from scratch, your resume or a child's homework are only going to come back if you have a backup copy to restore.

There are a number of things to consider in devising a backup plan, all of which are dependent on your individual circumstances and requirements. For example, if you only have a standalone computer with very little critical data, and reinstalling and updating your operating systems and applications is not an issue, then your backup strategy might simply involve saving files to a floppy or other removable disks and, optionally, compressing them. If you need a full system backup so that you can easily restore your operating system, applications, and all of your data, then a real backup solution is required. If you need to schedule unattended backups of a corporate network, then a serious backup solution and some planning is required.

First, you need to choose a backup medium. If the quantity of data that you need to back up is small, a removable hard disk or rewritable CD or DVD might be all that you need, or you might simply choose to use another physical hard disk or a network drive. For more flexibility and capacity, you may decide that a tape drive is the way to go. If you need to schedule unattended backups of large amounts of data on your corporate network, then a tape library that holds multiple tapes is the best solution.

The next consideration is what kind of backup software, if any, you're going to use. Windows XP Professional comes with a Backup utility already installed that includes a feature called Automated System Recovery, which we'll talk about in a minute. For Windows XP Home Edition, you will need to install the backup program separately from the Windows XP CD. There are also a number of backup programs available from third parties. You can check the Windows Catalog for information on backup software that is compatible with Windows XP.

Another consideration is the operating system that is going to be used to restore the backup. Because you can't run the Windows XP Backup utility on a Windows 98 computer, a backup created with Windows XP Backup can't be restored on the Windows 98 computer.

I should also mention that there are some less sophisticated utilities available that you can use for backup. For example, the File Settings and Transfer Wizard can be used to back up files and Windows settings. You can, of course, use Compressed Folders and the COPY or XCOPY command to manually back up your files. We'll discuss these options in more detail in a moment.

If you decide to use the backup tool included with Windows XP, which is also called NTBackup, you should keep several things in mind. First, NTBackup does not support CDs or DVDs. To back up to a CD-R or CD-RW or to a rewritable DVD disk, you will first need to back up to a file and then copy that file to the CD or DVD disk. You can use NTBackup to restore directly from the CD or DVD disk.

The second thing to consider is that NTBackup only supports compression when you back up to a tape cartridge or a tape drive. When you back up to a file, your data is not compressed. For example, in the case of backing up to a CD, which is limited to 650-700 MB, you might have to divide your backups into smaller jobs. Another option, of course, is to just compress your data and copy it to the CD or DVD without using NTBackup at all.

With NTBackup you can manually run a backup or schedule backups. If you have a tape library that holds several tapes, NTBackup can automatically mount and dismount tapes as required when the scheduled backup program calls for a new tape. This makes unattended backups possible and allows you to overwrite or append to a tape based on the backup options you choose.

If you have a standalone tape library, one that requires you to manually load and unload media, you can schedule nightly unattended backups, provided the data that you are backing up can fit on a single tape. If the data can't fit on a single tape, backup will pause and ask for a new tape cartridge.

Several types of backups are also available with NTBackup (slide 12). Deciding which type of backup to use depends on your needs. The two major considerations are the value of the data and the amount of data that has changed since the last normal or incremental backup. The types of backups are listed on the slide.

A normal backup copies all selected files and marks each as having been backed up. This is the easiest way to restore files you need. Only the most recent backup file or tape is required to restore all of the backed up files. This is also the most time-consuming backup, because every file that is selected is being backed up, regardless of when it was changed.

An incremental backup reduces the time required to complete the process by saving only files that have been created or changed since the last normal or incremental backup. If you use a combination of normal and incremental backups to restore your data, you must have the last normal backup set of media, as well as every incremental backup in chronological order since the last normal backup.

A differential backup can also reduce the time required to complete the backup process by copying files that have been created or changed since the last normal or incremental backup. You, of course, need to create a complete, normal backup of your system before you run a differential backup, and you must have the last normal backup media set and the last differential backup sets to restore your data.

A copy backup copies all selected files, but it doesn't mark them as being backed up. This is a useful temporary method to back up files between normal and incremental backup. It doesn't affect the other backup operation.

A daily backup copies all selected files that have been modified on the day that the daily backup is performed.

Note that some of these backup types use a backup marker, also known as an Archive attribute, to track when a file has been backed up. When the file changes, Windows XP marks the file to be backed up again. Files or directories that have been moved to new locations are not marked for backup. NTBackup allows you to back up only files with this marker set and to choose whether or not to mark files when they are backed up.

If the data you create on a daily basis is irreplaceable, daily backups are recommended. If the data is less valuable, then you can back it up less often. However, the longer the period between backups, the greater potential for loss. The type of backup also determines how easy or difficult it is to restore the data in an emergency. The compromise is between security and convenience.

If you choose to run full, normal backups every day, you can restore lost data easily, but the backups can take a substantial amount of time, depending on the quantity of data to be backed up and the data transfer speed of your storage device. If you choose to make incremental backups for a month after making a full backup, you can save substantial time in the backup process. However, fully recovering or restoring a corrupted hard disk might require you to restore the normal backup and then each incremental backup in succession. Substituting a differential backup for the incremental backup shortens the restore process, but because the backup process takes more time each day, the total accumulation of changed files continues to grow, so the time you gain using a differential backup might be minimal. You must also use a separate cartridge for each differential backup to prevent losing the ability to retrieve earlier versions of files.

Also note that you should keep normal backup tapes for at least a month. Because some viruses take weeks to appear, this allows you to restore your system to its uninfected state in the case of a virus infection.

Also note that in NTBackup you will see an option to back up something called system state. System state is a collection of system-specific data maintained by Windows XP that must be backed up as a unit. It's not a backup of the entire system. The system state data includes your registry, system files, boot files, and files that are protected by the Windows File Protection feature. For servers, the system state data also includes the Certificate Services database if the server is a certificate server, and in the case of domain controllers, the system state also includes the Active Directory database and the SYSVOL directory. If the server is a node in a cluster, it includes the cluster database, and the IIS metabase is included if Internet Information Services is installed.

As I mentioned previously, the backup tool in Windows XP Professional adds a new feature called Automated System Recovery (ASR) (slide 13). This feature allows you to recover from situations where you cannot easily repair system partition damage. ASR works by writing operating system files on to backup media and hard disk configuration information to a floppy disk.

The ASR Preparation Wizard is part of NTBackup. This backs up the system state, data, system services, and all disks associated with the operating system components. It also creates a floppy disk, which contains information about the backup, the disk configurations, and how to accomplish a restore.

After you create this ASR backup set, you begin an ASR restore operation by using the Windows XP Professional CD to start your computer. During the text-mode setup phase, you can press F5 at the prompt to run ASR and simply follow the instructions on the screen. ASR reads the disk configurations from the floppy disk and restores all of the disk signatures, as well as the volume and partition information for the disk required to start your computer. ASR then performs a simple installation of Windows and automatically starts to restore from backup using the backup ASR set created by the ASR Preparation Wizard.

Note that ASR is not a backup replacement, because it doesn't include data files or partitions other than your Windows partitions. You still have to back up your data files and these other partitions separately. ASR is designed to restore your system partitions, in the event of a catastrophic failure, to allow you to get your system back up and running quickly.

The File and Settings Transfer Wizard (slide 14) was designed to transfer common files, such as your desktop, document folders, and fonts, and some Windows settings, from an old computer to a new computer. For example, you can use it to transfer settings for Internet Explorer and Outlook® Express as well as your desktop and display settings, dial-up connections, and other types of settings, as well as the My Documents and Shared Documents folders. As you go through the wizard, you can also select additional files and settings that you want to transfer. These files and settings are archived in a .dat file, which you can restore using the File and Settings Transfer Wizard on another computer, or after reinstalling Windows on the same computer. Note that you can run the File and Settings Transfer Wizard on any Windows system, provided you have a Windows XP CD.

Another option is the compressed or zipped folders feature in Windows XP. This is similar to the more popular ZIP programs that are also available. You can use Compressed Folders or your favorite ZIP program to reduce the disk space used by your files before you back them up or before you copy them. As I mentioned earlier, Compressed Folders and the COPY or XCOPY commands may be the only backup solution you need for a standalone computer with very little critical data. Because ZIP programs are available for most operating system platforms, restoring the files on another system is not a problem.

System Restore is a Windows XP and Windows Millennium Edition feature that takes a "snapshot" of critical system files and some program files. It stores the snapshot as a restore point, so that you can return your computer to a previous state. I list it here with a question mark, simply to point out that it is not a backup solution. Because its name has "restore" in it, some think it may be a backup solution. It's not. We'll talk about System Restore more in a moment.

There are three other backup considerations I want to mention. First, the Windows XP Professional product includes the ability to encrypt data directly on volumes that use the NTFS file system. This is called Encrypting File System, and it is used to ensure that other users can't access your data. If you use EFS, then you should export your certificates and private keys to removable media so that you can recover this data in the event of a system restoration. A backup is not sufficient in this case. You will need to restore the encrypted data from your backup and then separately restore the EFS certificates and keys.

Second, Windows Media Player includes a Digital Rights Management feature that is enabled by default. Content that you download from the Internet or record with the CD audio feature may have associated license files that you must back up periodically to ensure that you can play the content in the event of a system restoration. Again, a simple backup/restore is not sufficient in this case. You also need to restore the licenses.

Finally, you should consider your Windows password. If you forget your password and the administrator password, then you can't log on to Windows XP. In this case you may have to perform a clean installation of Windows XP, re-create all your user accounts, and reinstall all your programs, unless you create a password reset disk. See Microsoft Knowledge Base article 321305 for information on creating a password reset disk.

Other routine maintenance (slide 15) that you'll want to perform is regularly checking your disks for errors and consolidating and freeing up disk space. The Check Disk tool checks the integrity of your hard disk drive for file system errors and can scan for and attempt to recover bad sectors. This tool replaces the Scan Disk utility included with Windows 98 and Windows Millennium Edition. You should run it weekly.

The Defrag tool is used to consolidate fragmented files and folders so that each occupies a single contiguous space on the volume. As a result, your system can gain access to your files and folders and save new ones more efficiently. By consolidating your files and folders, this defragmenter also consolidates the free space on the volume, making it less likely that new files will be fragmented.

The Disk Cleanup tool helps you free up space on your hard disk by searching your disk for files that you can safely delete. You can choose to delete some or all of the files. With Disk Cleanup you can remove temporary Internet files or remove downloaded program files (for example ActiveX controls and Java applets that are downloaded from the Internet), you can empty the Recycle Bin, remove Windows temporary files, remove optional Windows components that you're no longer using, or you can remove installed programs that you no longer use. You can start the Disk Cleanup by clicking Start, clicking All Programs, pointing to Accessories, pointing to System Tools, and then clicking Disk Cleanup.

I also want to briefly mention compression. While not typically considered part of a routine maintenance program, certainly making more disk space available to Windows and your programs can increase the performance and reliability of your system. Compressed Folders and NTFS compression both allow you to store files in a compressed format that uses less disk space. If you need access to the files immediately, consider NTFS compression. Otherwise, you can use Compressed Folders to archive the files into a ZIP file.

The last topic I want to talk about is troubleshooting and system recovery (slide 16). There are a variety of troubleshooting tools and recovery options in Windows XP.

One common tool used by Microsoft support professionals is Safe Mode. To start your computer in Safe Mode, press F8 during startup and select Safe Mode on the Windows Advanced Options menu. Safe Mode loads only a minimal set of drivers and disables startup applications and services that are not required to start Windows XP. If Safe Mode works, then you can use the System Configuration Utility (MSConfig) in Safe Mode to further isolate any problematic drivers, services, or applications.

The Last Known Good configuration is similar to System Restore. It restores your system to the last configuration in which you were able to start Windows XP successfully and log on. This is particularly useful in cases where the root cause is known and the failure occurs before you log on. For example, if you change your configuration or add a driver to your system and it fails to restart properly, then you can try Last Known Good. To use Last Known Good, you press F8 at startup and then select the Last Known Good Configuration from the Windows Advanced Options menu. Note that after you log on successfully, Last Known Good is overwritten. Therefore, if the problem occurs after you logged on, Last Known Good is not going to help.

System Restore, which I mentioned earlier, is also a tool to consider if your computer was working properly at some point in the past. It's not, again, a backup/restore utility. System Restore takes a snapshot of critical system files, some program files, and stores this information as restore points. You can then use these restore points to return Windows XP to a previous working state. System Restore automatically creates restore points for you at regular intervals, and you can also create restore points manually when your system is configured the way you want and is running properly.

To start System Restore, click Help and Support on the Start menu, and then click Undo changes to your computer with System Restore. You can run System Restore in both Safe Mode and Normal Mode, but you cannot create restore points in Safe Mode. If you can't start Windows XP in either Normal Mode or Safe Mode, you can also start System Restore from the safe mode with command prompt boot option by running Rstrui.exe from your Windows\System32\Restore folder.

The Recovery Console provides some command-line tools to repair boot configuration and corruption issues that prevent you from starting Windows XP in either Normal Mode or Safe Mode. You can preinstall the Recovery Console to your hard disk so that it's available from the boot menu, or you can boot with the Windows XP CD and run Setup to access the Recovery Console.

Finally, a repair or reinstall, also called an in-place upgrade, is another technique that can be used if your computer does not start in Safe Mode or Normal Mode. This may be required if you suspect corrupt or missing operating system files. Note that a Repair or Reinstall deletes all of the restore points created with the System Restore utility, so you may want to try System Restore before doing a repair or in-place upgrade.

There are basically two options for doing an in-place upgrade or repair. If you can start Windows XP in normal mode, simply insert the Windows XP CD into your CD-ROM drive, and on the Welcome to Windows XP page that appears, click Install Windows XP and select Upgrade (Recommended) in the Installation Type box.

If you can't start Windows XP in normal mode, you can run a repair by booting from the Windows XP CD-ROM. This runs Setup again, and you first have the option to repair Windows XP using the Recovery Console. If you select the option to Install Windows XP instead of repair using Recovery Console, the next screen allows you to perform a repair install.

Note that you cannot perform a repair or in-place upgrade by booting from a Windows 98 boot disk and running Winnt.exe in real mode. This does a clean install and will, therefore, delete all of your user profile data, such as My Documents, desktop items, or Internet Explorer Favorites. Also note that you will have to reinstall all Windows Updates, including service packs, after you perform a repair or in-place upgrade. Of course, if these troubleshooting tools and strategies don't work, then you can perform a clean install of Windows XP and restore your backups.

Finally, here are some additional resources (slide 17) for you to use in maintaining your Windows XP system. With that, I will hand it over to Otto for the Q&A.

Otto Cate: Thank you very much for the presentation; good information there. Before we jump into the Q&A, I'd like to share a couple of program notes with our audience.

Just a quick note on the content of the questions. One-on-one product support issues are outside the scope of what we're able to address during the WebCast. If you do happen to need some more complex technical assistance, your best bet is to contact a support professional directly by phone or by through online incident.

I'd also like to introduce Scott MacArthur. He's going to be helping us out with the Q&A. He is a support professional for Windows XP. Welcome, Scott.

Scott MacArthur: Thank you; glad to be here.

Otto: Let's roll through these questions. It looks like we have quite a number of them. There's one that was actually pretty common early in the presentation. You may have addressed this in the slides, but a lot of users are wondering: What's the best way to back up to a CD-R? Are there are any utilities or methods available that would allow for backup to span multiple CD-Rs?

William: Scott just indicated that there are some third-party backup programs that are available that afford backup to CD media, and they may allow you to span multiple CDs or DVDs.

Otherwise, as I mentioned in the presentation, NTBackup does not support CDs or DVDs, so an option that's often suggested is to back up to a file and then just copy that file to the CD. Obviously, you don't get compression, as I mentioned in that case, when you use NTBackup to backup to a file. There's no compression. If you're going to span multiple disks, you're going to have to break up your backup sets as well.

Another option that I mentioned is ignoring the backup solution. If you don't want to use a backup solution, you could use Compressed Folders and then copy the compressed files to the CD. That's another option that's available.

However, in terms of a solution that allows you to do a complete back up and span multiple CDs, it's going to require a third-party backup program.

Otto: Would this also go for differential backups to CD-R, for instance?

William: Yes. If we're using NTBackup, the same caveats apply. We don't support CDs or DVDs with the NTBackup program.

Otto: During the presentation you also mentioned some manual methods through XCOPY. Is there a specific procedure that should be used in case people are having problems getting that functionality to work?

William: Not really. I think the scenario that I mentioned is using something like Compressed Folders to compress the data that you're going to back up. Then use the COPY command in the shell, in Explorer, or use either COPY or XCOPY from a command line. And if you use the /? on the XCOPY command, you'll get the syntax for that command, depending on whether you want to just back up some files in a folder, or if you want to back up subfolders and back up empty subfolders. You need to include some additional switches with the XCOPY command; otherwise, it's fairly straightforward command-line syntax.

Scott: I will also add some additional information here. As we stated, the current implementation doesn't allow you to perform a full system backup to CD-R, but I would encourage all users to go to http://v4.windowsupdate.microsoft.com/catalog/en/default.asp, click Software, point to Utilities, and then click Backup; it lists a number of third-party backup software programs that have the Designed for Windows XP logo. Looking through that list right now I see a number of software applications that mention spanning CD-Rs, so that is an option for them.

Otto: Thank you very much for that information. What would you recommend as the minimum set of files necessary for a good backup while using the backup wizard in Windows XP Professional?

Scott: Obviously, a full system backup would be preferred. It depends on the level of what you want to recover. The bare minimum would probably be the My Documents folder. All your software applications, if you have the CDs for that software, you do have the ability to reinstall that. So backing that up is not always something you have to do, because if you're not using ASR, you have to reinstall Windows XP. You can reinstall your software applications and then just restore your user data file. That also allows you to decrease the size of the backup. So at very minimum back up the My Documents folder, or where you save your user files — most software these days store their files in My Documents.

Otto: Concerning Windows Update, some users have noticed quite a few of the updates require reboots. Does whether or not we need to reboot normally just depend on the type of update that is happening, whether or not we're touching critical system files at the time?

William: Yes. Generally, if we're going to update system files, particularly files that are in use, we're going to have to restart the computer. I think you're going to experience a number of cases where a reboot is required after installing updates from Windows Update.

Otto: It seems as if this is also related to Windows Update. The question is: I would like to know why the downloads cannot be saved during the update. Do you know the specific location where those files are temporarily stored and if they're accessible through any other method?

William: Yes. Actually, I have a better solution for you. The main Windows Update site is designed to make the process of updating Windows as easy and seamless as possible. So it installs the updates for you. You don't get an option to save the update to disk and install it later. It's just designed to be a straightforward, "Go here, click this, and update your system."

The Windows Update Catalog, however, is available just for this purpose. If you go to Windows Update, in the left frame there's an option called Personalize Windows Update. If you click that, you will get an option to add the Windows Update Catalog to your Windows Update site. Then you can access the catalog and download any of the individual updates or drivers on the Windows Update site and save them to a standalone file that you can install later, or you can share with other machines. When you go to Personalize Windows Update, the option is called Display the link to Windows Update Catalog under See Also. Then in the left frame, under See Also, you will have a link to the Windows Update Catalog, which can do exactly what you're talking about.

Otto: A couple of users originally had set up their PC to not use Automatic Updates. They're wondering how they can reactivate that, or enable the ActiveX control to let those updates go through.

William: The ActiveX control is not involved. The ActiveX control is for when you go to the Windows Update site directly. If you're using the Automatic Updates feature, the control is already on your machine. You don't have to install a separate control. To configure that you would just right-click on My Computer and choose Properties. Then there's an Automatic Updates tab that allows you to configure Automatic Updates.

If you're having trouble with the ActiveX control on Windows Update, your Internet security needs to be at the default level for the Internet Zone, which is medium. And that allows signed ActiveX controls to be downloaded. If you increased that security or you used the Custom security setting and disabled the ability to download signed ActiveX controls, then you're not going to be able to get the ActiveX control from Windows Update.

But the Automatic Updates feature is separate, and you can configure that by right-clicking My Computer and selecting Properties.

Otto: Concerning the scheduled Automatic Updates: What happens if the computer is offline during that scheduled time?

William: The update does not happen, obviously. If the computer is turned off, it would pick up on the next scheduled day and time and perform the update. If the computer is turned off, it's just going to skip that scheduled update and go to the next one.

Otto: What if the system is still on but the users are just simply logged off?

William: Then it will do the Automatic Update and restart the computer. It's designed to be run in that fashion so that you don't have to have user interaction. Even if no users are logged on, as long as the system is booted, the Automatic Update will kick in and restart the computer.

Otto: I'm not sure if I'm reading this question correctly, but I'm going to ask it as was written: Is there a way to have update prompt users before it runs to allow them to close open files? I guess it's: Is there a way to configure a warning of sorts? That way you can shut down programs in the background before it starts.

William: Right. There are two options here. If you're using the scheduled updates setting, then you do get a dialog with a five-minute countdown timer that tells you that "We're going to install these updates in five minutes. Save your work. Close your applications." If you are logged in as an administrator, you can cancel the update in that dialog. If you're not an administrator, there will not be an option to cancel it; it's just a five-minute countdown timer, and when the countdown gets down to zero, the updates install. It reboots regardless of the user that's logged on. But an administrator can cancel the update in the dialog that comes up when you have the schedule set for an Automatic Update.

The other option is the second option for Automatic Updates, which is to automatically download the updates in the background while you're connected to the Internet, but then notify you when they're ready to be installed. In this case you would not be using the schedule feature. You would configure Automatic Update to download the updates for you automatically, but then you'll get the message from the notification area when the update is downloaded and ready to be installed. You can manually choose to install it. Those are the two options.

Otto: When applying a lot of updates, I seem to accumulate a lot of temporary files in, for instance, c:\TEMP and c:\WINDOWS\TEMP. Is this normal? And is it okay just to remove those .tmp files?

William: For the .tmp files, I'd want to clarify — and this may be a better question to contact support with — I would say yes and no, depending on where the files are located. For the Windows Update files, obviously it's going to download and keep some files on your system. Under your Program Files directory there's a folder where the updates are stored, and a log file that helps Windows Update determine what the history is or what updates you have previously installed. Windows Update will remember those. And it uses some of the files under Program Files to do that, so you don't want to delete those.

When I hear "temp files," I think of the folders that are associated with the TEMP and TMP environment variables in Windows. Generally speaking, I've not noticed Windows Update putting files there, but I guess it could, depending on the update. Individual updates could put files in the TEMP folders, and that may or may not be normal, depending on the particular update that we're talking about. But I would think that they could be safely deleted.

I've also seen some issues, and I believe we have a Knowledge Base article on this, on certain third-party utilities that will interfere with Windows Update and cause a large number of temporary files to be written to your Windows INF folder. I would want to get a little more detail on what types of files we're talking about and what location. Are we talking about the TEMP folders, TMP folder, or some other location?

Otto: It looks like a majority of these are .tmp files. There is also a mention from another user that they're also seeing a large number of compressed directories inside the Windows directory, of a form "*Quninstall Qnumber." It looks like that might be related to some of the hotfixes.

William: Yes. Hotfixes and service packs both will do that. That is normal and those are uninstall folders that you want to keep around in case you need to uninstall either the hotfix or the service pack. Those are normal files and folders that are created that allow you to roll back or uninstall those updates.

Just to add, Otto, a large number of .tmp files that hang around after a Windows Update, I don't think that is generally normal, and that might be something that you would want to contact a support professional about.

Otto: Is there a way to disable some Automatic Updates, not necessarily all of them? For instance, there are a couple of pieces that it's asking me to update that I actually don't have on my machine.

William: That's interesting. That would be a bug with Windows Update. If you're being prompted to update a component that you don't have installed — Internet Information Server, for example, the Web server with Windows 2000 Professional, if you don't have that installed — you shouldn't be prompted with any updates for IIS. That sounds like a bug in the detection mechanism for Windows Update, and I think I would open a support case on that.

There's no way to dismiss individual Automatic Updates that are scheduled. If I recall correctly, if you have Automatic Updates notify you when updates are ready to be installed, you can clear the selection for individual updates at that point, and they won't be offered again unless you go back to the Windows Update site and configure it to display those updates for you again. That may be possible, but again, this sounds like a support issue to me. If there's an individual update for a component that's not installed, and you're getting prompted for it and you shouldn't be, that might be something we'd want to look at.

Otto: Regarding an NTBackup backing up to a file: Would you recommend backing up to a file that could be up to, let's say, 3 GB, and then using some type of application to essentially split that file into parts that would fit on CD-Rs, if that's available? Or would it be better to simply start your backup in smaller jobs that would fit on 700-MB increments?

Scott: Right now, with the current implementation of CD burning in Windows XP, we don't have the ability to span CDs. That ability might be available in something like Easy CD Creator. That program might have the ability to create a CD-RW or CD-R, and to take a single file and span it across CDs.

William: Or find the third-party backup programs Scott mentioned earlier that can span multiple CDs. Otherwise, if we're not talking about Easy CD Creator, some other CD burning software or a third-party backup program, I think we're both leaning toward option two there, which is to split the backup jobs in smaller units so that they fit on a single CD.

Scott: That's definitely something we're aware of, and I do believe there may be some changes in the future that may allow us to do that.

William: Which is another good thing to mention. You can go to the microsoft.com page and submit a suggestion to include this functionality in future versions of the product.

Otto: Can you briefly explain the difference between an incremental and a differential backup, in a nutshell?

William: They are confusing terms, and I always get confused as well. An incremental backup is a backup of all the files that have changed since the last time you did a normal or incremental backup. Whereas a differential backup is all files that have been created or changed since the last normal or incremental backup. It sounds a lot alike to me. I think the main difference here is, with incremental backups, we mark the Archive attribute, whereas with differential, we don't. I think that is the primary difference, is that with an incremental backup, the backup program is going to mark the file as having been backed up, whereas with a differential, it's not.

Otto: If that user needs any further clarification, feel free to let us know and we'll certainly try to address that. Hopefully that helps.

William: No.

Otto: Regarding ASR: Does ASR work on a dual-boot system?

Scott: No. In fact, I would highly recommend not doing that. One of ASR's primary functions is to restore or partition where Windows is installed to, and it does reconfigure disks. It could, basically, remove another partition. In a dual-boot scenario, it is not going to work.

William: What about, and I'm going to just ask Scott as well to drill down on this question, does it matter what the dual boot is? If it's some foreign partition type that we don't know about, it may be more problematic than, for example, if we were in an Windows XP and Windows 2000 dual boot situation. Would that be okay?

Scott: No.

William: Or Windows XP and Windows 98?

Scott: Any multiboot scenario could potentially result in losing a partition, so it's recommended to only do that on a machine that has a single operating system installed.

One important thing about ASR is that the only partition that it actually backs up is where your Windows directory is or where the operating system is installed to. If you have files on drive D, for example, and Windows is installed on drive C, we don't necessarily back up those files on drive D. That has to be backed up separately through NTBackup. When we perform the restore, you would end up with drive C, everything would be restored there, but drive D would essentially be empty because we do reconfigure the machine to have the same disk configuration as it did before. But we don't necessarily back up files on any drive other than where Windows is installed to. I highly suggest looking at the help on ASR before you run through that.

Otto: This is also related to ASR: If a 30-GB disk fails, can I use ASR to restore it to a 120-GB replacement drive?

Scott: Yes. You can grow to a larger drive. I will have to check. We can get back to them on that part of the question. But I do know it can grow to a larger size.

Otto: I'll mark that one for offline follow up.

Scott: You cannot go to a smaller drive.

{William: If you use ASR to restore to a larger disk, ASR will automatically increase the partition size to fill the larger disk. No manual steps are required.}

Otto: Okay. This one might be outside the scope, but it's related to backup: Are there any special considerations for backing up, for example, Microsoft Reader e-books, or would those be done just like any other files?

William: I don't know. Scott is going to look here, I think, and see if there's anything specific to Microsoft Reader. If there are licenses to back up and restore, similar to the Media Player licenses that I talked about during the presentation, then you would probably need to do that separately from a backup. But I don't have any information specifically, and Scott doesn't see anything here in the Knowledge Base that immediately pops out at us.

Scott: That's probably a good question for an offline answer.

Otto: Yes. We'll mark that one for offline follow-up.

{William: The Microsoft Reader software is associated with your Passport account and a unique hardware ID that is generated from the volume serial number of your system hard disk. Each Passport account can only be associated with eight Microsoft Reader installations. Therefore, if you reformat your hard disk (or have to install a new one) or restore your computer to a point in time when Microsoft Reader was not installed (requiring you to reinstall the software), you may need to request more activations for Microsoft Reader to open an e-book that you purchased online. For additional information about this issue, see Microsoft Knowledge Base article 271289.}

Scott: I would say there are probably easier methods to back up. One issue you have to deal with is open files. The only way to back up open files is to use NTBackup. There are also potential issues if you move that hard drive to another machine. It would see that as a significant hardware change and might require reactivation. I would say that the amount of work to do what you suggest is a lot more work than looking into a backup solution software.

William: It's not as simple as it sounds, in other words.

Otto: How do we run Check Disk this from the command line?

William: chkdsk is the command, /f if you want it to fix errors.

Otto: Can that be run within Windows, like the command shell within Windows, or will Check Disk prompt you to restart, and then automatically start afterward?

William: If there are open files on the volume that you're running Check Disk on, it's always going to prompt you to restart or to schedule the Check Disk to run on the next reboot. The other option is the GUI Check Disk, the graphical interface. You right-click on a drive in My Computer, choose Properties, and then on the Tools tab there's a Check Disk option that runs a GUI version of this tool. But the command line, the chkdsk command, is going to prompt you to schedule the Check Disk for the reboot if there are any open files on the drive. Obviously, if you're running Check Disk on the same drive that Windows is installed on, there are always going to be open files, so it's going to have to reboot.

Otto: This one might be a little off topic, but it seems somewhat related, so I'm going to ask it: If we're running into physical boot problems that seem to be intermittent, basically the drive doesn't spin up, or something of that nature, until you restart the computer, would the fixmbr switch be a viable option in the Recovery Console, or something of that nature?

Scott: No. fixmbr just rewrites your master boot record. If you have a drive that's not spinning up or that locks up, there are a number of things that could cause that. Hard disks do fail. They have a mean time between failure. So usually most vendors of your particular hard disk, like Western Digital or Maxtor, have utilities that you can download, put on a floppy disk, boot the machine up, and it will actually check the drive. If it finds problems with it, you can, in most cases, send that back to the vendor, and they will send you a new one, if you're in your warranty period. For hard disks that don't spin up, that sounds more hardware related.

It could even be a power issue on the computer — if we have too many devices on the computer, things like that. Additionally, hard drives do generate a lot of heat, so if there's not adequate ventilation in the case, that could also cause strange disk problems.

William: Neither the fixmbr switch in Recovery Console nor any other utility in Windows is going to be able to fix problems like that. It's a hardware issue.

Otto: Thank you for the clarification. Will it be necessary to enable Internet Connection Firewall if I'm using some of the new Microsoft broadband products that have built-in security?

Scott: No. If you are behind a firewall, such as a Microsoft router or a Linksys router, it is not necessary to turn on Internet Connection Firewall. Where you do need to turn that on is if you are directly connected to the Internet and you're not behind a firewall; then it is highly recommended that you turn that on. But because those devices already block incoming ports, you don't have to turn it on. In fact, if you have other computers on, let's say you have a home network, turning ICF on may actually cause some connectivity issues between the machines if you are trying to copy files. If you have multiple computers behind a single router or firewall, you would need to keep ICF turned off.

Otto: Can you schedule the Check Disk feature?

William: Yes, but not directly. What you can do is you can use the Task Scheduler in Windows to schedule a batch file or a .cmd file that runs the Check Disk command that you want to run. You don't really schedule the Check Disk through the Task Scheduler, but you put those commands in a batch file or a .cmd file and you schedule that file. From Control Panel, double-click Scheduled Tasks; you just run the wizard to set up a schedule to run the .bat or .cmd file that includes the Check Disk command that you want to run.

Otto: I guess all this would really depend on the amount of daily use of the system, but: What would you recommend, as a general rule of thumb, as far as how often we should defrag our drives?

Scott: This really depends on how much you move your files around. If you're constantly copying a large number of files from one location to another, or you're installing a lot of applications, then you want to run that more often. In the defragger, when you right-click the drive in My Computer, click Properties, click Tools, then click Defragment now. It does have an "Analyze Now" button that will tell you if this drive needs to be defragged. Obviously, that's a good thing, because defragging a drive does take some time. I would also suggest, if you want to defrag a drive, that you turn off your virus scanning, because that may cause the defragmenter to start over and take a lot longer. It's hard to say what's a good time, just when you think about it, to go in there. There are third-party defragmenters available that have automatic scheduling features, so that's an option also. You can set up a schedule for it to run when you want.

Otto: If system integrity is compromised during a defrag, what's the correct approach to minimize damage or loss of data? Or is it something that we should be concerned about?

William: For example, you get a blue screen during a defrag.

Otto: Yes. It would be a power failure or anything like that.

Scott: If the machine is able to boot up, I would obviously recommend backing up some data immediately.

William: You should have done that before you ran the defrag. You should perform a backup first.

Scott: Right. Then run Check Disk to make sure that will correct inconsistencies on the drive. It can't fix hardware issues, but it can fix logical inconsistencies on the drive. If you have the ability to boot the machine up and get to files, I would back up some files off the machine first. Then run Check Disk. Then run defrag again. Defragmenting is a very intense process, so close everything that's open, including the virus scanning software, or anything that shows up in the notification area by your clock. Personally, that's what I do, is I close everything I can first, then I run defrag.

William: I would also throw out here, and Scott can correct me if I'm wrong, but a defrag is recoverable. It's not going to put me into a situation where if I hit the power button on my machine in the middle of a defrag I'm going to lose data; that's not going to happen, because defrag is recoverable. What it does is it copies a file first, or a fragment of a file, and it waits for that piece to be copied before it goes back and deletes the copy that it started with. There are always going to be two copies of the data that it's currently moving, so it should be fully recoverable, and you shouldn't really have to worry about it, other than doing, as Scott suggests, a Check Disk when you reboot.

Otto: After an initial full system scan, why do you recommend that we perform a full system scan on a regular basis if the antivirus program scans at boot and then scans incoming files and such?

William: It depends on the antivirus product that you're using. As I mentioned, we don't include an antivirus product with Windows XP. They're all different and they can all be configured in a variety of different ways. The short answer is yes, if your antivirus product runs a full scan of your hard disk on every boot, then you don't need to schedule an antivirus scan on a weekly basis because you're already doing one every time you boot, unless you don't boot the machine but once every two or three months. Obviously, if you're going to boot the machine every day and run that scan, then that's sufficient, so it really depends on the configuration options available in the antivirus product that you're using.

Otto: I'm assuming that it's also possible that these initial boot up scans, the virus scans, they may not be full system scans or full hard drive scans. Maybe they just take care of a certain piece of the system partition —

William: Or memory. Sometimes they'll just do a scan of memory and not a scan of the hard drive. That may be what your antivirus program is doing. In which case you would still want to run a full scan of the hard disk, on a regular basis, on top of that.

Otto: Just to make sure all of your bases are covered, I suppose.

William: Right.

Otto: I'm a little bit confused about System Restore in XP. I used it and it seemed to move a lot of data around. But I didn't really find any good explanation on what it actually is doing.

William: It's basically returning your system to a previous state. As I mentioned, System Restore creates restore points that contain some system files and settings. When you choose to restore to a previous state, it's basically restoring your computer to the versions of system files and any other operating system settings that existed on that previous state. That's basically what it's doing. It's not restoring data.

As I mentioned, it's not a backup solution, so it's not restoring, for the most part, any of your data. It may restore some program files. It may delete some program files. For example, you create a restore point with System Restore, or it creates one automatically, and then you later install some program. If you restore back to the restore point that existed before that program was installed, that program goes away when you do a System Restore. That's essentially what we're doing, is rolling the system back to a previous state, with respect to program files as well as operating system files and settings.

Scott: In most cases, most software applications will fire off System Restore. We will see that you're installing something and System Restore will set a restore point. Although for some software, depending on how they install, it may not create a system restore point.

As an example of how beneficial this is, I just recently installed the latest Movie Maker beta, and one of the things it does when it installs is it sets a System Restore point so that I can easily go back to the version that's in Windows XP. The same thing with the latest beta version of Windows Media Player. So System Restore does allow you try out some of those new things without having to worry, "Am I going to have problems." Because if you do have a problem you can go back to that System Restore point and get back to those earlier files.

Otto: Are those System Restore points normally set before installing some of our updates and hotfixes from Windows Update?

William: Not for Windows Update, I don't believe, but correct me if I'm wrong — Scott, Service Pack 1 for Windows XP does create a restore point?

Scott: Yes. Most hotfixes and things installed from Windows Update have uninstall directories. So if you go into Add or Remove Programs you can just go back to the previous version. Any time you install a new device driver a System Restore point is set also. So if you install a device driver and then try to reboot, if it has some type of problem, you do have the ability to go back to the earlier driver version, which you can access when you boot up the machine.

William: Right, or you could use the Driver Rollback feature and go back to the previous driver that way.

Scott: To get to the System Restore points when you're booting up your machine, do you choose F8?

William: No. You would have to boot and use System Restore in either Safe Mode or Normal Mode, or if you can't boot either of those, you can boot to a Safe Mode with Command Prompt, and you can run the command-line version of System Restore manually.

I also wanted to note, back on the previous point about Windows Updates and creating restore points, Scott mentioned that some hotfixes will create their own uninstall information. The other side of that is that critical updates are typically not uninstallable. Not only do they not create restore points when you install them, they also don't create uninstall information because they are, in fact, critical updates. We don't recommend that you uninstall those. You could use System Restore or some other method to roll those back, but again, it's not something that we would recommend doing.

Scott: One last thing, some people might be wondering how you access System Restore. The easiest way to do that is to click Start, click Help and Support, and one of the options there is Undo changes to your computer with System Restore. This allows you to create a restore point or restore to one, and it will show you a little calendar and the most recent restore points.

Otto: Does System Restore leave all user data and files intact? Not necessarily files, but at least user data, like favorites and shortcuts, desktop settings, or MRU lists, for example?

William: Yes. Data files we're going to leave alone with System Restore, but I'm hesitant when you say user files. The application example that I noted previously, let's say one of your user files is something.exe, it's an executable file; it's a program. You put that on your desktop and then roll back to a restore point that existed before you put it on your desktop, and the files go away. System Restore will do that. But yes, by and large it does ignore data files, and it's based on the file type. Documents, shortcuts (which are .lnk files, technically), and things like that will hang around after a System Restore.

Otto: If I were to back up my applications, how would I reinstall them from a backup after I reinstall XP?

William: Depending on what you mean by your applications — we're talking about a full backup in this case, because Windows applications are not separate and distinct entities in the sense that you can back them up discretely. When you install a Windows application, it copies a number of files to its own subdirectory. It may update or copy files to the Windows folders. It will typically add a bunch of Windows registry settings, which is a Windows file. The Windows registry is a Windows file, so that's something critical to the operation of most Windows applications that's not technically part of your application. So you're talking about a full system backup if you want to back up applications.

Otto: I have a follow up to the spare hard drive backup question that we addressed a little earlier.

William: Yes.

Otto: How about periodically creating and breaking a mirror? Something about this seems to solve the open file problems. Do you understand what he's mentioning here?

Scott: If we're talking about mirroring, I don't believe that's available in Windows XP, mirroring drives. The server products allow you to mirror a drive. I'm not sure if I understand the question — if we're talking about software mirroring or some type of hardware mirroring.

Otto: It looks like we're looking at creating and breaking a mirror. It's not specific here whether that's a software or hardware mirror.

William: You would be talking about software, probably, and I agree with Scott. We'd need to look at Windows 2000 Server or the Windows .NET Server 2003 beta, which would support this, but we don't support mirrored sets with Windows XP, so it makes me think we're talking about a hardware mirror. Mirroring is basically a way, whether you're doing it through software or hardware, to have a recoverable system. You have multiple drives in an array, one fails, and you can pop in a new one and keep on going, because the mirror can rebuild the data from the missing drive. It's not really a way to do a backup, though. I don't see the connection there.

Otto: It looks like we had some clarification. It looks like it is a hardware RAID with removable drives.

William: Right. Again, I don't see the connection with respect to backup. Obviously, if you have a hardware array with a mirror set and one drive in the set fails, you can replace it and the mirror can rebuild itself and recover in that way. It is a recovery option, but backup programs and the operating system, for that matter, are going to be oblivious to a hardware mirror. A hardware mirror is going to take five physical hard drives and turn them into potentially one large drive that Windows sees. So Windows is going to think it's running on one big drive. A backup program is going to back up one drive. And the hardware mirror is taking care of everything else under the cover in hardware.

Scott: One aspect of that is having a hardware mirror of, let's say, the drive that your operating system is installed on. If something occurs where you see file corruption or registry corruption, that is immediately mirrored to the other drive. At that point recoverability may not occur, just because a mirror is a true mirror. Anything written to one drive is written to the other drive. If you look at most recommendations on fault tolerance, they don't recommend mirroring as a backup solution. It can be used to get an OS back up and running. But, as I said, if there's some type of corruption on one drive, it's mirrored to the other drive, and you may not have the ability to boot that drive. There are definitely some caveats with it. But I could see how it could be used to mirror an operating system drive.

Otto: Thank you for the clarification. What do you do if when you try to install patches from Windows Update they fail to load? Is that something that might be better handled through a support incident, or do you have any general recommendations?

William: The only general recommendation I might make is if you can access the Windows Update Catalog, either on that machine or potentially on another machine, you might try to download the update separately from the catalog, and then install it by itself instead of allowing the Windows Update site to install it for you. It could be an issue with the controls and the engine that does the automated install from the Windows Update site. And it might not be a problem with the update itself. That's the one quick suggestion I would make, is try downloading the update separately from the catalog and install it by itself. That will tell you whether the problem is with the update itself or with Windows Update in general.

Scott: Also, when an update fails it will usually tell you that the installation failed, and there is a link there to contact our Windows Update Support Group and open an incident. They can determine if there's something wrong with the update or if there's just something on the machine that's preventing the update from installing, like maybe you have a newer version of that file, and so it's unable to replace it. There are a number of things that could cause it to fail.

Otto: This one might also be better handled through a support incident, but I'm going to ask it: When I'm running Disk Cleanup, the tool seems to hang about 10 percent. Do you have any guidance you can provide on the next steps?

William: Hangs for how long? When I have to ask questions, I'm inclined to say that it may better be handled by a support incident, but I would also encourage you to wait. Hangs how long is an important question in my mind. Temporary Internet files, for example, are deleted through the Disk Cleanup Wizard. And I have seen this myself. When I have been browsing the Web a lot and haven't emptied the Temporary Internet Files folder in quite a while, that cache can get very large and can take a long time to delete. It could appear to hang the interface while it was doing that. My suspicion is that it's not really hung, that the application has not actually stopped responding. If you press CTRL+ALT+DELETE and bring up the Task List, does the application actually say it has stopped responding? If not, I would just wait and see if it gets past that stage. But if it hangs for a long period of time, then yes, I think we probably want to open a support incident on it.

Otto: With that, we've addressed all the questions that we were able to get to in our time allowed today. We'll definitely try to get some of these other questions answered offline as well, and we should be able to post those into the transcript for the benefit of the entire audience. That should be available in about two to three weeks.

I hope that everyone has the opportunity to tune in again soon. Thank you, and have a great day.

[Please send any feedback you have regarding the Support WebCast Program to supweb@microsoft.com. You can submit any comments you have about this WebCast or submit suggestions for future WebCast topics.]

{Supplemental Q&A:

Question: How does Windows Update Catalog keep the history of what has been downloaded?

The Windows Update Catalog download history is stored in a file called iuhist_catalogAdmin.xml in your Program Files\WindowsUpdate\V4 folder (note that the Windows Update folder is hidden).

Question: Is there a way to implement multiple downloaded updates on the Windows Update Catalog all at once, like when using Windows Update?

It depends on the type of updates, but generally the answer is yes. The hotfix installer in Windows XP and Windows 2000 post-SP3 updates includes functionality to support multiple hotfix installations. Prior to this, you had to use a utility called QChain. Now you can group multiple hotfixes together in a batch file and install them as a unit; this way you do not need to restart your computer after each hotfix is installed. The /Q (uses quiet mode; no user interaction is required) and /Z (does not restart the computer after the installation is completed) switches can be used to do this.

The following code sample, taken from taken from the "Hotfix Installation and Deployment Guide" topic (the Hfdeploy.htm file, in the Support\Tools folder on Windows XP Service Pack 1 CD-ROM), is a batch file that installs multiple hotfixes and makes sure that the correct files get replaced after the computer is restarted.

Question: How can command prompt be accessed if Windows XP cannot be booted?

Answer: To access a command prompt if you can't start Windows XP normally, try the Safe Mode with Command Prompt boot option, as discussed in Microsoft Knowledge Base article 315222.

Question: Slides 10 and 11 mention Q295322 regarding the catalog — but this doesn't appear to match that description: Microsoft Knowledge Base Article 295322, "How to Determine If Hardware or Software Is Compatible with Windows XP."

Answer: This is actually the correct Microsoft Knowledge Base article reference for slides 9, 10, and 11, where we discussed firewalls and antivirus and backup programs. You can use the Windows Catalog referenced in Microsoft Knowledge Base article 295322 to find hardware (for example, a firewall) or software (for example, an antivirus or backup program or a firewall) that is compatible with Windows XP.

On the other hand, the Windows Update Catalog referenced in Microsoft Knowledge Base article 323166 (slide 3) can be used to download Windows updates and enhancements and Microsoft Windows Hardware Quality logo (WHQL) device drivers to install later or on another machine.

Question: How do I set a System Restore point from the command line (not using the GUI)? Aslo, how do I restore to a restore point from the command line?

Answer: You can start the System Restore tool from a command line (as discussed in Microsoft Knowledge Base article 304449), but you can't create a restore point or restore your computer to an earlier time using the command line. There may be third-party utilities that do this, or you could write your own (see Microsoft Knowledge Base article 315530).

Question: Could an ASR floppy created in one machine be used in another system?

Answer: This would only work if the Asr.sif and Asrpnp.sif files were identical. Note that you can create an ASR floppy from the from the media that stores the ASR backup. See Microsoft Knowledge Base article 299526 for details.

Question: Could automatic SUS include updates for applications like Office, Project, and so on?

Answer: Not unless the updates are available from Windows Update. Software Update Services is designed to synchronize with another server for its content (distributable updates), and the other server must be either the public Windows Updates servers or a server in which the content has been synchronized with the public Windows Update servers by using Software Update Services.

Question: I've noticed that if I start up my PC, and then don't log on for 10 minutes or so, the hard disk will have a burst of activity. This is with nobody touching the PC. What is happening? Is Windows XP defragging the drive?

Answer: Defrag does not run unless you run it manually or schedule it to run. This sounds more like a performance feature of Windows XP. One of the design goals for Windows XP on a typical consumer PC was to boot to a useable state in a total of 30 seconds. To accomplish this, Windows XP does two things that may contribute to the behavior you have observed. First, Windows XP defers loading processes and services that are not required to boot until the boot process is complete and the computer is usable. Second, it pre-fetches (reads ahead) device drivers and services before they are actually needed. For more information on these features, see the "Fast System Startup for PCs Running Windows XP" white paper.

Question: With reference to the NTBackup utility, is it possible to configure your Windows 2000 server to "pull in" the backup rather than configuring the clients individually to back up to the selected location on the server? Or does this functionality require additional software?

Answer: You can use NTBackup to back up files on a remote computer (for example, by using a mapped network drive), but NTBackup does not allow you to back up the system state on a remote computer. To work around this limitation, you can first run (or schedule) NTBackup on the remote computer to back up the System State, and then run (or schedule) a backup of the system state backup of the remote computer. This is documented in Microsoft Knowledge Base article 315412

Question: How do you back up the File Encryption Keys? I've tried to follow the Microsoft KB article about it, but I do not see the same screen they show online.

Answer: See the Export a certificate with the private key topic in Help and Support (search on "export private key") for details. In the Certificate MMC, personal EFS certificates are found under Certificates – Current User\Personal\Certificates with an Intended Purpose of File Recovery.

Question: When would you use differential as compared to incremental backups, because both aren't so different from each other?

Answer: Think of a differential backup as just a copy (the files are not marked as being backed up — that is, the Archive attribute is not cleared by the backup utility). And then think of an incremental backup as a true backup (the files are marked as being backed up — that is, the Archive attribute is cleared by the backup utility). Therefore, if you want your backup utility to "remember" that the files were archived, you would use an incremental backup instead of a differential.

Question: Would there be a reason why a complete folder cannot be recovered after being deleted from drive C by error, even with trying "Undelete" software?

Answer: When Windows deletes a file, it does not physically remove the file from your hard disk. Instead the associated allocation unit(s) is simply made available for use by new files. Undelete utilities work by recovering these allocation units before they are used by new files. So the chances of recovering a deleted file (or files) diminishes as new files are created. Even if you don't create new files yourself, both Windows and Windows applications create temporary files during normal operation of your computer. In addition, the Windows paging file can also grow as needed, consuming more allocation units. Defragmenting a drive can make it virtually impossible to recover a deleted file. As a result, the best time to undelete a file is immediately after it is deleted, before performing any other tasks or restarting your computer.

Question: Can I override the security level for the ActiveX controls to be download after ghosting machines with the same security level (High)?

Answer: You can configure Internet Explorer security settings for ActiveX controls under Internet Options in Control Panel, using group policy, or by editing the security zones registry keys directly.

Question: Can you use NTBackup to back up your system to another drive? Can you use it to restore your box by booting from another disk and running the recovery console tool? I smoked my box at home and had to run the Recovery Console with the Windows XP Home Edition disk , which restored the OS, but not all of the applications worked. Most had to be removed and then reinstalled.

Answer: You cannot run NTBackup in Recovery Console. If you use Recovery Console to repair the problem that prevented Windows XP from booting, you should then be able to use NTBackup from the original installation to restore. If the original installation cannot be recovered, you can perform a new installation of Windows XP and then run NTBackup to do the restore. If a new disk drive is required (for example, the old disk drive fails), then Automated System Recovery would allow you to restore the partition information and a minimal copy of Windows XP on the system disk to do the restore.

Question: If you use the option to download and install automatically, will it restart your computer automatically (unattended), or must you still click Yes to restart?

Answer: Scheduled Automatic Updates will restart your computer without any user interaction, but a computer administrator can cancel the installation and therefore prevent the restart if they are logged in at the time.

Question: Can one write an NTBackup backup set directly into a compressed folder?

Answer: No, but you can compress your files first with the Compressed (zipped) Folders feature (or another compression utility) and then back up the compressed archive (.zip file).}