Tricks & Traps: Ask Dr. Bob Your Windows NT Questions

Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.
By Bob Chronister, Windows NT Magazine, December 1999

Q:If I want to add new Windows NT services, do I need to add them from the installation CD, then reload all service packs to update the core NT installation? Do I need to uninstall all service packs prior to adding a new service?

A: You can add new services that require the NT installation CD at any time, and you don't need to remove a service pack before adding those services. You do, however, need to reapply the service pack whenever you use the installation CD to install new software. A service pack simply copies new versions of NT program files to the NT installation directories (after backing up the old versions if you've requested a backup). When you install a new service from CD, the installation process might overwrite a file that the service pack has updated. Even more likely, the service pack includes updated versions of some files, but they don't copy to the computer when you install the service pack if the original files don't exist on the system.

To be safe, whenever you install new software that copies files from the original NT installation CD, reapply the service pack so you know you're running the most recent versions of the programs. If you've applied hotfixes after the service pack, you'll also need to reapply those, because the service pack installation probably wrote over files that the hotfix replaced.

I don't recommend adding services just because you think you might use them in the future. Each service drains a little more system resources, and some have a significant impact on busy systems. (The Netmon service and the diskperf -y switch are two that will affect system performance when you install them, even when monitoring isn't active.)

Q: On my network, one PC runs Windows NT Server 4.0 and the other PCs run NT Workstation 4.0. The network's name is workgroup . When the server or workstations boot up, the message Can't see workgroup appears. When the workstations aren't active, the server sees itself as workgroup, but if a workstation is active, the server displays an error message. Any suggestions?

A: Your symptoms suggest that you've set up the server as a domain controller for the workgroup domain and the workstations as members of a workgroup also called workgroup. This conflicting use of the name workgroup explains why the server can boot alone but experiences an error upon boot, when it finds a workgroup using its domain name.

I recommend you let the server be a domain controller, then join all the workstations to its domain. Alternatively, you can reinstall NT Server on the system so that the server isn't a domain controller but rather a member server. Then, configure the server to be a member of the workgroup called workgroup.

Q: How can I determine the average bandwidth that Windows NT Server 4.0, Terminal Server Edition client sessions use when I'm capacity planning?

A: In its "Terminal Server Capacity Planning" white paper (, Microsoft claims that you can use a figure of 2Kbps to 6Kbps per user to estimate the Terminal Server client's impact on network utilization. However, this estimate isn't accurate for all customer environments. To get a more precise idea of how Terminal Server will affect your network, you can use Network Monitor in conjunction with Performance Monitor.

On your NT server, go to the Services tab of the Control Panel Network applet and install Network Monitor Tools and Agent. This procedure adds the Network Segment object to Performance Monitor. Network Interface, the other object you'll need, installs along with TCP/IP. Now, you can use the newly provided counters underneath the Network Segment object to analyze the impact of your active Terminal Server sessions on the server. Specifically, you can use the Network Segment object's %Network utilization counter, which displays the total bandwidth in use on a given network segment, and the Network Interface object's Bytes received/second and Bytes total/second counters, which provide the total number of bytes that the server's adapter receives or processes.

I've found that Network Monitor's % Network Utilization counter sometimes provides unreliable data, especially on Fast Ethernet/100Mbps networks. And NT Server's Network Monitor can monitor only the traffic to and from its own adapter. If you want to more accurately monitor all traffic on a network segment, consider using an enhanced network monitor such as the Systems Management Server (SMS) version of Network Monitor or a third-party product such as Data General's NetXRay. Numerous hardware products also provide network traffic and utilization data, including handheld cable/network testing devices such as Microtest's Compass.

Q: I have a 10GB hard disk that holds Windows 98 on a FAT 32 partition. How do I install Windows NT 4.0 to another physical 2GB disk and make it dual-boot on my computer?

A: I recommend using a third-party boot manager utility (such as V Communications' System Commander or PowerQuest's BootMagic) to manage your multiboot environment. These utilities create a special boot partition that becomes the launching point for booting multiple OSs from your various disk partitions. If you're managing a multi-OS environment, these products also offer the most flexibility and ease of use.

However, most third-party boot manager utilities require that you have an existing FAT12 or FAT16 partition within the first logical 2GB of the first hard disk. As a result, your existing disk configuration might not work. (A FAT32-formatted C drive isn't a suitable location for the Windows NT boot manager, anyway.) You might need to repartition your existing disk scheme before you can install the boot manager. As with boot management, I recommend a third-party utility for disk partitioning.

Q: Have you ever been unable to install an application on a Windows NT workstation, even though the application installs elsewhere with no problems?

A: An inability to install applications on a Windows NT workstation can occur for many reasons (e.g., conflicting DLLs, unsupported service packs). However, the most common reason is that the currently logged-on user has insufficient privileges to install the application—either to make the required changes to the Registry or to write to a given portion of the system's NTFS volume. Try logging on as the systems administrator; then, install the application.

Q: I installed Windows 2000 (Win2K) beta 3 under the assumption that it was an upgrade to Windows 98. I performed a clean installation to an NTFS drive. Win98 resides in the primary FAT32 drive. Win2K didn't perform well with my 32MB of RAM, so I decided to erase Win2K and format the drive back to FAT32. However, how do I remove Windows NT Boot Loader from my C drive and restore Win98's boot sector? Finally, how do I remove an entry from boot.ini?

A: I'm not surprised that you didn't like Win2K with 32MB of RAM. I've found that you need at least 64MB (preferably 96MB or more) and a fast Pentium II processor (400MHz or better) to get anything close to decent performance from a Win2K Professional (Win2K Pro) system.

You can remove Windows NT's Boot Loader by booting a Win98 boot disk that contains the Sys utility and running Sys C:. The contents of the boot.ini file in the system partition's root directory (i.e., C:) control Windows NT Boot Loader's choices. Once you remove the read-only attribute from this file, you can edit Windows NT Boot Loader's contents using any text editor. However, when editing boot.ini, be sure to keep the contents properly formatted, or you could render your system unstartable. Screen 1 (below) shows a sample boot.ini file. Microsoft provides several articles that describe the purpose and structure of the boot.ini file. I recommend the article "Purpose of the BOOT.INI File" at;en-us;99743&sd=tech.


Screen 1 Editing the boot.ini file

Q: I'm repeatedly receiving a Kernel not found error message during boot. The error renders my servers unrecoverable. I can't even get to the Windows NT Boot Loader screen. The problem forces me to reformat the disk and rebuild the server from scratch. I thought I might be experiencing a hardware failure, but the problem occurs across several servers. Any advice?

A: I suspect that something is altering the boot sector on your hard disk or perhaps another low-level disk structure. For example, you could attribute this event to software that has made low-level changes to the disk structure (i.e., disk-partitioning utilities). Another possibility is that a disk-defragmentation program is causing your problem. If you're running a defragmenter (or other disk utility that automates repairs or maintenance on hard disks), try updating the software or temporarily disabling it to see if the problem goes away. However, assuming you aren't running software that makes low-level changes, I suggest you perform a thorough virus scan on all your machines—with the latest virus signatures.

If your problem had occurred after the Windows NT Boot Loader screen appears, then you'd probably need to look for a different cause. In that case, the problem would probably relate to the boot.ini file and the fact that something caused the enumeration order of the adapter, drive, or relative partition number to change on your system. This situation also invalidates the ARC pathname of the line in boot.ini that loads Windows NT (e.g., multi(0)disk(0)rdisk(0)partition(1)\winnt), and causes a black-screen failure that typically references an ability to load a kernel file.

Q: Can you recommend a utility that examines and corrects a corrupted NTFS directory (e.g., a Norton Disk Doctor for NTFS)?

A: You can run Chkdsk, but you'll need to have an alternative method to access and run diagnostics on the volume. The best way to solve your problem is to use a utility such as Winternals' ERD Commander Professional Edition or simply move the disk into another system running Windows NT and run Chkdsk from there.

ERD Commander is helpful because it doesn't require you to move the disk. (Laptop hard disks with proprietary drive connectors are especially troublesome.) ERD Commander also lets you use a boot disk to run Chkdsk and perform other maintenance activities. Screen 2 (below) shows a sample ERD Commander session.

Another Winternals utility, Remote Recover, lets you run such diagnostics over the network. In addition to booting a special Windows NT command/recovery shell from disk, Remote Recover loads network drivers so that you can administer the machine from anywhere on the LAN/WAN.


Screen 2 Performing maintenance with ERD Commander

Editor's Note Sean Daily and John Green contributed answers to this Tricks & Traps. ABOUT THE AUTHOR

Bob Chronister is a contributing editor for Windows NT Magazine and president of Chronister Consultants in Mobile, Alabama. He is coauthor of Windows NT Backup and Recovery(Osborne/McGraw-Hill). You can reach him at

Send your tips and questions to Windows NT Magazine. You can also visit Bob Chronister's online Tricks & Traps at

The above article is courtesy of Windows NT Magazine. Click here to subscribe to Windows NT Magazine.

We at Microsoft Corporation hope that the information in this work is valuable to you. Your use of the information contained in this work, however, is at your sole risk. All information in this work is provided "as -is", without any warranty, whether express or implied, of its accuracy, completeness, fitness for a particular purpose, title or non-infringement, and none of the third-party products or information mentioned in the work are authored, recommended, supported or guaranteed by Microsoft Corporation. Microsoft Corporation shall not be liable for any damages you may sustain by using this information, whether direct, indirect, special, incidental or consequential, even if it has been advised of the possibility of such damages. All prices for products mentioned in this document are subject to change without notice.