The Mole #36: Technical Answers from Inside Microsoft - Pagefile, PDC Help, Character Limits, Duplicate IP, Group Copy
June 5, 2000
Editors Note The questions and answers below are from the Inside Microsoft column that appears regularly on the TechNet Web site at the following location: https://www.microsoft.com/technet/community/columns/insider/default.mspx. To find out how to submit questions of your own, see the end of this article or go to https://www.microsoft.com/technet/community/columns/insider/default.mspx.
The TechNet Mole provides expert answers from deep within Microsoft to questions from IT professionals. This installment focuses on these issues:
Return of Pagefile
Multi-purpose PDC Needs Help
Tech Wants More Characters
Duplicate IP Address is Annoying
Copying Groups from Machine to Machine
On This Page
Return of Pagefile
Multi-purpose PDC Needs Help
Tech Wants More Characters
Duplicate IP Address is Annoying
Copying Groups from Machine to Machine
Credits
Return of Pagefile
Mole,
I am having problems with configuring the pagefile for terminal server. Recently when a user was trying to use their e-mail, they received a message "out of virtual memory," even though I had configured the pagefile to the recommended size, any ideas as to what may have caused this?
When spreading the pagefile across all physical disks, does it matter if they are not all of equal size?
Pearson
Dear Pearson,
Mole is going to have to get out his stabbing stick to answer your letter. This is not to take a stab at you (Mole never resorts to physical aggression). No, Pearson, Mole's stabbing stick is what he uses to unearth possible causes of his reader's problem when he does not have enough information to construct a truly informed reply—like what version of NT you are running, the Event ID that was in the Event View. That said, Mole will take a stab at your problem nonetheless.
This sounds like the recommended pagefile size is just not big enough. Let's make sure we understand what "recommend" means. Mole's trusty Webster's Ninth New Collegiate Dictionary says it means "To present as worthy of acceptance or trial " (Mole emphasis added). The recommended pagefile size is just that – a starting point from which you determine whether the setting is appropriate for your system. Mole can't say something like "If you have 96 MB of memory, then you need to configure the pagefile to X MB." No way. Not even Mole can know what combination of applications or number of users will be accessing the server. Mole's Magic 8-Ball only gives the most vague answers, and then only to specific questions. For example, in response to the question "Should I make my pagefile size = to Memory + 12 MB?" Mole's Magic 8 Ball simply says "Outlook Not So Good."
Instead, you should monitor the size of the paging file(s) on the Terminal Server computer. To initiate the information capture, start Performance Monitor and chart object "Paging File," counter "% Usage Peak," and instance "_Total." Set the interval that PerfMon records data to something like 15 seconds so as to lessen the impact of taking this measurement on the server. This measurement displays the maximum percentage of the currently configured pagefile disk space that the pagefile has consumed during the Performance Monitor session. Observe this over a period of time on the Terminal Server.
If you have configured a pagefile for each disk, then you can monitor each individual pagefile usage in addition to the total. Do this by adding the "%Usage" counter and selecting the appropriate disk drive letter in the Instance drop-down.
So, what do you do with this information? If the Usage peak is approaching, say, 90 percent, that tells you that your paging file is probably sized about right. On the other paw, if it bumps up at near 100 percent, you probably need to increase the size of the paging file. Mole leaves no stone unturned, so here's a quick review of how the paging file is changed in NT 4.0: Start Control Panel, select the Performance tab, and in the Virtual memory section, click the "Change…" button. There you can specify the pagefile size in addition to creating a pagefile for each logical disk.
As to your question about "spreading the pagefile across all physical disks, does it matter if they are not all of equal size?" Mole's answer: It does not matter one whit.
A good source for information on the paging file is the Windows NT 4.0 Workstation Resource Kit, specifically Chapter 12 - Detecting Memory Bottlenecks.
Hope this helps, Mole
Multi-purpose PDC Needs Help
Dear Mole,
Our company has a PDC, which performs the following tasks:
Print server; about 25 network printers
fileservers; all our 150 employees log on and have their profiles/home
User directories, also their shared disk space.
Runs Jetform (print spooling)
Runs Arcserve (DLC backup)
Secondary WINS server
DHCP server
The machine is an IBM Netfinity 7000, with Token Ring adapter. Raid controller installed. The system has a Raid 1, 4 GB system disk and a 6*9Gb Raid 5 array. 256 MB memory. Dual Pentium Pro 200/512. This system is running Windows NT 4.0 Server SP3. The server needs maintenance. First it has to be upgraded to SP 4 or 5 and some old software leftovers have to be removed. So this is a normal cleanup. Here are my problems:
At rush hour the performance decreases. How is the chance the problem is the single NIC? You will ask me "What did the performance monitor tell you," my answer will be, it is an IBM, performance monitor will cause the system to crash (infamous blue screen, reboot). IBM has it's own Netfinity Manager, this will cause blue screen, reboot. I want to give you information, I try to get information and all that is happening is an angry mob after me. But considering the evidence, I'm almost convinced that the NIC is overcrowded.
Is it a known problem - Performance Monitor on an IBM Netfinity 7000, Win NT4.0 SP 3, PDC cause the system to crash?
I'm thinking of relocating the printers to a different server (including the jetform program) to give some space on the network part. Do you think this is a sound idea? What policy do you recommend concerning downtime. People will kill me if the server will be down for maintenance during business hours and I do not like it to work on weekends (I know I have to). Could you give me some advice to get the best of both?
Gijs Linssen, NT system manager, Lincoln Electric Europe
Greetings Gijs,
This specific problem (the Stop 0x9C) has been reported on a few different manufacturers' machines, one of which is the Netfinity 7000.
Here is Mole's first suggestion. The problem likely boils down to a hardware problem that is simply being reported by NT. The next time you experience a blue screen, document the STOP error code. If the error displayed starts with the address "0x0000009C," then read the Knowledge Base article, **162363:**Understanding and Troubleshooting the Stop 0x9C Screen for more information. This article also contains a reference to Intel's "Operating System Writer's Manual," which you can download in PDF format from Intel's web site. Mole dug up the manual's precise location and provides to you at no extra charge—Intel Pentium Pro Family Developer's Manual - Volume 3: Operating System Writer's Manualhttps://developer.intel.com/design/pro/MANUALS/242692.htm). If you need more technical manuals, go to "Intel's Pentium Pro Processors – Manuals" download page (https://developer.intel.com/design/pro/MANUALS/).
Mole's second suggestion is that you ask your IBM technical representative whether he or she knows of any problems in the scenario you describe. Mole can tell you that there haven't been any reports of fundamental problems with Netfinity computers running NT, and that includes running Performance Monitor.
Now, regarding your other questions.
Moving print services to another computer: Mole thinks this is probably a good idea. The new machine doesn't have to be a big powerful box, but serving 25 printers is no trivial task, either. A lot depends on the typical printing volume.
Downtime: Best to minimize the impact on users—that is clear. Mole understands your reluctance to spend your valuable weekends stuck in some stuffy server room. An alternative might be to migrate the printer to the new server in stages, say over a few days. Remember, in NT-talk, a printing device refers to the actual hardware device that produces printed output. A printer refers to the software interface between the application and printing device. Mole can't decide for you whether to come in over the weekend or stay after hours during the week just to move some printers…that is something that you need to decide.
Oh, and Gijs, upgrade to Service Pack 6a, please. You'll be glad you did.
Regards, Mole
Tech Wants More Characters
Hello,
We are setting up NT server 4.0 as a Primary Domain Controller for a domain "molecanhelp.co.za" (Note: the name has been changed to protect the innocent. –Mole). We cannot get NT to accept more than 15 characters in network properties and have tried editing the registry to no avail. It only accepts "molecanhelp.co." "Tech"
Dear Tech,
When life places limits in front of you, the Zen thing to do is to just know those limits have a purpose. In the case of the NetBIOS naming convention, it allows for only 16 characters. Microsoft, however, limits NetBIOS names to 15 characters and uses the 16th character as a NetBIOS suffix. Thus the NetBIOS suffix is the 16th character of the 16-character NetBIOS name. The NetBIOS suffix is used by Microsoft Networking software to identify functionality installed on the registered device.
Know that Mole cannot change his little universe; he can only explain its workings. For further enlightenment, read Knowledge Base article **163409:**NetBIOS Suffixes (16th Character of the NetBIOS Name).
Meditatively yours, Mole
Duplicate IP Address is Annoying
Dear Mole,
I have a duplicate IP in our network here but can only find one of the two twins (the correctly installed one). The other one seems to have no user logged in and be running all the time somewhere in our plant.
Is there a chance to remotely shut down this NT workstation just knowing the duplicate IP-address and presumably the MAC-address (which we found by sniffing some ARP-packets on the network)?
We just can ping the IP address, we cannot connect to the wrong PC with any other tools we know.
Eginhard Vornberger, Siemens AG
Well Eginhard,
While, despite mass missing information, Mole will suggest you do the following:
Using the TCP/IP utility NSLOOKUP, go to some machine connected to the network and running TCP/IP, get to a command prompt and enter the following:
Nslookup <tcp/ip address>
where <TCP/IP address> is the duplicate IP address of the machine you're trying to track down. The result of this query will include a line that begins with "Name:" the first part of the DNS name will be the computer's name.
Now, armed with the computer name, you can use the Windows NT utility SHUTDOWN to remotely shut down that machine. The shutdown utility is available in the Windows NT 4.0 Server Resource Kit, which you should have. If you don't have the ResKit for some reason, then you can obtain the SHUTDOWN utility at no charge from the MS Windows NT 4.0 Resource Kit Support Tools web site (https://www.microsoft.com/technet/prodtechnol/winntas/downloads/nt4sp4rk.mspx). This utility and many others are available on the MS Windows NT 4.0 Resource Kit, Supplement 4 Utilities.
Three more things:
This rogue machine could very well not be a computer running NT. After all, Mole seems to remember something about Unix machines being capable of running TCP/IP, too. If that turns out to be the case, SHUTDOWN won't help you.
Change the known machine's IP address.
Use WINS/DHCP.
Happy hunting, Mole
Copying Groups from Machine to Machine
Munificent Mole,
I've discovered your molehill musings! Might you marshal your multifarious mining methods to mitigate my morning's misery?
My current perplexity is over the quickest way of setting up a new NT4 SP4/IIS web server for a company intranet. We're outgrowing our existing (NT4 SP3/IIS) server's speed and capacity so we are upgrading the hardware. We have about 1,600 users configured in user manager, and each user has a directory with multiple user permissions settings (group related--e.g. if user A is part of parent group 1, that directory needs permissions set for User A and Parent Group 1).
Is it possible to transfer the User Manager data from one machine to the second and keep the ID, password, and other info intact? And is it possible to copy to the new system the directories and files while maintaining their security settings as configured on the 'old' server? Or am I (the non-ten-fingered-touch-typist) stuck with a month's work of manual reentry and recreating permissions?
A network guru friend mentioned scopy.exe as being a possibility, but didn't have any firsthand experience with it, and a search of the online MS knowledge base gave me an article on scopy as it related to 127954: "Keeping NTFS Security Intact When Moving a PO", not exactly enlightening to me regarding my NT/IIS issues; another techie mentioned cloning via manipulating these two machines as PDC/BDCs—but as I understand, that requires identical hardware (and SP versions?) on each box.
Magnificent Mole, is there a way to worm out of such a laborious manual recreation? It's not fun-and-games time, as my digits are degraded from dredging for 'de info' while fearing future finger fatigue...
Eugene, Sr. Web Guy
Also, Enrico Iozzi writes:
Dear Mole,
On my stand-alone Windows NT 4.0 Server, I have over 400 users! Now I want copy all users on the stand-alone server to a new PDC Server. It's possible? If Yes how? Enrico Iozzi
Dear IT Compadres,
Mole sympathizes. Mole, too, is typing challenged. He has to scamper back and forth across his keyboard, hunting and pawing. That is why he will keep his answer brief.
Enrico and Eugene, the answer to both questions is "Yes, it is possible." One command is already available to you from the NT system; another is available by a utility from the Windows NT 4.0 Server Resource Kit.
Eugene, you say that your users belong to specific groups. To copy or transfer Users from one machine to another, you can use the GRPCOPY tool. Here is a mini-blurb about this tool:
GRPCOPY allows users to copy user names from an existing group to another group, in the same domain or in another domain, or on a computer running Windows NT. To use Grpcpy, you must have at least account operator privileges in the affected domains.
Second question and answer: Your friend was on the right track by suggesting the SCOPY utility. However, SCOPY has been replaced with the XCOPY utility, which does the same thing. The XCOPY utility has been there for you all along—just go to a command prompt on an NT machine. To get a peek at the available switches for xcopy, type the following at the command prompt:
xcopy /?
XCOPY copies files and directories from NTFS partitions with their security intact. Other Resource Kit utilities you might find useful are:
Permcopy.exe: This command-line tool copies share-level permissions (ACLs) from one share to another.
ShowACLs: This command-line tool enumerates access rights for files, folders, and trees. ShowACLs works on NTFS partitions only. The most useful feature of ShowACLs is the ability to show permissions for a particular user.
Perms.exe: Perms displays a user's access permissions for a specified file or set of files. To use Perms, you need "Backup files and folders" privileges on the computer where the files are stored, and you must be logged on as a member of the Administrators group for the domain or computer where the user account is defined. Otherwise, "Access denied" errors may occur.
Mole hopes this helps.
Credits
Gratitude heaped upon Mr. Collins once again.