Do you find the Support WebCast transcripts helpful?
Let us know!

Note This document is based on the original spoken WebCast transcript. It has been edited for clarity.

Heidi Moeller: Hello and welcome to the Microsoft Support WebCast Program. Our topic today will be "An Overview of PCHealth and Windows Millennium," and our presenter will be Lewis Umbenhower. I'm Heidi Moeller, and I'll be your host for today's session.

We'll start this session with Lewis' presentation and follow that up with a question-and-answer period when the presentation is finished. We only answer questions submitted for the Support WebCast during the live event.

I'd like to now take just a brief moment to introduce Lewis. Lewis joined Microsoft as a Technical Support Professional in August of 1991. He has provided technical support for all versions of MS-DOS^®, Windows^® 3.x, and Windows^® 95 and 98^®. During this time, he was also a mentor and an Escalation Engineer involved in handling more advanced customer issues. Thank you so much for joining us today, Lewis. Let's get started.

Lewis Umbenhower: Thank you very much, Heidi. On this second slide, we'll start in. Today we'll discuss the individual components of PCHealth in Windows Millennium. Those are Help and Support (which includes the Assisted Support), Automatic Update, System File Protection, and System Restore.

Moving to the next slide, "Help and Support." There is now one place for KB articles, Help, how-tos, troubleshooters, Web help, and electronic support. This provides a single place in Windows where users go to access the many different kinds of help: Windows Help, KB articles, multimedia how-to tutorials, Web-based help, troubleshooters, etc.

This will allow OEMs to add their custom help content and will provide a pluggable framework that defines a consistent overall end-user experience, while allowing custom content to be dynamically added over the Web. This content, at the base level, is very flexible: HTML and JavaScript.

This integrated help will save the user from looking in myriad locations to find out how to do what they know is possible. It will allow users to find help in a task-based fashion across multiple sources of help.

Content can be delivered in packages for easy transport, which allows new content to be conveniently transferred and updated via any medium, such as the Internet, floppy disks, or CD-ROMs. This content will be stored in a private directory associated with the vendor.

It allows newer, existing content to be added or modified easily. Help content can be located anywhere, including the local machine, the intranet, and the Internet. It provides direct links in the Help Center UI to help content that has been registered with Help Center.

This will enable Help files to be displayed using the old HTML Help interface. The Help Center will define, in collaboration with OEMs and ISVs, a publicly available Help taxonomy that will be used to organize the Help content into a hierarchy that is easy to navigate, provides security through the use of digitally signed certificates from trusted sources, as well as provides a strictly controlled scripting environment via content authorization store.

This will ensure that only scripts from trusted sources have access to HCP automation objects. It provides the ability to obtain machine data through WMI, Windows Management Instrumentation, also known as Web-Based Enterprise Management providers.

It provides the ability to obtain history data on a predetermined set of the systems information for upload or script analysis. It provides a support automation framework to manage problem escalations to multiple support centers.

It could also provide a way to access the features via the new URL namespace. This will allow users to type hcp://namespace or click on an HCP link to directly access the Help and Support application.

Individual applications will be able to launch the Help and Support tool based on this, as a parameter to specify which content to display. It provides a library of HCP automation objects that will allow integration of intelligent scripts into troubleshooters.

These enhanced troubleshooters can not only walk the users through the steps, but they also have the flexibility to detect machine state and take actions on the machine to attempt to fix the problem. This slide (slide 4) is what the Help and Support interface looks like.

Slide 5 is a view of the Index page. You can use common queries in the index on the left; just type it in and it'll drop down to the closest match. Or you can search in the upper-right corner for a specific string, phrase, or subject.

Help and Support includes some diagnostic tools as well. MSInfo32 is now part of the Help and Support center. And new to Millennium is Network Diagnostics. This is what the system information interface looks like in Millennium (slide 7). It's pretty much what you're used to seeing, except it's wrapped inside the new UI for Help and Support.

This is how Network Diagnostics will appear in Millennium (slide 8). You have Services, Computer Information, and Modems and Network Adapters. All of these are expandable by clicking on the plus sign (+) to the left of any one item.

The Assisted support link is where the online support can be found, either from Microsoft or the specific OEM or ISV. To use Assisted Support, you will need to first log on to the Passport system. The Passport system (slide 10) is currently being used for one unified log on to all Microsoft.com services.

Slide 11 shows the incident management center where you can get the status of your incidents and/or view the history of your support requests. And this is what the form will look like if you choose to submit a support request.

There's Descriptive Title, Problem Area, Frequency of problem, and a place to enter some details. You can collect information about your machine, or choose not to. And you can Supply files requested by a support professional or that you deem pertinent to your specific incident.

This final Help and Support screen (slide 12) is where you can observe the status of the data collection upload and obtain a service request number.

The next component of PCHealth is Auto Update. The goal of the Auto Update feature is to bring the functionality of the current Windows Update Web site to the client machine. From an end-user experience standpoint, the goal of this product is to be as nonintrusive as possible while retaining full functionality.

Ultimately, the intent is for Auto Update to become silent and automatic, much like the Critical Update Notification self-update feature. Replacement of the Critical Update Notification occurs during the Millennium setup; if Critical Update Notification is installed on the client in an upgrade scenario, setup will uninstall Critical Update Notification, because Auto Update provides a superset of redundant Critical Update Notification functionality. And Auto Update is on by default.

There will be no user action required or notification of this change. It updates every 24 hours — that's not configurable. Auto Update will periodically wake up on schedule to determine what operations to perform. If there are no pending actions to be taken by Auto Update, and the user has not explicitly set the schedule by using the Remind Me Later option, Auto Update will run once every 24 hours.

If the 24-hour time period has passed and Auto Update was not able to check for updates, it will register with SENS, the System Event Notification Service, to be notified when a connection is available. After a connection is available, Auto Update will check for updates and reschedule for 24 hours.

Once Auto Update has been awakened, it will need to check the last state of Auto Update. In other words, what action was Auto Update performing on the last execution. And how should Auto Update resume?

It uses a throttled download technology. The downloader will only retrieve information from your Windows Update server in the background, while the bandwidth is not being used by another service, user, or anything else. Auto Update will detect when a connection is not in use, or not saturated, and request information from the server. As other requests enter the pipe, Auto Update will throttle down its use of the bandwidth until a sufficient amount of bandwidth becomes available.

The goal for background download is to have no noticeable impact on a user's use of the connection. The noticeable impact varies, depending on the use of the pipe: e-mail, surfing, streaming media, whatever you have. So Auto Update will detect, in real time, the saturation level of the pipe to determine how much bandwidth is available for its own use.

Background downloading applies to all CAB content downloaded, as in self-update CABs, new content, etc., but will not apply to version 3 (of SFP and Auto Update) catalog information. The reason for this is the catalog information must always be the latest information when detecting or resuming a download, to ensure that the user receives proper updates. For this reason, if the catalog retrieval is ever interrupted, then a restart will occur from the beginning, rather than the point of interruption.

Windows Update uses the Wuv3is.dll control that the Windows Update site uses. It only deals with critical updates. Auto Update is a subset of the content located on the Windows Update site.

The Auto Update content is contained on a separate server. We won't pull down anything from recommended updates or other Windows Update areas. Auto Update will not automatically dial a connection. It will sense if a connection to the Internet is present and proceed accordingly.

When Millennium is about to enter a hibernated or suspended or standby state, Auto Update must exit gracefully to allow this state to occur. Because Auto Update runs in the background, it will not be obvious to the user why the transition cannot be made. Auto update should not prevent this transaction.

If connectivity is lost due to the state transition, Auto Update should terminate and not be in memory when the system hibernates. But the SENS and shell hook should be able to resume from hibernation as appropriate.

It's configured in Control Panel or Auto Update properties. There are three options in Control Panel and double-click Automatic Updates. Automatically download updates and notify me when they are ready to be installed is the first option. The second option is Notify me before downloading any updates and notify me again when they are ready to be installed. And the third option is Turn off automatic updating. I will manually update my computer.

And this is what the Automatic Updates icon looks like in Control Panel (slide 14). This is your selection area where you can choose how you want Auto Update to behave (slide 15).

The next subject for PCHealth is System File Protection. The goal of System File Protection is to prevent core system files from being overwritten. How does it work? Whenever a protected file changes, a copy is made of the file before it is changed.

When System File Protection is invoked, it checks that the file is a valid Microsoft binary, and that catalog signing and the proper binary hash are all in place. SFP checks with the information in the catalog to see if the file is the right version.

If the file is authorized, digitally signed by Microsoft, and correct, SFP terminates and allows the file to be updated. If the file check fails, SFP pulls the correct version from the file out of its backup store and copies it to the relevant directory. No reboot is needed.

The exceptions to this are if there's no space on the drive to perform these operations, it will persist the requirement to revert the file. It will inform the backup store that a data purge or first in, first out (FIFO) be done. It will check at periodic intervals. If space is available and when space is adequate, it will restore the file.

If it cannot find any version of the file in the store, it will leave the file on the system as is. To update a protected system file, a digitally signed and Millennium-certified catalog file will be needed.

Is there any way to configure System File Protection? No. Can you turn it on or off? There is no supported method to disable System File Protection.

It does not protect user-created files. System file protection protects specific system files, but does not protect such files as .chm, .txt, .html, .wav, .bmp, etc. — any file that can be deemed user data.

It also does not protect the My Documents folder. A complete listing of the files protected by System File Protection can be found in the file Sfpdb.sfp, which can be opened with Notepad.

There's also a list of protected files in the file Filelist.xml. (This is for System Restore and System File Protection; this is a file of reference. When VxDMON.vxd goes through its "First Run," this file is combined into VxDMON.dat.) This also contains System Restore information. We'll be covering this in the next series of slides.

Other files that it does not protect: files that may be updated during run time; configuration and .ini files; files that get rolled into other files during setup (a classic example of this is Bmm32.vxd); data files that can be edited by the user at any point; third-party INFs; INFs that are only executed during setup; files owned by third parties that Microsoft is redistributing on the CD; files that are legally allowed to change (if we have formally and contractually allowed third parties to modify a file, then it is not a candidate for system file protection).

Exceptions can be made if component teams want additional files protected or want SFP to stop protecting their file. This slide contains a little bit more of what we've discussed (slide 17).

System Restore allows the user to roll back their system to a previous point in time (slide 18). The System Restore feature will automatically monitor and record key system changes to the PC, and will allow users to roll back their system to the previous point in time.

It can be used in the event that a software or driver installation has caused system instability, and you have no way to uninstall the software or the driver. It restores the registry and file changes that are outside the scope of files protected by SFP.

Snapshots of the registry are taken at the time when a system checkpoint is created, and a copy of the system files held in Filelist.xml is saved. Automatic restore points can be created by software installers that use the Darwin technology (for example, Office 2000) and for software installers that use the most recent versions of InstallShield.

Invoking the System Restore application itself, meaning if you use SR to restore back to a previous point in time, a checkpoint would automatically be created at that time. Here's when you would not use System Restore: to uninstall a version of Millennium on a system; there is no functionality for uninstalling Windows Millennium with System Restore.

When an installer is available to uninstall the suspect application, System Restore will not remove all associated files with any given application. However, it will remove binary files that can cause a particular anomaly to occur, such as .dll, .exe, and .sys files. Registry files will be restored to the point in time that the restore point was taken, and the remaining non-binary files should be able to be safely deleted from the system.

The Start menu may well contain entries for the application that was on the system prior to the rollback. But these too can be safely deleted.

What System Restore does not do: it does not protect critical documents that are created by applications. It does not replace the Uninstall feature of the operating system setup. System Restore is not an add/remove software utility. It is not a backup utility, and does not function as such.

System Restore relies on a data store. We use up to 12 percent of the disk space for Windows partitions that are larger than 4 GB. If you have a partition that is less than 4 GB, and Windows was installed on that partition, then we will use a maximum of 400 MB of that partition's free space for the data store.

System checkpoints are taken every 10 to 24 hours. They are created once for every period of 10 hours of computer up time, or the 24-hour interval if no 10-hour checkpoint was created. This depends on system idle time.

Where do we store the restore points? They are on your Windows partition, which for reference I'm going to refer to as C:\_Restore\Archive. This is where the data is stored for the actual restore event; c:\\_Restore\Logs\Restorept.log is the file that has pointers to the actual displayed restore point and the data CABs.

What is in the include/exclude list? It includes all the files that are not excluded and contained in the Filelist.xml. Files such as .doc, .bmp, .txt, and other personal files are considered excluded because we don't want to cause data loss when we revert the system back. For example, changing someone's spreadsheet after they worked all week on it would be a very bad thing. We do not monitor those files.

VxD will exclude changes to the following files and directories: your swap files; we specifically do not monitor the registry files; Recycle Bin; Windows Temp files; all data files with known extensions; Outlook Express mail stores; POP, IMAP, SMTP; Outlook Express Address Book; Outlook Express news stores; Outlook Express subscriptions; Outlook Express stationery; the My Documents directory and all content therein; Cookies; Favorites; Internet Explorer History.

This list will be represented in XML format, which will be the Windows Update mechanism in the future. We may have to add a size limit for files that we consider system files. The size limit will be decided later; currently it is 12 MB.

Another optimization that we will consider is to dynamically update the exclusion list with new file types registered with Windows. Next is first in, first out of the restore points. Restore points and the associated data CABs are purged first in, first out to preserve storage capacity imposed by design.

The metrics for this are at 90 percent capacity of your data store, System Restore will go into a FIFO process and purge the previous restore points, first in, first out, until the data store is at or below 50 percent of its maximum size.

What does the restore on emergency boot disk (EBD) do? Essentially, if you have a failed restore operation, you can use the startup disk and boot into a useable system, or roll back, using System Restore. You can only undo the last operation. If you did not have a restore operation prior to booting to the EBD, you will not be offered the option to undo the last restore.

Reverting will be supported whether the user arrived at this state directly from protect mode or from safe mode, as long as it was the result of a restore operation. The ability to revert a restore will only be available if, in fact, a restore was the last operation. We'll know by this criteria that there was a restore operation, the restore success trigger did not delete the dummy file. We will not have to worry about this, because unsuccessful restores will always be reverted, and the revert operation clears the dummy file. Once the user creates the boot disk and inserts it, he will see the options for the Millennium startup.

The first one will be start computer with CD-ROM support. The second will be start computer without CD-ROM support. The third will view the help file. The fourth will be a minimal boot.

Regardless of the selection made, if the above criteria are met, which tells us if the restore was the last operation, System Restore will create the following message on the screen. Users must type Y or N before they can proceed to the selected menu option.

That's the message you will see if you enter into this condition and boot from a floppy.

This is what your System Restore interface will look like (slide 20). You'll have the choices Restore my computer to an earlier time or Create a restore point.

Once System Restore is in effect, you'll have a calendar view (slide 21) of the restore points and/or system checkpoints that you can choose from, if you wish to restore your system. Bold dates contain actual restore points, whether they're system checkpoints, Windows updates, or manually created checkpoints.

This is the confirmation screen (slide 22), which displays the restore point that you are reverting back to; you must select Next to continue. And this is the progress bar (slide 23) that appears during the actual restore operation. It will start at the left and move to the right.

Once your system has gotten through that point and restarts, a successful restore will present you with the Restoration Complete screen (slide 24).

After you've restored your system at least once, the initial System Restore screen will have a third selection. And that will be to Undo my last restoration. This option is available in the event that running System Restore did not correct the problem, and it allows you to go back to the point in time in which you originally invoked System Restore.

Are there any questions?

Heidi: Thank you, Lewis. It is time to move on to the Q&A portion of the Support WebCast. We only do take questions during the live event.

The Q&A portion of the Support WebCast is intended to encourage further discussion of the Support WebCast topic. However, one-on-one product support issues are outside of the scope of this session. So if you have the beta Millennium product and you are having any difficulties with it, use the appropriate newsgroups to get those types of questions resolved.

With that said, let's go to our first question, which is: You said that I don't have to worry about System Restore replacing any of my data files because it's smart enough to know that the files like .xls and .doc are my user files. What if I install an application tomorrow that uses a new file type unknown to System Restore? Will I lose my data file if I perform a restore operation?

Lewis: In most cases, no. For unknown file types, we may monitor file changes and act accordingly, because we don't know about those file types. If you have data files that you want protected or left alone, store them in the My Documents folder. We do not monitor that folder, and any files you put in there will not be reverted during any restore.

Heidi: The next question is: How many days worth of restore points will I be able to store on my system at any given time?

Lewis: That's going to be variable, because restore points can be relatively small, say, 4 to 5 MB, or rather large, up to 20 or 40 MB, per restore point. All of this is going to depend on how large the drive is where your data store resides.

If your data store is 400 MB, then you probably have close to three weeks worth of system checkpoints, provided you have not done many software installs or uninstalls. Those will affect the size of the restore points saved, and also the days with which you will be able to save them.

Heidi: The next question is: Does System File Protection operate in safe mode?

Lewis: No. It does not. There is no provision for it to work in safe mode.

Heidi: We've only got a couple questions left. So I do, once again, want to encourage anybody who has a question to get it submitted to us at this point.

The next question is: I've been infected with the "ILOVEYOU" worm virus. Although I have cleaned my system with Neato Antivirus utility, it still says that I have an infected file or two in the data store. How can I tell System Restore to let Neato Antivirus clean the file?

This sounds a little bit like support, but we'll see if Lewis can answer it anyway.

Lewis: The data store is protected. So any application that wants to get inside and modify anything within it is forbidden. If this situation occurs, and yes, it can occur, you need to keep in mind that System Restore does not check for viruses. It is not a virus utility.

What you can do, in this situation, is simply purge the data store. And you can do that by disabling System Restore features and reenabling them after you've rebooted. That will clear the data store and all of your restore points and log files. It will also get rid of the virus in this situation.

Heidi: The next question, and last question at this point is: Yesterday I had restore points going back over 10 days. Today there are only 2 days worth. Where did the other restore points go?

Lewis: This is a standard feature of System Restore. In order to maintain free space on your drive, we go through a FIFO operation when your data store gets to 90 percent of its allocated size. At that point, System Restore will CAB what files it needs to, and purge the oldest restore points first, until the amount of storage in the data store is reduced to 50 percent or less.

That's where your restore points will go. Restore points are volatile. They are going to depend on the amount of free space and the size of your drive.

Heidi: With that question answered, we have cleared the queue of all the questions that were submitted during today's broadcast. I want to thank everybody who joined us for today's session. I hope the information was useful for you.

We always appreciate your feedback. You can submit that to us at feedback@microsoft.com. Be sure to include "Support WebCast" in the subject line. And we're looking for feedback on this session, on any other topics you're interested in seeing, any comments you have about the program overall, or other subjects you've watched in the past.

Once again, thank you so much for joining us today, and we do hope that you join us again in the near future. Have a great day. Bye.