A+ Learn

220-232 220 - 232
Study Guide
A+
Operating System Technologies
Version 4
www.testking.com
-1-
220 - 232
TABLE OF CONTENTS
List of Tables
Introduction
1. Operating System Fundamentals

1.1 Operating System Basics
1.2 Major Types of Operating Systems

1.2.1 CP/M
1.2.2 MS-DOS
1.2.3 Microsoft Windows
1.2.4 Windows NT
1.2.5 OS/2
1.2.6 Linux
1.3 File Systems

1.3.1 The File Allocation Table (FAT) File System
1.3.2 The NT File System (NTFS)
2. MS-DOS
2.1 The MS-DOS Boot Sequence
2.2 The MS-DOS File System
2.3 MS-DOS Mode

2.3.1 Internal MS-DOS Commands
2.3.2 External MS-DOS Commands
2.3.3 MS-DOS Mode Navigation
2.3.4 Using MS-DOS Commands
2.3.4.1 The PATH Command
2.3.4.2 The EDIT Command
2.4 Working with Config.sys and Autoexec.bat

2.4.1 Config.sys Settings
2.4.2 Autoexec.bat Commands
3. Microsoft Windows
3.1 Windows Memory Utilization
3.1.1 Real Mode
3.1.2 Protected Mode
3.1.3 386 Enhanced Mode
www.testking.com
-2-
220 - 232
3.2 Resource Management
3.3 Beyond MS-DOS

3.3.1 Windows 9x
3.3.2 Windows NT
4. Installing Microsoft Windows

4.1 Preparing to Install Windows
4.1.1 Minimum System Requirements
4.1.2 Additional System Requirements
4.1.3 Boot Configurations
4.1.4 Upgrades and Clean Installs
4.1.5 Preparing the Hard Disk Drive and File System
4.2 Installing Windows 98

4.2.1 Running Setup
4.2.2 Windows 98 Setup Command-Line Switches
4.2.3 The Windows 98 Installation Process
4.2.3.1 Performing a Clean Install
4.2.3.2 Upgrading to Windows 98
4.2.4 Establishing Network Connections
4.2.5 Troubleshooting a Windows 98 Installation
4.3 Installing Windows 2000 Professional

4.3.1 Running Setup
4.3.1.1 Running Setup from the CD-ROM
4.3.1.2 Using Boot Disks
4.3.1.3 Running Setup from a Network Share
4.3.2 Windows 2000 Professional Setup Command-Line Switches
4.3.3 The Windows 2000 Professional Installation Process
4.3.3.2 Upgrading to Windows 2000 Professional
4.3.4 Additional Installation Tasks
4.3.5 Troubleshooting a Windows 2000 Professional Installation
5. Operating Windows 98
5.1 The Windows 98 Operating System Core Components
5.2 The Windows 98 Operating System Ancillary Systems
5.3 The Windows 98 Boot Process

5.3.1 The Normal Boot Process
5.3.1.1 The BIOS Initialization Process
5.3.1.2 Real-Mode Driver Loading Phase
5.3.1.3 Protected Mode Initialization Phase
5.3.2 Alternative Boot Processes
www.testking.com
-3-
220 - 232
5.3.2.1 The Windows 98 Startup Menu

5.3.2.2 The Windows 98 Startup Disk
6. Operating Windows 2000 Professional

6.1 The Kernel Mode
6.1.1 The Hardware Abstraction Layer (hal.dll)
6.1.2 The Windows 2000 Executive
6.1.3 The Kernel Mode Drivers
6.2 The User Mode

6.3.1 The Preboot Sequence
6.3.2 The Boot Sequence
7. Managing and Maintaining the Windows Operating System

7.1 The Windows System Registry
7.1.1 The Registry Root Keys
7.1.1.1 The HKEY_CLASSES_ROOT Root Key
7.1.1.2 The HKEY_CURRENT_USER Root Key
7.1.1.3 The HKEY_LOCAL_MACHINE Root Key
7.1.1.4 The HKEY_USERS Root Key
7.1.1.5 The HKEY_CURRENT_CONFIG Root Key
7.1.1.6 The HKEY_DYN_DATA Root Key
7.1.2 Managing the Registry
7.1.2.1 The Windows Control Panel
7.1.2.2 The Microsoft Management Console (MMC)
7.1.2.2.1 The Event Viewer Snap-In
7.1.2.2.2 The Disk Management Snap-In
7.1.2.3 The Registry Editors
7.1.2.4 Backing Up the Windows 98 Registry
7.2 Anti-Virus Protection
7.3 Disk Cleanup
7.4 Maintaining Drive Integrity
7.5 Hard Disk Fragmentation
7.6 File Backups

7.6.1 Developing a Backup Strategy
7.6.2 Backing Up the Registry and Critical System Files
7.7 Checking Critical System Files
www.testking.com
-4-
220 - 232
7.8 Creating Emergency Repair and Startup Disks
8. Troubleshooting Microsoft Windows

8.1 The Basic Windows Troubleshooting Approach
8.2 Performing Differential Diagnosis
8.3 The System Operational Cycle

8.3.1 Resolving System Startup Problems
8.3.2 Resolving Operational Phase Problems
8.3.2.1 Using the Computer Management Snap-In
8.3.2.2 Using the System Configuration Utility
8.3.2.3 Using the Device Manager
8.3.3 Resolving Shutdown Problems
8.3.3.1 The Windows 2000 Task Manager
8.3.3.2 The Windows 98 System and Resource Monitor
8.4 Troubleshooting and Recovering the Registry

8.4.1 Troubleshooting Windows 9x Registry
8.4.2 The Windows 2000 Recovery Console
8.5 Resolving MS-DOS Application Problems
8.6 Resolving Printing Problems
9. Practice Labs
9.1. Creating a MS-DOS Boot Disk
9.2 Creating a Windows 98 Startup Disk
9.3 Running ScanDisc to check for Hard Drive errors
www.testking.com
-5-
220 - 232
LIST OF TABLES
TABLE 2.1: Common File Extensions

TABLE 2.2: Some Common Internal MS-DOS Commands
TABLE 2.4: Config.sys Settings
TABLE 2.5: Autoexec.bat Commands
TABLE 4.1: Minimum System Requirements for Windows
TABLE 4.2: Windows 98 Setup Command-line Switches
TABLE 4.3: Winnt32.exe Command-Line Switches
TABLE 4.4: Winnt.exe Command-Line Switches
TABLE 4.5: Windows 2000 Professional Upgrade Paths
TABLE 5.1: The Msdos.sys [Paths] Section Entries
TABLE 5.2: The Msdos.sys [Options] Section Entries
TABLE 5.3: The Win.com Command-Line Switches
TABLE 5.4: Common Windows 98 Startup Menu Options
TABLE 6.1: Files Used in the Windows 2000 Boot Process
TABLE 7.1: The Regedit.exe Command-Line Switches
TABLE 8.1: Windows Troubleshooting Tools
TABLE 8.2: Some Recovery Console commands Zone Types
www.testking.com
-6-
220 - 232
A+ Operating System Technologies

Exam Code: 220-222
Certifications:
A+ Core
Prerequisites:
None
About This Study Guide

This TestKing Study Guide is based on the current pool of exam questions for the 220-222 – Operating
Systems Technologies exam. As such it provides all the information required to pass the CompTIA A+ 220-
222 exam and is organized around the specific skills that are tested in that exam. Thus, the information
contained in this Study Guide is specific to the 220-222 exam and does not represent a complete reference
work on the subject of Operating Systems. It includes only information about operating systems that pertain
to the CompTIA 22-222 A+ exams, i.e., operating systems available for Intel based computer systems. This
StudyGuide also includes the information required to answer questions related to the installing computer
components and maintaining computers that may be asked during the exam. Topics covered in this Study
Guide includes Identifying the Operating System’s functions, structure, components, and major system files,
including io.sys, boot.ini, win.com, msdos.sys, autoexec.bat, config.sys; Identifying differences between
Windows 9x and Windows 2000; Understanding memory management, including conventional memory,
extended/upper memory, high memory, virtual memory, himem.sys, and emm86.exe; Understanding
command prompt procedures and syntax, including dir, attrib, ver, mem, scandisk, defrag, edit, xcopy,
copy, format, fdisk, mscdex, setver, and scanreg; Identifying basic concepts and procedures for creating,
viewing and managing files, directories and disks; Understanding file naming conventions; Identifying
common file extensions; Understanding file systems, including FAT, FAT32, NTFS, and NTFS5;
Understanding the Windows Registry; Using disk utilities including fdisk, and scandisk; Identifying the
procedures for installing Windows 9x, and Windows 2000; Identifying the steps to perform an operating
system upgrade; Identifying the basic system boot sequences and boot methods; creating an emergency boot
disk with utilities installed for Windows 9x, Windows NT, and Windows 2000; Identifying boot options,
including Safe Mode and MS-DOS mode; Identifying procedures for loading/adding and configuring
application device drivers; Recognizing and interpreting the common error codes and startup messages from
the boot sequence; Identifying the networking capabilities of Windows; and Identifying concepts and
capabilities relating to the Internet and basic procedures for setting up a system for Internet access.
Intended Audience
This Study Guide is targeted specifically at people who wish to take the CompTIA A+ 220-222 – Operating
Systems Technologies exam. This information in this Study Guide is specific to the exam. It is not a
complete reference work. Although our Study Guides are aimed at new comers to the world of IT, the
concepts dealt with in this Study Guide are complex. Knowledge of the MCSA / MCSE exams: 070-210 –
Installing, Configuring, and Administering Microsoft Windows 2000, 070-98 – Implementing and
www.testking.com
-7-
220 - 232
Supporting Microsoft Windows 98, as well as the CompTIA exam: 220-221 – A+ Core Hardware Service
Technician course would be advantageous.
Note: There is a fair amount of overlap between this StudyGuide and the
TestKing 220-221 StudyGuide. We would not advise skimming over the
information that seems familiar. Instead, read over it again to refresh your
memory.
How To Use This Study Guide

To benefit from this Study Guide we recommend that you:
• Although there is some overlap between this StudyGuide, the TestKing 220-221 – A+ Core Hardware
Service Technician StudyGuide, and the TestKing 070-210 – Installing, Configuring, and Administering
Microsoft Windows 2000 Professional StudyGuide, the relevant information from the TestKing 220-221
and 070-210 StudyGuides are included in this StudyGuide. This is thus the only StudyGuide you will
require to pass the CompTIA 220-222 exam.
• Study each chapter carefully until you fully understand the information. This will require regular and
disciplined work. Where possible, attempt to implement the information in a lab setup.
• Perform all labs that are included in this Study Guide to gain practical experience, referring back to the
text so that you understand the information better. Remember, it is easier to understand how tasks are
performed by practicing those tasks rather than trying to memorize each step.
• Be sure that you have studied and understand the entire Study Guide before you take the exam.
Note: Remember to pay special attention to these note boxes as they contain
important additional information that is specific to the exam.
Good luck!
www.testking.com
-8-
220 - 232
1. Operating System Fundamentals

As recently as the 1970s most computer machines were bulky, i.e., room-sized, slow and used punch cards
as a primary data input tool. In addition, anyone wanting to use a computer had to navigate a complex,
uninviting interface with only a keyboard to help them. As computer technology has evolved towards the
modern personal computer, it became smaller, more powerful and popular for home and business use. The
ever improving operating systems that are use to interact with these computer is one of the key reasons for
the acceleration of computer usage over the last decade. Computers require programmed code, called
software programs to run, and they require an input-output mechanism to allow users to give the machine
instructions and view the results of those commands. As computer hardware has improved, software has
improved with it.
1.1 Operating System Basics

All the time a user spends working on a computer his or her work is supported by the operating system.
Without the support of the operating system, the user would not be able to use any other software programs.
All operating systems share certain basic components and features.
• An important part of the operating system is the user interface, which allows the user to interact with the
computer by inputting commands or information. A Graphical User Interface (GUI) allows the user to
interact with the computer without having to learn complicated command control methods. The various
versions of Microsoft’s Windows operating systems are examples of GUI enable operating systems and
makes use of mouse and keyboard input, drop-down menus, and scrolling content areas. The majority of
Windows-based programs share many of the same commands for functions like adding and moving text
and printing, opening, and saving files. This common approach saves time and effort, allowing both
programmers and end users to concentrate on the task at hand rather than typing commands.
• The operating system is responsible for creating and maintaining files, placing them on storage media,
ensuring their integrity, reorganizing and erasing them as needed.
• The operating system also interacts with the hardware components but requires drivers and command
sequences to achieve this. It controls all of the hardware and its functions, tracking the status of
communications ports, printer ports, and remote devices; providing memory management; interacting
with any TSR (terminate-and-stay-resident) programs; and maintaining the integrity of its own operation.
• Most operating systems are loaded as software. They must include boot sequence code that can be
accessed during system startup so that they can be loaded into memory and made functional when the
computer is turned on. They must also have installation routines as well as troubleshooting and recovery
techniques for reinstallation in the event components become corrupted during use.
• Problems ranging from severe damage to simple user error can cause a system to become unstable. A
well-designed operating system will be able to detect such problems, display error messages to alert the
user, and provide the ability to recover without significant loss of data or corruption of the operating
system.
• A complete operating system should also include software routines for defragmenting hard drives,
scanning for viruses, and performing other tasks that keep the system performing optimally; as well as
support for networking protocols.
Thus, the operating system is the center through which the hardware components, software applications, and
the end user interact.
www.testking.com
-9-
220 - 232
1.2 Major Types of Operating Systems

There are a number of available operating systems on the market. These include UNIX, different versions of
Linux, OS/2, MacOS, CP/M, MS-DOS, and different versions of Windows. Some of these operating
systems are obsolete.
Note: The A+ exam focuses only on operating system options available for Intel based
computer systems used in the corporate world. Intel/Windows based computer systems
dominate the corporate market.
1.2.1CP/M
The Control Program for Microcomputer (CP/M) is an operating system that was not in use on modern
PCs. Gary Kildall wrote this operating system in 1973, using his PL/M programming language. It initially
ran on the Intel 8008. It was later ported to the 8080 chip and was, in many ways, very similar in function to
MS-DOS. By 1981, when IBM decided to begin marketing their line of PC computers, they decided to
license an operating system rather than develop and support their own operating system. At the time CP/M
was the industry standard for low-cost computers on the Intel platform. However, IBM awarded the
operating system license to Bill Gates’ fledgling company, Microsoft.
1.2.2 MS-DOS
In the 1980s or early 1990s, the operating system that shipped with most PCs was MS-DOS, a version of the
Disk Operating System (MS-DOS) created by Microsoft.
In November 1981, IBM announced the IBM 5150 PC Personal Computer. The 5150 had a 4.77MHz Intel
8088 CPU, 64KB RAM, 40KB ROM, one 5.25-inch floppy drive, color graphics capability, and an
operating system called PC-DOS 1.0, which was actually MS-DOS that IBM had under license. However,
Microsoft had contracted to allow IBM to use their operating system, rather than allowing IBM to buy it
outright. Moreover, IBM had not been granted any type of exclusivity over MS-DOS, hence Microsoft was
also able to license versions of MS-DOS to other companies, allowing the creation of what were originally
called “IBM clone” machines. These machines ran on the same Intel chip as the IBM PC and used a similar
version of the operating system.
• The original version of Microsoft DOS, MS-DOS 1, was introduced in August 1981. It had no
provisions for networking, did not include any sort of graphical shell program, and had limited ability to
manage system resources. It also did not support internal hard disk drives as the IBM 5150 PC did not
have an internal hard drive. In May 1982, MS-DOS 1.1, a revision was introduced. This added support
for double-sided 320KB floppy drives. Double-sided disks were important, as they effectively doubled
the computer’s storage and retrieval capacity.
• In March 1983, IBM introduced the IBM PC XT. The XT featured a 10MB hard drive, a serial interface,
and three additional expansion slots. It also had 128KB of RAM and a 360KB floppy drive. The MS-
DOS 2 allowed users to take advantage of this new hardware.
• With MS-DOS 3.0, introduced in August 1984, Microsoft continued to include additional MS-DOS
features and to support more powerful hardware. MS-DOS 3.0 supported hard drives larger than 10MB,
as well as enhanced graphics formats. The IBM PC AT was the first machine shipped with MS-DOS 3.
www.testking.com
- 10 -
220 - 232
It had 256KB of RAM, an Intel 80286 processor (6 MHz!), and a 1.2MB 5.25-inch floppy drive. A
20MB hard drive and color video card were also available.
MS-DOS 3.1 was introduced in March 1985 and was the first version of MS-DOS to support
networking.
MS-DOS 3.2 was introduced in January 1996 and introduced the xcopy.exe command, enabling
the user to identify more than one file at a time to be copied, and it made important modifications
to other MS-DOS commands. It was also the first version to support IBM’s Token Ring network
topology and the first to allow for 720KB 3.5-inch floppies.
MS-DOS 3.3 was introduced in April 1987. It offered additional enhancements to numerous
existing commands and introduced support for 1.44MB floppy disks. Logical partition sizes
could be up to 32MB, and a single machine could support both a primary and a secondary
partition on each disk.
• Following the launch of the Apple Macintosh computer with a graphical user interface in 1984, it was
apparent that the future of the operating system was the graphical interface. MS-DOS 4, introduced in
February 1988, provided users with the MS-DOS Shell, a utility much like the Windows File Manager,
and supported a mouse. It also added support for hard disks greater than 32 MB, the mem.exe command.
• MS-DOS 5.0 was introduced in May 1991 and had several important features. It had the ability to load
drivers into upper memory which is also called reserved memory. This allowed more complex MS-DOS
programs that took up more conventional memory to be developed. In addition to this feature, several
software utilities were introduced. The most commonly used utility introduced at this time was edit.com,
which was an ASCII text editor. Other utilities added in MS-DOS 5 were qbasic.exe, doskey.com,
unformat.com, and undelete.exe.
• MS-DOS 6.0, introduced in March 1993, offered a number of new commands and configurable options,
including memmaker.exe, which was used to modify the config.sys and autoexec.bat files so that device
drivers and memory-resident programs could take up less conventional memory space, and emm386.exe,
which allowed the computer system to pool extended and expanded memory. It also included Windows
Unformat and Undelete, virus protection, and backup.
MS-DOS 6.2, which included ScanDisk, Microsoft Diagnostics (MSD) utilities, and enhanced
diagnostics, was introduced in October 1993.
MS-DOS 6.22 was introduced in 1994April and is the most current MS-DOS version available as
a stand-alone operating system.
• The following version of MS-DOS, MS-DOS 7.0 marked the end of MS-DOS as a stand-alone operating
system. It was introduced in December 1995 as an integral part of Windows 95 and is used within
Windows 95, and subsequent versions of Windows, to support MS-DOS command line utilities.
1.2.3 Microsoft Windows

The success of MS-DOS after 1987 was largely due to the arrival of Windows. In the early years of its
existence, Microsoft’s MS-DOS gained great acceptance and became a standard as a PC operating system.
As computers became more powerful and programs more complex, the limitations of the MS-DOS
command-line interface were becoming apparent. The solution to the problem was to make the operating
system easier to navigate, more uniform, and generally more “friendly” to the user. Microsoft developed a
graphical user interface (GUI) based on groundbreaking work done by Xerox labs which it named Windows,
releasing the first version in 1985.
www.testking.com
- 11 -
220 - 232
The Windows interface to MS-DOS is really just a shell program that allows users to issue MS-DOS
commands through a graphical interface. The integration of a mouse for nearly all tasks further freed users
from MS-DOS by allowing them to issue common commands without using the keyboard.
After the development of Windows, many of the enhancements made to subsequent versions of MS-DOS
were designed to help free up and reallocate resources to better run Windows and Windows-based
applications. Similarly, PC hardware continued to evolve far past the limits of MS-DOS’s ability to
effectively use the power available to it, and later versions of Windows would be designed to overcome the
limitations of the operating system.
• The first version of Windows featured the tiling windows, mouse support, and menu systems that is still
present in next-generation operating systems such as Windows 98, Windows CE, and Windows 2000. It
also offered “cooperative multitasking”, allowing more than one Windows application to run
concurrently. Windows 1 however did not use icons and was basically just an updated, more graphical
version of the MS-DOS shell.exe program.
• Icons were introduced in Windows 2, which was released in 1987 and allowed application windows to
cascade, i.e., to overlap each other, as well as tile. Support was also added for PIFs (program information
files), which allowed the user to configure Windows to run their MS-DOS applications more efficiently.
• Windows 3.0 featured a far more flexible memory model, allowing it to access more memory than the
640KB limit normally imposed by MS-DOS. It also featured the addition of the File Manager and
Program Manager, allowed for network support, and could operate in “386 Enhanced mode.” 386
Enhanced mode used parts of the hard drive as “virtual memory” and was therefore able to use disk
memory to supplement the RAM in the machine. Windows today, in fact, is still quite similar to the
Windows of version 3.0.
In 1992, a revision of Windows 3, known as Windows 3.1, provided for better graphical display
capability and multimedia support. It also improved the Windows error-protection system and let
applications work together more easily through the use of object linking and embedding (OLE).
After the introduction of version 3.1 Microsoft started to change to a full 32-bit application
environment.
With Windows 3.11, also known as Windows for Workgroups, Windows could offer support for
both 16-bit and 32-bit applications. Significant progress on the 32-bit front was not to be made,
however, until very late in 1995, when Microsoft introduced Windows 95.
• The constraints of MS-DOS made it difficult for the Windows operating system take full advantage of
rapidly improving hardware and software developments. The future of operating systems was a 32-bit,
preemptively multitasked system such as IBM’s OS/2, but many current users had MS-DOS-based
software or older hardware that was specifically designed for MS-DOS and would not operate outside of
its Windows 3.x, cooperatively multitasked environment. Because of this problem, in the fall of 1995
Microsoft released a major upgrade to the MS-DOS/Windows Legacy Devices
environment. Called Windows 95, the new product integrated
Legacy devices are expansion cards and
the operating system and the shell. Windows 95 was designed peripheral devices that do not support the
to be a hybrid of the features of previous MS-DOS versions Plug-and-Play (PnP) standard. Such
and newer 32-bit systems. To this end, it is a preemptively devices are not able to dynamically interact
multitasked system that is able to emulate and support with newer systems. They therefore require
cooperative multitasking for programs that require it. It also manual configuration or must be replaced
by newer devices, which usually do not
supports both 32-bit and 16-bit drivers as well as MS-DOS need manual configuration. Most pre-1995
drivers. Windows 95 also had support for the Plug-and-Play computer components were not PnP
standard (PnP). This meant that if a device was designed to be compliant and often interfered with the
plug-and-play, a technician could install the device into the Plug-and-Play environment.
www.testking.com
- 12 -
220 - 232
computer, start the machine, and have the device automatically recognized and configured by Windows
95. This was a major advance, but unfortunately for Plug and Play to work properly,
The operating system had to be PnP compatible;
The computer motherboard had to support PnP; and
All devices in the machine had to be PnP compatible.
All subsequent versions of Windows use an interface essentially identical to the Windows 95 GUI.
• Three years after the release of Windows 95, Microsoft introduced Windows 98. This version of
Windows was the first to really take advantage of Plug-and-Play technology. Hardware meeting the
Plug-and-Play requirements is automatically detected and configured by the operating system after
installation. It added internal support for new hardware standards including Universal Serial Bus (USB)
and IEEE 1394 (FireWire); introduced a new generation of support tools, including tasks scheduler; and
had a closely integrated Internet browser with the operating system.
• In the third quarter of 2000 Microsoft introduced Windows Millennium Edition (Windows ME).
Windows ME is closely linked with the Internet, allowing users to have the system automatically
updated over the Internet via the Microsoft Web site. Windows ME also has a System Restore feature
which makes it easy to undo configuration changes and return a computer to the state it was in before the
update. It also simplified local area networking (LAN) with increased use of setup wizards for devices
like printers and scanners that can be shared.
1.2.4 Windows NT
The Windows NT operating system was designed for use in corporate networks and is far more powerful
than any previous version of Windows. It uses an architecture based entirely on 32-bit code and is capable of
accessing up to four gigabytes of RAM. Windows NT can support huge drive sizes and multiple processors,
and has numerous advantages over Windows 95 and MS-DOS. There are two editions of Windows NT each
intended for a particular role in a network environment. These are Windows NT Workstation and Windows
NT Server. Windows NT Server is able to carry out numerous tasks for organizing and managing networked
computers while Windows NT Workstation, is intended for users who work with large files or complex
programs.
Windows NT also allows for better security than previous versions of Windows and is more stable.
• Windows NT 3.x was first introduced in 1993, under the title of Windows NT 3.1.
Windows NT 3.1 was a reworking of the LAN Manager software that Microsoft had developed
as part of its aborted OS/2 partnership with IBM. The first release of Windows NT had the
familiar 3.1 version number to stay in line with the rest of the Windows 3.x family. It also used
the same Windows 3.x Program Manager GUI.
When Windows NT 3.51 was introduced in the fall of 1995, it featured a number of
improvements, such as a fully 32-bit operating system, improved security, support for more
RAM, support for multiple processors, and support for mixed networks of Windows NT and
Novel Netware servers.
• Windows NT 4.0 was introduced in 1996 and sported the popular Windows 95 GUI. Windows NT 4.0
was positioned directly against IBM’s OS/2 Warp and soon captured most of the power user market.
However, Windows NT 4.0 lacked plug-and-play capabilities. Windows NT 4.0 has regularly been
updated by means of service packs. The last service pack for Windows NT 4.0 was service pack 6 (SP6)
and a Windows NT 4.0 with SP6 installed is referred to as Windows NT 4.0 (SP6). Windows NT 4.0
consists of 2 editions:
www.testking.com
- 13 -
220 - 232
Windows NT 4.0 Workstation, which is the desktop version of Windows NT 4.0 and is
designed for a single user.
Windows NT 4.0 Server, which is a server platform designed for robust networking.
• Windows 2000 succeeded Windows NT and was introduced in 2000. It offered extended multiprocessor
support, improved security features and advanced administration tools. It also supports the Plug-and-Play
standard and consists of 4 editions:
Windows 2000 Professional, which replaces Windows NT 4.0 Workstation and is designed for a
single user.
Windows 2000 Server, which is the entry-level server platform, replacing Windows NT 4.0
Server.
Windows 2000 Advanced Server, which is a more powerful server platform, providing support
for up to eight CPUs and up to 8 GB of RAM.
Windows 2000 Datacenter Server, which is the most advanced Windows 2000 server platform
and is designed for large data warehouses, advanced scientific and engineering applications, and
large-scale Web farms.
1.2.5 OS/2
While Windows 3.1 was in development, Microsoft was participating in a joint effort with IBM to create a
next-generation operating system for use with 286 and higher processors. This operating system was to be
IBM/Microsoft’s second generation operating system, or OS/2, intended to replace MS-DOS. Differing
goals for the design of the new system caused a number of disagreements, though, and the partnership soon
broke up. IBM continued the development of OS/2 on their own, while Microsoft took their part of the
technology and began to develop LAN Manager, which would eventually lead to the development of
Windows NT.
• IBM made OS/2 a 32-bit system that required at least a 386 processor to run. Although this made it
vastly more stable and powerful than Windows 3.1, both it and Microsoft’s NT product had a problem
finding a market.
• With version 3 (OS/2 Warp), IBM created a multitasking, 32-bit operating system that required a 386
but preferred a 486. Warp also required a ridiculous 4MB of RAM just to load. With a graphical
interface and the ability to do a great deal of self-configuration, the Warp operating system was a
peculiar cross between MS-DOS and a Macintosh. Warp featured true pre-emptive multitasking, did not
suffer from the memory limitations of MS-DOS, and had a desktop similar to the Macintosh.
For all of its tremendous features, OS/2 never really established a wide user base. Nonetheless, until
Windows NT 3.51 was released in 1995, OS/2 was the operating system of choice for high-end
workstations. At the turn of the millennium, IBM abandoned the high-end desktop market to Windows
NT, Windows 2000, and Linux. OS/2, and ships Windows 2000 Professional with its own desktops.
1.2.6 LINUX
Linux is a Unix-type operating system that has been released into the public domain and is being developed
as an “open-source” operating system standard. Linux it is making inroads with knowledgeable home users
and is even being used as a server in many corporate environments and is thus positioned as an alternative to
www.testking.com
- 14 -
220 - 232
the Microsoft dominance of the operating system market but it has not yet found sufficient support from
software application developers to be a viable alternative.
The architecture of Linux is based on UNIX, the operating system used in mainframes and other high-end
computers, and it is extremely powerful and stable. Linux also is
commonly used as a Web server or e-mail server on the Internet, Open Source Software
and can function as either a network operating system or a desktop The theory behind “open source” software
operating system. is to make the core program code available
to anyone who wants it, so that the code can
then be explored and enhanced by the
The early distributions of Linux were complex to install and had users. Linux is an example of open source
little application support. software. Users can modify the Linux
source code as they see fit, and release it to
the world as a Linux “distribution”.
Distributions are similar to versions, but
1.3 File Systems
where as versions are chronological
One of the most important roles of an operating system is to enhancements to a single company’s
define and manage the file system. The file system is a component operating system, distributions are
of the operating system that acts as an interface with hardware variations on a single operating system. For
storage devices, and organizes data on them in a form that can be a list of Linux distributions, refer to
www.linux.org/dist/english.html.
used by the computer system and by the applications. The file
system defines the file naming conventions, file size, and, in some cases, the capacities of the storage
products themselves. The modern computer can have several different file systems as different types of
storage media often require different types of formatting or translation. CD-ROM devices, DVD devices and
Zip drives are, for example, manufactured with a specific file system already in place on them. Magnetic
media like floppy drives and hard disks employ several different types of file systems, depending on the
operating system on the target computer. The various versions of the Microsoft Windows NT family of
operating systems, i.e., Windows NT 3.11, Windows NT 3.11, Windows NT 3.11, Windows 2000, Windows
XP and Windows.net offers the use of two file systems. These are: FAT-based file systems and the NTFS
file system.
1.3.1 The File Allocation Table (FAT) File Systems

All modern computers can use a FAT-based file system. This is a very simple form of file system that
organizes files by listing them in a table, hence the name File Allocation Table (FAT). The FAT file system
was originally developed for use on floppy disks, and all versions of Windows still support FAT for that
purpose. The FAT-based file systems are compatibility with a wide range of operating systems including all
versions of Microsoft Windows, OS/2, and many versions of UNIX.
There are three versions of the FAT file system; based on the number of bits required for a single FAT entry.
The version used on floppy drives is known as FAT12 which uses a 12-bit table; FAT16 was introduced
with MS-DOS 3.0 to enable support for large drives; and FAT32, which supports long filenames, is the
preferred file system for Windows 9x.
• FAT16 has a small system footprint and thus offers performance advantages on volume smaller than 250
MB. All files on a FAT16 hard disk drive can be accessed when the computer is booted with a MS-DOS
bootable floppy disk. It supports a hard drive partition size of up to 2 GB. FAT16 also limits the length
of file names to the 8.3 convention of an eight-character name with a three-character extension and no
spaces.
• FAT32 offers several enhancements over FAT16 but limits compatibility with other operating systems
to Windows 95 OSR2 (Operating System Release 2) and Windows 98. The enhancements it offers over
www.testking.com
- 15 -
220 - 232
FAT16 includes: more efficient allocation of hard disk space, allowing the computer system to make
more efficient use of the hard disk space, thus allowing the storing of much more data; can automatically
employ a backup copy of a volume’s FAT if the master copy becomes corrupt; provides automatic
backup of the boot sector, making it possible to recover the volume in the event of a boot sector failure;
supports hard disk drives of up to 2 terabytes (TB) in size; with support for partition volume sizes of 32
GB; and supports long filenames of up to 255 characters with the ability to use spaces.
FAT16 volumes can be converted to FAT32 by using the Drive Converter Wizard. However, this
conversion cannot be undone. Furthermore, neither FAT16 nor FAT32 provides built-in security or data
compression methods as FAT was developed without any consideration for multiple users on the computer.
Hence, you cannot lock a file to prevent access to it by anyone who has access to the system. Instead of
passwords and locked files and directories, FAT offers a set of attributes that provide a method to prevent
the overwriting of files; to hide files from being displayed in regular directory listings; and to denote if a file
has been backed up.
In MS-DOS mode, you can set file attributes using the ATTRIB command. In Windows, you can set file
attributes by right-clicking the file and choosing the Properties option from the popup menu. The syntax for
the ATTRIB command in MS-DOS mode is indicated below in Figure 1.1
FIG. 1.1: The ATTRIB Command
1.3.2 The NT File System (NTFS)

Microsoft introduced the NTFS (NT file system) with Windows NT. It supports long filenames with spaces
and is optimized for multiuser environments. It also provides an extra level of file security, and is more
reliable than previous file systems. The latest version of the NTFS is NTFS5, introduced with Windows
2000. There are some minor incompatibilities between NTFS5 and earlier NTFS versions due to the changes
needed to allow for improved features. As a result, not all file system operations available in the Windows
2000 version of NTFS can be used when accessed by systems running Windows NT.
www.testking.com
- 16 -
220 - 232
The NTFS has a number of advantages and disadvantages. It can support volumes of up to 2 TB in size;
maintains a log that can be used to recover and repair a volume’s content in the event of a system failure;
employs a B-tree file structure resulting in faster file access; supports advanced compression, allowing users
to compact individual files and folders and access them while they are in a compressed state; and supports
disk quotas which a system administrator can use to limit the amount of hard disk space an individual user
can save data to. NTFS volumes are, however, not directly accessible under MS-DOS and Windows 9x;
cannot be used as a primary partition for dual boot system configurations with MS-DOS and/or Windows 9x;
and is not appropriate for volumes smaller than 400 MB in size as the additional overhead required for
NTFS features may result in slower performance than under a FAT file system. It also supports file and
folder level security, which is implemented by means of permissions. Permissions are set by right-clicking
on the file or folder that is to be secured and choosing the appropriate options from the popup menu. Once
set, the permissions apply to both local users and anyone accessing the system over the network.
There are six NTFS permissions:

• Read, which allows the specified users and user groups to view the files and subfolders in the folder and
view folder ownership, permissions, and attributes.
• Write, which allows the specified users and user groups to create new files and subfolders within the
folder, change folder attributes, and view folder ownership and permissions.
• List Folder Contents, which allows the specified users and user groups to see the names of files and
subfolders in the folder.
• Read & Execute, which allows the specified users and user groups to browse through folders to reach
other files and folders, even if the users do not have permission for those folders. It also allows the user
to perform actions permitted by the Read permission and the List Folder Contents permission.
• Modify, which allows the specified users and user groups to delete the folder and perform actions
permitted by the Write permission and the Read & Execute permission.
• Full Control, which allows the specified users and user groups to change permissions, take ownership,
and delete subfolders and files. It also allows the user to perform actions permitted by all other NTFS
folder permissions.
• Deny, which denies a specified users and user groups all access to a folder. This permission overrides all
other permissions that the user or user group may have.
www.testking.com
- 17 -
220 - 232
2. MS-DOS and MS-DOS Mode

Microsoft Windows are advanced operating systems that build on more than two decades of operating
system development, beginning with MS-DOS. Many concepts and conventions used in Windows stem
from its MS-DOS predecessor. Furthermore, several diagnostic routines, including installing a new
operating system, formatting a new hard drive, checking for low-level hardware problems, and repairing
damage from viruses require knowledge of user command prompt interaction.
All versions of MS-DOS were built for specific CPUs and computers: MS-DOS 1.0 was designed for the
original IBM PC. Those computers had either one or two floppy drives and had a port for a cassette drive in
the back, but did not have support for internal hard drives. As the Intel CPUs increased in power and as the
computer became a more advanced, MS-DOS was updated to take advantage of the new features and
capabilities but could not effectively overcome some critical limitations such as its lack of native networking
support and its memory limitations.
The command prompt was the MS-DOS user interface for those who did not use Windows and involved
typing an appropriate command following the C prompt (C:\>) in the proper syntax and pressing the Enter
button on the keyboard. Using this prompt is still a fundamental requirement in setting up a new computer
system or hard disk drive.
2.1 The MS-DOS Boot Sequence

MS-DOS requires three files to boot to a hard disk drive or floppy disk and to load the operating system into
memory. These files are:
• io.sys, which is the interface between the hardware and the operating system code. This is the lowest
interface layer, acting as an intermediary between the various hardware components and the software
environment.
• msdos.sys, which is the main operating system code. This is the middle layer and only provides both key
logic and basic commands for opening and closing files, navigating the file system, and other common
tasks performed by the software
• command.com, which is the interface between the user and the operating system code. This is the
highest interface layer and provides support for the operating system's direct interaction with the user,
accepting commands and performing the necessary steps for execution
These three files would make the operating system operational, however, the computers has an open
architecture. This means that no two computers have to be exactly alike as different computer manufacturers
can include different hardware components, while the user can upgrade the computer and its components.
The operating system must be able to support these variations in hardware levels. The operating system
requires custom device drivers and memory configurations to achieve this. MS-DOS used two startup files
for this purpose. These were:
• config.sys, which loads the hardware and device drivers that are not built into io.sys; and
• autoexec.bat, which loads TSR programs specified by the end user and sets up environment variables
such as the TEMP directory and PATH locations
The Windows operating system uses a similar boot process and some versions can also use the autoexec.bat
and config.sys files.
www.testking.com
- 18 -
220 - 232
When a DOS based computer is booted, the power on self test (POST) is performed. The POST routines
include instructions that locate and invoke the operating system by checking for the io.sys and msdos.sys.
The operating system processes the config.sys file, which contains information to configure the system
environment, including special memory management overlays and hardware drivers. Command.com is then
loaded. Thereafter the operating system processes the autoexec.bat file, which loads programs and user-
defined settings. If no programs, such as Windows, are invoked by autoexec.bat, command.com presents
prompt and waits for a command.
2.2 The MS-DOS File System

In MS-DOS, the file was the primary unit of data storage on the computer. It allowed the system to
distinguish a single collection of information from another. Files were organized into directories. File and
directory names were up to eight characters long, were not case-sensitive and could have a three-letter
extension following a period. Several file extensions were universally used. These naming extensions have
been carried over into the Windows environment. Table 2.1 discusses a list of common file extensions.
TABLE 2.1: Common File Extensions

Extension Description
.exe Files with this extension are the executable file of programs or applications.
.com Files with this extension are the command files of programs or
applications.
.sys Files with this extension are system files that are used to define and
configure options.
.bat Files with this extension are batch files. These are text files that can be run
to execute a series of commands or launch programs.
.txt Files with this extension are text files consisting of plain ASCII data.
.doc Files with this extension are document files created with word processors
and include file text with formatting.
.drv Files with this extension are driver files that are used to configure hardware
devices.
2.3 MS-DOS Mode

The latest versions of the Windows operating system still incorporate a limited version of MS-DOS, which
can run within a window. MS-DOS mode does not require 32-bit drivers and high memory management.
This makes it ideal for troubleshooting purposes.
The command.com file contains the code that provides the user
interface in MS-DOS. Thus, by running command.com under Directories
Windows, you open up a MS-DOS session. You can do that by In MS-DOS and the versions of Windows
clicking on the START button, selecting RUN from the start that preceded Windows 95, a folder was
menu, and typing COMMAND. To use a command prompt interface called a directory and the command DIR
was used to display the files and
you type a MS-DOS command, such as MEM or FORMAT, at the subdirectories of the current directory, i.e.,
DOS prompt and press the ENTER button on the keyboard. The the directory that the path preceding the
operating system then loads and executes the command, and then prompt points to.
www.testking.com
- 19 -
220 - 232
displays the information on the screen. You can generally use the /? switch for help when unsure of how to
use a MS-DOS command, alternatively you can use the MS-DOS HELP command.
2.3.1 Internal MS-DOS Commands

Internal DOS prompt commands are built into the operating system, i.e., is present in command.com itself.
These include DIR, which displays a list of the files and subdirectories of the current directory; COPY, which
allows you to make a copy of a file and move it to another location; and MEM, which provides a breakdown of
memory use on your computer. Internal commands can be typed at the command prompt regardless of the
directory that he command prompt points to. Table 2.2 lists some of the commonly used internal MS-DOS
commands.

Command Function
CHDIR or CD Changes the directory.
CHKDSK Examines the file allocation table (FAT) and directory structure on a hard
disk drive, checking for errors and inconsistencies that can prevent access
to a file. It also locates lost clusters and can convert them into files and
can reclaim wasted space.
CLS Clears the screen.
COPY Copies files from one directory to another.
DATE Changes the system date.
DEL Deletes the specified files in the current directory.
DIR Lists the files and subdirectories contained in the current directory.
DISKCOMP Compares two floppy disks.
MKDIR or MD Makes a new directory.
PROMPT Changes the appearance of the cursor.
RENAME or REN Renames a file.
RMDIR or RD Deletes a directory but only if the directory is empty.
TIME Changes the system time.
TYPE Displays (types) a text file.
VER Displays the version of MS-DOS in use.
2.3.2 External MS-DOS Commands

External MS-DOS commands are programs that exist as separate files from the management tools built into
the MS-DOS operating system. To use these external commands you must specify the directory where the
file is located by typing in the complete path to its location. In other words, you must specify the name of
the program you want to run and the directory where the program is located. Table 2.3 lists some of the
commonly used external MS-DOS commands.
www.testking.com
- 20 -
220 - 232

Command Function
DISKCOPY Makes a copy of a floppy disk provided that both the source and the
destination disk have the same format.
EDIT Allows you to edit a text based file such as a .txt, .ini, .sys or .bat file.
FORMAT Prepares a disk for receiving files by places a root directory on the disk.
Will make a floppy disk bootable if used with the /s switch.
UNDELETE Recovers a deleted file if the disk has not been modified since the file was
deleted.
XCOPY Copies the files of one directory to another but will not copy hidden files
unless you use the /h switch.
2.3.3 MS-DOS Mode Navigation

The MS-DOS file system uses a tree structure for its directories. The primary volume on a drive is called the
root and can contain both files and subdirectories. Each subdirectory creates another branch, which can also
contain files and subdirectories. The root directory does not have a name; it is created when you set up the
partitions on the hard disk drive, and it is represented by a backslash (\).
The DIR command, which is an internal MS-DOS command, is used to navigate in MS-DOS mode. This
command provides a list of the files and subdirectories contained in the current or specified directory. This
information is displayed as a table with four columns. The leftmost column shows the date on which the file
was created; the second column gives the system time at which it was written to disk. The third column
indicates if the item is a subdirectory; and the fourth column provides the file size and the name of the file.
The DIR command also display the total number of files in the directory and their aggregate size in bytes,
followed by the total number of subdirectories on the drive and the number of subdirectories with the total
amount of free space on the drive.
2.3.4 Using MS-DOS Commands

2.3.4.1 The PATH Command
The PATH command is critical to command-line navigation and the running of applications in MS-DOS
mode. In batch files it can be used to set search paths for operating system to locate the executable files. It
can also be used in a DOS prompt to display the current path
2.3.4.2 The EDIT Command

You can use the EDIT command to edit text based files such as autoexec.bat, config.sys and system.ini, in
MS-DOS mode. If the path to the file you want to edit is not specified, you will have to enter it. This can be
done by pressing the ALT key to activate the menu options and using the arrow keys to navigate through the
menu options to File/Open.
The following table presents a quick reference of some of the important terms and concepts you should be
familiar with when working in MS-DOS mode, as well as for the A+ certification exam. Some items are a
review of the previous discussion; some expand on the material just presented and will be used as we
continue.
www.testking.com
- 21 -
220 - 232
2.4 Working with Config.sys and Autoexec.bat

The config.sys and autoexec.bat files are used during the boot process to execute commands and load legacy
drivers MS-DOS and in the older versions of Windows. The config.sys file is run first. It sets up and
configures the computer’s user-defined hardware components. The autoexec.bat file executes commands
and loads TSR programs.
2.4.1 Config.sys Settings

The config.sys file can contain a number of settings. Table 2.4 discusses several of them.
TABLE 2.4: Config.sys Settings

Setting Function
BUFFERS Allocates reserved memory for transferring information to and from the hard
disk.
COUNTRY Enables MS-DOS to use country conventions for times, dates, and currency.
DEVICE Loads a device driver into memory.
DEVICEHIGH Loads a device driver into upper memory.
MS-DOS Loads part of MS-DOS into upper memory area.
FCBS Specifies the number of file control blocks (FCBs) that MS-DOS can have
open at the same time.
FILES Specifies the number of files that MS-DOS can hold open concurrently.
INSTALL Loads a memory-resident program.
LASTDRIVE Specifies the maximum number of drives the computer can access.
MOUSE.SYS Loads a mouse driver.
NUMLOCK Specifies whether the Num Lock key is on or off when MS-DOS starts.
SHELL Specifies the name and location of the command interpreter. The interpreter
converts the typed command to an action. The default for MS-DOS is
command.com.
www.testking.com
- 22 -
220 - 232
FIG. 2.1: A Config.sys File opened in Edit.com
2.4.2 Autoexec.bat Commands

The autoexec.bat file can contain a number of commands. Table 2.5 discusses several of the common
commands.
TABLE 2.5: Autoexec.bat Commands

Command Function
DOSKEY Loads the DOSKEY program.
ECHO Displays commands as they are executed. ECHO OFF suppresses the
display of commands as they are executed.
KEYB Configures a keyboard for a specific language.
MOUSE.EXE Loads a mouse driver.
PATH Specifies the search path for program commands.
PAUSE Pauses the execution of autoexec.bat and displays the message "Strike
any key to continue".
PROMPT Sets the display of the command prompt.
SET Displays, sets, or removes MS-DOS environment variables.
SHARE Installs the file sharing and locking capabilities.
SMARTDRV Provides disk caching.
www.testking.com
- 23 -
220 - 232
FIG. 2.2: An Autoexec.bat File opened in Edit.com
www.testking.com
- 24 -
220 - 232
3. Microsoft Windows
The first few versions of Microsoft Windows, through Windows 3.x, were not complete operating systems.
They were operating environments that used MS-DOS as a foundation. It provided a user-friendly GUI that
could be shared by all compatible programs. The GUI uses icons, toolbars, standard menus, and common
device drivers to simplify application development and minimize the time it takes a user to learn a new
product. The addition of the mouse and enhanced graphics displays extended the reach of the PC into the
desktop publishing, education, and graphic arts markets once dominated by specialized workstations and the
Apple Macintosh.
The first version of Windows, which was introduced in 1985, provided little more than a graphical interface
and it was not until 1992, when Windows 3.1 was introduced, that the Windows operating environment
became popular. This could be attributed to the increasing number of software applications designed for the
graphical interface, faster graphics cards and improved memory management. The final and most used 16-
bit version of Windows was Windows 3.11. Microsoft Windows 95 that was introduced as the successor to
Windows 3.11 was the first full-fledged 32-bit Microsoft Windows operating system.
Applications written for the Windows operating system provide a common user interface, including the
menu system, which offers the same basic commands for file, print, copy, and save operations, the ability to
select text or objects with the pointing device or keystroke commands, similar mouse functions, and the
ability to cut and pasted data among applications. The multitasking capability of Windows allows the user to
have more than one application open and switch among them.
3.1 Windows Memory Utilization

Windows overcomes the 1-MB memory restriction of MS-DOS by implementing new modes of memory
utilization. The MS-DOS operating system was designed for 8088 processors. As more powerful CPUs
became available, the limits of the 8-bit operating environment hindered the development of programs and
devices that could make use of more powerful computers. With the release of 80286 processors, the CPU
was able to address more than 1 MB of RAM, thus breaking the MS-DOS barrier. However, the market was
still dominated by MS-DOS–based programs that worked within this limit. The release of Windows solved
this problem by allowing a CPU to operate in several modes.
3.1.1 Real Mode

Windows was originally designed to provide MS-DOS with a GUI. Thus the first versions of Windows did
not include memory-management functions and worked within the MS-DOS limit of 1 MB of RAM. Later
versions moved outside the 1-MB limit but continued to support this MS-DOS mode until Windows 3.1
appeared. This MS-DOS mode is called real mode and is used for downward compatibility with applications
and hardware that can only operate within the MS-DOS memory restriction.
3.1.2 Protected Mode

Windows 2.0 broke the MS-DOS 1-MB barrier by using the 286-level protected mode of operation. In
protected mode Windows could address up to 16 MB of RAM. Programs were written that could run only in
the extended memory controlled by Windows. The term protected mode refers to the use of protected
memory. MS-DOS programs can only run under Windows in real mode.
www.testking.com
- 25 -
220 - 232
3.1.3 386 Enhanced Mode

The 386 protected mode, called 386 enhanced mode and introduced with the 80386 processor, allowed the
operating system to address up to 4 gigabytes (GB) of memory, supported virtual memory, and allowed
multiple MS-DOS programs to run simultaneously. From Windows 3.11, only 386 enhanced mode
operation allowed for use of the operating system’s features. The use of real mode was limited to advanced
diagnostics and development as it dramatically restricted the computer’s performance.
3.2 Resource Management

Windows is a resource manager and treats everything in the computer, including memory, video, serial ports,
and sound, as resources. Windows manages resources through device drivers. Applications consume
resources and must request access to any resource form Windows by using subroutines called the
application programming interface (API). Applications can also use a dynamic-link library (DLL) file
to address the Windows operating system directly. DLL files store subroutines that either come with the
compiler that created the application or are created by the programmer, and always end with the .dll
extension.
RAM is the most important resource that the operating system must manage. In Windows, when a program
starts, it loads what is called a stub in conventional memory. This stub makes a request to the operating
system for RAM. The operating system then allocates the amount of RAM if it is available. This area of
RAM is known as a segment, and its location is stored in a heap. Once loaded, a program can ask for
resources as required, as long as the requested resources are available. Windows can provide more
functional memory than the available RAM by using what is called virtual memory, i.e., the swap file, or
the paging file in Windows XP, on the hard disk drive. When an application needs more memory than is
available, the Memory Pager moves blocks data from RAM to virtual memory, i.e., the swap file, on the
system’s hard disks. This frees up the RAM but the hard disk drive is much slower than RAM. To
compensate for this lack of speed, Windows prioritizes programs and caches the less frequently programs to
the hard disk drive. In Windows 95 the user must set the amount of hard disk space to be used and must
specify whether it is to operate in 32-bit mode but Windows 98 automatically adjusts the size of the swap
file and the way virtual memory is allocated when physical memory becomes low.
Later versions of Windows overcomes the problem of having to reset the CPU to run an MS-DOS program
by running what is known as virtual 8086 mode, an extension of 386 protected mode that allows for the
creation of virtual 8086 machines. A virtual 8086 machine is a segment of RAM that operates as if it is an
8086 computer. Windows will run itself in one virtual machine (VM) and allocate another VM to a MS-
DOS program. Because Windows can run several VMs, it also overcomes the limitations of running only
one MS-DOS program at a time.
3.3. Beyond MS-DOS

3.3.1 Windows 9x
Microsoft Windows for Workgroups, also known as Windows 3.11 was the last version of Windows to serve
as a GUI enhancement for MS-DOS. Its successor, Windows 95 was an operating system in its own right. It
was followed by Windows 98 in 1998 and Windows ME in 2000. These versions of Windows, which are
collectively referred to as Windows 9x, overcame the 640-KB memory limit of MS-DOS, can easily be
networked, make use of the Internet, and are aimed at the home and general office markets. Windows ME is
www.testking.com
- 26 -
220 - 232
the most recent mass-market edition of the Windows 9x family and offers improved reliability and recovery,
enhanced Plug and Play support, and extended multimedia capability. Microsoft did, however release
Windows XP Home for the mass market, but Windows XP Home is based on Widows NT than on Windows
9x.
3.3.2 Windows NT
In 1993, Microsoft released another operating system, Windows NT 3.1 alongside Windows 3.1. It was
aimed at power users and the corporate market, and was used in relatively simple network installations.
Windows NT was not just an upscale version of Windows 3.1 but a completely different operating system
that offered better performance, improved reliability, advanced security, and scalability. It was available in
two editions: Windows NT Workstation, which is a stand-alone operating system aimed at technical,
professional and power users; and Windows NT Server, which is designed for robust networking. Both
editions provide high levels of security. The different versions of Windows NT are supplemented by regular
updates called service packs (SPs), which provide inline fixes that do not change the version number.
Windows NT 4.0 had six service packs.
Windows 2000 followed Windows NT 4.0, adding Plug-and-Play support, better multimedia tools, and
advanced Internet support. It comes in 4 editions:
• Windows 2000 Professional replaces Windows NT 4.0 Workstation and is designed for the single user.
It has support for symmetric multiprocessing on up to two CPUs, file encryption, system monitoring and
advanced troubleshooting tools, NTFS5 support, and enhanced mobile computing capability.
• Windows 2000 Server is designed as the entry-level server platform, replacing Windows NT Server. It
has support for symmetric multiprocessing on up to four CPUs and adds support for Active Directory
services which is an enhanced version of the domain technology found in Windows NT.
• Windows 2000 Advanced Server is designed for high-traffic networks and e-commerce sites. It has
support for symmetric multiprocessing on up to eight CPUs. It also has support for up to 8 GB of RAM,
load balancing, and clustering of up to two servers.
• Windows 2000 Datacenter Server is the most advanced Windows 2000 server platform. It is designed
for large data warehouses, advanced scientific and engineering applications, and large-scale Web farms.
It supports four-way clusters and storage area networks.
The latest version of the Windows NT family is Windows XP and Windows.net. Windows XP consists of
two editions: Windows XP Home, which replaces Windows ME as the operating system aimed at the mass-
market; and Windows XP Professional, which replaces Windows 2000 Professional. The server editions of
Windows 2000 have evolved into Windows.net.
www.testking.com
- 27 -
220 - 232
4. Installing Microsoft Windows

4.1 Preparing to Install Windows
4.1.1 Minimum System Requirements
There are a number of different versions of Windows available. Windows 2000 Professional, Windows 98,
and Windows ME are designed for the end-user while the server versions of Windows 2000 are designed for
network environments. More demanding users will find Windows 2000 Professional more satisfying from a
performance standpoint, but will require greater outlay in terms of the initial purchase price of the operating
system and the higher system requirements to run it effectively. Windows 98 and Windows ME have lower
system requirements. Table 4.1 lists the minimum hardware requirements for Windows 98, Windows ME
and Windows 2000 Professional. These are however minimum system requirements to support the operating
system. Users will need higher system specifications to support applications as well.
TABLE 4.1: Minimum System Requirements for Windows

Hardware Windows 98 Windows ME Windows 2000 Pro
CPU 486 DX/66 Pentium 150 Pentium 133
RAM 16 MB 32 MB 64 MB
Hard Disk space 110 MB 480 MB 2 GB with 650 MB
free space
Display system VGA with 16 colors and VGA monitor
CD-ROM Required to install operating system from Installation CD
Input device Keyboard and Mouse or other Windows compatible pointing device
4.1.2 Additional System Requirements

• The amount of RAM necessary on any Windows system depends on which applications the user will
want to install on the computer. Microsoft Office users will require at least 64 MB of RAM. Any
additional RAM will boost the system’s performance.
• The minimum CPU requirement will be sufficient for general productivity applications with little or no
multitasking, especially if a good graphics adapter with its own coprocessor is also installed on the
system. Computers that will be used for scientific, technical, and graphics-intensive applications, or that
are intended for multitasking will need faster CPUs. However, adding more RAM often provides a
bigger boost than upgrading the CPU to the next level.
• Graphics-intensive and multimedia applications will benefit graphics adapter cards with powerful
coprocessors and extra Video RAM as the power of the graphics adapter card’s coprocessor and the
amount of RAM on the adapter card affects the screen redraw speed, the refresh rate of the display,
resolution, and color depth.
• The hard disk space will also need to have sufficient storage space for the operating system, the
applications, and to store user files.
4.1.3 Boot Configurations
www.testking.com
- 28 -
220 - 232
More than one operating system can be installed on a single computer. Both Windows 98 and Windows
2000 support dual boot operations that can include various versions of Windows 9x, Windows 2000,
Windows NT, UNIX, and even OS/2. Dual boot installations require some consideration to ensure that one
installation does not damage the other, that file systems are compatible, and that all hardware devices and
software required by each operating system are properly accessible.
In a Windows 98 dual boot configuration, Windows 98 must reside on the primary boot disk which must be
a FAT16 partition if the other operating system is Windows NT or it can be a FAT32 partition if the other
operating system in Windows 2000. The two operating systems must reside in different partitions or hard
disks. You cannot dual boot Windows 98 and Windows 95 as both operating systems use the same boot file,
thus, the second installation will overwrite the first. Furthermore, Windows 98 cannot access files on NTFS
partitions, and Windows NT cannot access files on FAT32 partitions.
You can dual boot Windows 2000 with MS-DOS, Windows 3.x, OS/2, Windows 95, Windows 98, Windows
ME, and Windows NT Workstation 3.51 and 4.0. As with Windows 98, each operating system must reside
on a different disk partition. When you dual boot Windows 2000 with MS-DOS or Windows 95, MS-DOS
or Windows 95 must be installed first.
4.1.4 Upgrades and Clean Installs

Operating systems can either be installed as clean installs or upgrades. A clean install is performed when the
new operating system is installed either on a newly formatted hard disk or in a dual boot configuration.
When a clean install is performed on a computer that had a previous operating system, you should backup
all data files that the user does not want to lose. You should also make copies of any batch files and user
profile and setting files on a floppy disk so they can be easily migrated to the new system.
An upgrade on the other hand is performed when the components of an existing operating system are
updated and new components are added. You can upgrade all earlier Windows operating systems, with the
exception of Windows 3.1, Windows for Workgroups 3.1 and Windows NT Workstation 3.5, directly to
Windows 2000. Windows 3.1 must first be upgraded to Windows 95 or Windows 98 and can then be
upgraded to Windows 2000 Professional. Windows for Workgroups 3.1 and Windows NT Workstation 3.5
must first be upgrade to Windows NT Workstation 3.5.1 or Windows NT Workstation 4.0 and can then be
upgraded to Windows 2000 Professional.
You can use Windows 2000 to generate an upgrade compatibility report that can be used to check whether
the devices and drivers on the existing operating system are compatible with Windows 2000. You can
generate this compatibility report by running the winnt32 /checkupgradeonly command or the
Chkupgrade.exe utility, which runs the Windows 2000 Readiness Analyzer but must be downloaded from
Microsoft website. The /checkupgradeonly switch of the for winnt32 command runs the first part of the
Windows 2000 Setup program and checks only for compatible hardware and software.
4.1.5 Preparing the Hard Disk Drive and File System

When installing an operating system on a new hard disk drive, you must first partition the drive and format it
with the desired file system. You can the MS-DOS command-line utility, fdisk, to partition the hard disk
drive and format to format the hard disk drive if the desired partition is FAT16 or FAT32. If you are
installing Windows 2000 or Windows NT 4.0 and want to implement the NTFS, you can format the partition
during the setup of the operating system, or you can format the partition as either FAT16 or FAT32 and
www.testking.com
- 29 -
220 - 232
convert the partition to NTFS after Windows 2000 has been installed on it. Remember that Windows 9x
cannot access a NTFS partition, thus if you implement dual booting with Windows 2000 on a NTFS
partition and Windows 9x on a FAT32 partition, the Windows 9x operating system will not be able to access
the files on the NTFS partition. Also, if you want to implement dual booting with Windows NT on a NTFS
partition and Windows 9x on a FAT32 partition, the Windows 9x operating system will not be able to access
the files on the NTFS partition and the Windows NT operating system will not be able to access files on the
FAT32 partition.
The Windows 98 and Windows 95 startup disks that can be used to boot the computer contain a copy of the
fdisk utility. When you run fdisk on a system that has hard disk dive that is larger than 512 MB, you will be
asked if you wish to enable large drive support. If you choose Yes, the 32-bit FAT file system will be used;
and if you choose No, FAT16 will be used. FAT16 will limit the partitions to 2 GB, even if it is a larger
drive. Once you have finished creating the partitions, you must reboot the computer with the startup disk and
format the partitions created on the hard disk drive. Format.com or format.exe is also included on the
Windows 98 and Windows 95 startup disks.
4.2 Installing Windows 98

4.2.1 Running Setup
There are two way of installing Windows 98, depending on whether you want retain the setting of the
existing operating system when you upgrade Windows 3.1, Windows fro Workgroups, or Windows 95 to
Windows 98 or whether you do not want to retain the existing settings when performing an upgrade or you
are installing a fresh copy of the operating system on a newly formatted hard disk drive.
When you upgrade to Windows 98 you must run the setup program from within the existing operating
system. This will ensure that the current setting will be retained in the upgraded operating system. If you do
not want to keep the current settings or if you are loading the operating system on a new computer or a
freshly prepared disk drive, you should boot the computer using a boot disk and run the setup program from
the MS-DOS prompt.
The Windows 98 installation files that are available on either CD-ROM or on floppy disks can be copied to
a network location that is available to the target computer on which Windows 98 is to be installed. The
Windows 98 startup disk includes drivers needed to run both EIDE and SCSI CD-ROM drives. However, if
the CD-ROM is attached to the system via a sound card, it may not be able to run the Setup program.
4.2.2 Windows 98 Setup Command-Line Switches

There are a variety of options, in the form of command-line switches, available when running Windows 98
Setup from a MS-DOS prompt. Table 4.2 discusses these switches.
TABLE 4.2: Windows 98 Setup Command-line Switches

Switch Function
/? Provides a list of command-line switches
/C Does not load the SmartDrive disk cache
/D Does not use the existing version of Windows for the first
Setup steps.
www.testking.com
- 30 -
220 - 232
/DOMAIN: domain_name Sets the Windows NT Logon Validation information.

/F Prevents filenames from being held in the local cache
/IC Performs a clean boot in some versions of Windows.
/ID Disables the minimum hard disk drive space check.
/IE Skips the Startup Disk screen
/IF Performs a fast setup.
/IH Runs ScanDisk and displays an error report.
/IL Loads a Logitech mouse driver that supports the Logitech
Series C mouse.
/IM Skips the low conventional memory check
/IN Skips the network installation section of the Setup program.
/IQ Skips the cross-linked files check
/IR Does not perform an update of the Master Boot Record
(MBR)
/IS Skips ScanDisk
/IW Does not display the License Agreement dialog box
/IX Does not perform a character set check
/NF Does not provide a prompt to remove the floppy disk from
drive A at the end of the Copying Windows 98 Files To
Your Computer Setup step
/NH Does not run hwinfo.exe when running Setup from the
Windows 95 user interface.
/NOSTART Copies a minimal installation of the required dynamic-link
libraries (DLLs) used by Windows 98 Setup, then exits to
MS-DOS without installing Windows 98.
/NR Skips the registry check
/PI Keeps forced configured hardware settings. Some BIOS
requires hardware to have a forced configuration to work.
Setup removes the forced configuration by default. This may
cause some hardware problems.
/PJ Loads Advanced Configuration and Power Interface (ACPI)
/script_filename Uses a script to install Windows 98 automatically
/SRCDIR Specifies the source directory where the Windows 98 Setup
files are located
/S filename Load the specified setup.inf file when starting Setup
/T:tempdir Specifies a temporary directory where Setup can copy files to.
These files will be deleted when Setup completes.
www.testking.com
- 31 -
220 - 232
4.2.3 The Windows 98 Installation Process

The Windows 98 installation consists of five steps that are more or less similar when performing a clean
install or an update. These steps are:
Step 1: Preparing to run Windows 98 Setup
Step 2: Collecting information about your computer
Step 3: Copying Windows 98 files to your computer
Step 4: Restarting your computer
Step 5: Setting up hardware and finalizing settings
FIG. 4.1: The Windows 98 Setup Program

During step one of a clean installation, Setup runs ScanDisk in Real-mode to check the hard drive for errors;
extracts the files from mini.cab to a temporary folder named C:\Wininst0.400. It then prompts you to accept
the software License Agreement.
During step two you select the Setup type and, if you selected a custom installation, the optional components
that are to be installed. You also specify user and computer information, such as user name and computer
name, during this step. You are then prompted to create the Windows 98 Startup Disk, which is a system
www.testking.com
- 32 -
220 - 232
disk with a collection of real-mode Windows 98 commands and utilities that can assist in troubleshooting.
After the startup disk is created, you will be prompted to remove the disk and continue with Setup.
After collecting the necessary information about your computer, Setup begins step three by prompting you
to start copying the Windows 98 files to the hard disk drive. During this step, Setup does not require any
input. If this step is interrupted and does not finish normally, the operating system will be unstable and may
have to be reinstalled.
In step four Setup reboots the computer once the file coping is completed and presents you with the license
agreement screen. You must accept the license agreement to continue installing Windows 98. Once you
have accepted the license agreement, you are prompted to enter the Windows 98 CD Key.
During step five, Setup detects both legacy and Plug-and-Play hardware devices and sets up the hardware
drivers. Setup then asks you to select the proper date, time zone, and printer information. It then modifies the
registry and other system configuration files, finalizes the Control Panel and Start menu, initializes Windows
Help, and configures MS-DOS programs. One this is done Setup restarts the computer for a second time.
4.2.3.2 Upgrading to Windows 98

Performing an upgrade is similar to a clean install except that you must start the installation from within the
existing operating system or the existing settings will be replaced. Although it consists of the same five steps
that are performed in a clean install, it is slightly different.
During step one Setup checks for anti-virus software, and if it finds any, it prompts you to disable the anti-
virus software. Setup creates setuplog.txt, which records information about the setup process as it occurs, in
the root directory of drive C. Setup then creates a temporary folder named C:\Wininst0.400 and extracts the
files from precopy1.cab, precopy2.cab, and precopy3.cab into C:\Wininst0.400. There after the License
Agreement is displayed. You must accept the License Agreement to continue Setup.
Step two begins after you accept the License Agreement. During this step Setup runs ScanDisk in protected
mode to check your system’s directory structure, file allocation table, and file system. It then checks the
integrity of the registry. Once this is complete Setup prompts you to save existing system files. If you
choose to save your existing configuration files, Setup creates two files: winundo.dat, which contains all of
the files necessary to restore your old system settings; and winundo.ini, which contains the information
necessary to restore the files contained in winundo.dat. You are then prompted to select Internet channels,
and create the Windows 98 startup disk.
During step three, Setup prompts you to start copying the Windows 98 files to the hard disk drive. This step
does not require any input and is identical to step three of a clean install.
Step four occurs after the file copying is completed and begins with a system reboot. After the computer
restarts, win.ini, system.ini, and registry files are modified in real-mode to add the Windows 98 settings, if
autoexec.bat and config.sys files exist, they are checked for incompatible device drivers and Terminate and
Stay Resident (TSR) programs as specified by entries in setupc.inf located in the C:\Windows\Inf folder. A
REM statement is added to any line in these files that contains a reference to an incompatible or unnecessary
entry.
www.testking.com
- 33 -
220 - 232
During the step five, Setup detects only Plug-and-Play hardware devices and sets up the hardware drivers.
Setup then asks you to select the proper date, time zone, and printer information. It then modifies the
registry and other system configuration files, finalizes the Control Panel and Start menu, initializes Windows
Help, and configures MS-DOS programs. One this is done Setup restarts the computer for a second time.
4.2.4 Establish Network Connections

If you upgraded a computer that was already set up on a network to Windows 98, the appropriate network
settings and protocols should already be loaded. Thus, when Windows 98 reboots after Setup is complete,
you should see the appropriate network logon. However, if you installed Windows into a new directory or
performed a clean install, you will have to use the Control Panel / Network setting to install protocols and
configure the network settings in order to make the computer a part of the network.
4.2.5 Troubleshooting a Windows 98 Installation

If the computer stops responding before Setup performs the first reboot, i.e., before step four, you must turn
off the computer, turn it back on, and run Setup again. When you run setup again, it will detect a failed
installation and will present the Safe Recovery screen.
FIG. 4.2: The Safe Recovery Screen
If you select the Use Safe Recovery option, Setup examines the setuplog.txt file to determine where the
failure occurred and then resumes from the point of failure but bypasses the cause of the error. If you do not
select the Use Safe Recovery option, the Setup will start over from step one.
www.testking.com
- 34 -
220 - 232
When you perform an upgrade from inside Windows 95, Setup does not perform full hardware detection but
verifies legacy hardware settings in the registry. If an error occurs during this stage, Setup launches full
hardware detection by writing data to and reading data from various hardware addresses, including I/O ports,
IRQs, and memory address ranges.
Setup records installation information that can be used for recovery in five files, including setuplog.txt.
These files are:
• bootlog.txt holds a record of the boot process, including which drivers were loaded and initialized and
their status. It is automatically generated during the setup process, but you can also create it by pressing
F8 during a normal Windows 98 boot process, or using the /b switch if you start Windows from a MS-
DOS prompt using the win.com command.
• detcrash.log is generated if Setup fails during the hardware detection phase of step five. It contains
information that show which detection module was running and the resources that were being accessed
when the failure occurred. This file is used directly by Setup and is not normally readable by the user.
• detlog.txt is generated every time a hardware detection process is initiated, either during a new Windows
installation or by running the Add New Hardware Wizard. It is a user-readable version of the
information contained in detcrash.log and can be used to quickly pinpoint the device that causes an error
during initialization.
• netolog.txt is similar to detlog.txt but is generated when network components, such as network interface
cards, protocols, clients, file and print sharing, and protocol bindings, are detected.
• setuplog.txt is used to enable Safe Recovery if Setup fails before the hardware detection phase begins. It
allows Setup to determine when the system stalled, what needs to be repeated, and what should be
skipped. This file can be found in the root directory of the boot disk, and records information in the order
in which they were executed.
These five files are ASCII text based files located in the root directory of the primary hard disk drive,
although detlog.txt and detcrash.log are hidden files. A text editor like Wordpad, Notepad, or Edit can be
used to read these files.
4.3 Installing Windows 2000 Professional

Installing Windows 2000 Professional as a stand-alone operating system is similar to installing Windows 98.
However, the more robust security provided within Windows 2000 Professional adds a few extra steps to the
process.
4.3.1 Running Setup

The Windows 2000 Professional Setup program runs two installation programs: winnt32.exe, a 32-bit
program; and winnt.exe, a 16-bit version. The version you will use will depend on whether the environment
you start the Setup program is a 16-bit or 32-bit environment. Winnt32.exe is the preferred command used
for all 32-bit operating environments while winnt.exe must be used in 16-bit environments.
The Setup program can be started in one of five ways: directly from the Installation CD, from within an
exiting operating system, from a shared network folder, or from a combination of boot disks and the
Installation CD, or from a combination of boot disks and a shared network folder.
www.testking.com
- 35 -
220 - 232
4.3.1.1 Running Setup from the CD-ROM

In your system BIOS set the CD-ROM drive as the First Bootable Device. This is usually set in the BIOS
Feature Setup. While you are in the BIOS Setup you should also check that Boot Sector Virus Protection
is disabled. The Boot Sector Virus protection prevents any attempt is made to write to the hard drive’s boot
sector or partition table. When BIOS detects an attempt to write to the boot sector it stops the computer and
display an error message. The Windows 2000 Setup program must write to the boot sector, therefore the
Boot Sector Virus Protection must be disabled.
Once you have configured the BIOS, place the Windows 2000 Professional Installation disk in the CD-ROM
drive and reboot the computer. During the boot process you will be prompted to press any key to boot from
CD-ROM. Once you have pressed a key the Installation of Windows 2000 Professional will begin.
4.3.1.2. Using Boot Disks

If your computer system does not support booting from the CD-ROM, you will have to create boot disks on
a computer that has an operating system installed on it already. On the Windows 2000 Professional
Installation CD is a folder named bootdisk that contains a file named makeboot.exe. This file is used to
create the Windows 2000 boot disks, a process that requires 4 high density floppy disks that can then be
used to boot the computer and will load the drivers required to access the CD-ROM drive.
Note: Boot disks operate in a 16-bit DOS mode environment. You therefore
cannot use winnt32.exe to install Windows 2000 Professional as winnt32.exe
is 32-bit application. You must use winnt.exe, which is the 16-bit equivalent
of winnt32.exe, instead.
4.3.1.3 Running Setup from a Network Share

To install Windows 2000 Professional over the network you must copy the i386 folder from the Windows
2000 Professional Installation CD to a shared folder on the network. You must also ensure that the computer
can connect to the network share when it is booted. To be able to boot to the network share the computer
must have a PXE compliant network adapter. If the computer cannot be booted over the network you will
have to create a network boot disk for the computer. A boot disk can be created by using the rbfg.exe utility.
If you must use a boot disk to boot the computer, you will have to run winnt.exe to install Windows 2000
Professional. Boot disks operate in a 16-bit DOS mode environment. You therefore cannot use winnt32.exe
to install Windows 2000 Professional as winnt32.exe is 32-bit application.
4.3.2 Windows 2000 Professional Setup Command-Line Switches

As with Windows 98, both winnt.exe and winnt32.exe supports a number of command-line switches that can
be used when starting Setup from a MS-DOS prompt. These switches provide access to the number of
options that can be used to fine-tune the setup process. Winnt32.exe can be run from a command prompt
window in Windows 9x, Windows NT Workstation 3.51 or Windows NT Workstation 4.0. Table 4.3
discusses the winnt32.exe switches while Table 4.4 discusses the winnt.exe switches.
TABLE 4.3: Winnt32.exe Command-Line Switches
www.testking.com
- 36 -
220 - 232
Switch Description
/checkupgradeonly
Checks the computer for upgrade compatibility
with Windows 2000
/copydir:folder_name Creates a folder in the systemroot folder (which
contains the Windows 2000 system files).
/copysource:folder_name Creates a folder in the systemroot folder. Files
created with /copysource are automatically
deleted after the installation is completed.
/cmd: command_line Specifies a command to be run before the final
phase of Setup.
/cmdcons Adds a Recovery Console option to the operating
system selection screen.
/debug[level] [:file_name] Creates a debug log at the specified level. The log
levels are: 0 = severe errors, 1 = errors, 2 =
warnings, 3 = information and 4 = detailed
information for debugging.
/m:folder_name Specifies that Setup must copy replacement files
from another location and to look for files in that
location first.
/makelocalsource Specifies that Setup must copy all installation files
to the hard drive.
/noreboot Prevents Setup from rebooting the computer
following the file copy phase. This enables a
command to be entered by the user prior to
completing setup.
/s:source_path Specifies the source location of Windows 2000
installation files.
/syspart:drive_letter Copies Setup startup files to a hard disk and marks
the drive as active. You can then install the drive on
another computer. When you start that computer,
Setup starts at the next phase. This requires use of
the /tempdrive switch.
/tempdrive:drive_letter Specifies a partition to contain temporary setup
files and installs Windows 2000 on that partition.
/unattend Updates the previous version of Windows 9x,
Windows NT Workstation 3.52 or Windows NT
Workstation 4.0 automatically by using the settings
from the existing operating system.
/unattend [num]:[answer_file] Performs a clean install in unattended Setup mode
using an answer_file that provides your custom
specifications to the Setup program.
www.testking.com
- 37 -
220 - 232
/udf:id[,udf_file] Indicates an identifier (ID) that Setup uses to

specify how a Uniqueness Database File (UDF)
modifies an answer file.
Note: Winnt32.exe is 32-bit application. It cannot be used in a MS-DOS-based

environment such as MS-DOS mode. Boot disks operate in a 16-bit MS-
DOS mode environment. You therefore cannot use winnt32.exe to install
Windows 2000 Professional from a boot disk. You must use winnt.exe,
which is the 16-bit equivalent of winnt32.exe, instead.
TABLE 4.4: Winnt.exe Command-Line Switches

Switch Description
/a Enables accessibility options
/e[:command] Specifies a command to be executed at the end of
Setup’s GUI mode.
/r[:folder] Specifies an optional folder to be installed on the
hade drive. Setup retains the folder.
/rx[:folder] Specifies an optional folder to be installed on the
hade drive. Setup deletes the folder after
installation
/s[:sourcepath] Specifies the source location of Windows 2000
files.
/t[:tempdrive] Specifies a drive to contain temporary setup files.
/u[:answer file] Performs an unattended installation using an
answer file that provides your custom specifications
to the Setup program. This requires the /s switch.
/udf:id[,UDF_file] Indicates an identifier (ID) that Setup uses to
specify how a Uniqueness Database File (UDF)
modifies an answer file.
4.3.3 The Windows 2000 Professional Installation Process

The Windows 2000 Professional installation consists of four steps that are more or less similar when
performing a clean install or an update. These steps are:
Step 1: Hard Drive Preparation. In text mode Setup checks the hard disk drive for consistency and
errors. It allows you to format and partition the hard disk drive and copies setup files to the hard disk
drive. Setup then reboots the computer.
Step 2: Setup Wizard. The graphical user interface Setup Wizard gathers information from you; such as
regional settings, your name and organization, the Windows 2000 CD-key, and computer name. Creates
the local Administrator user account and requests a password for it.
Step 3: Installing Network Components. After the Setup Wizard has gathered the necessary information
from you in Stage 2, it begins the network components installation. It detects your network adapter card;
www.testking.com
- 38 -
220 - 232
allows you to choose which network components, such as the network client, file and printer sharing and
protocols, to install; allows you to join a workgroup or domain; and installs the components you have
chosen.
Step 4: Completing the installation. The Setup Wizard completes the installation by installing the start-
menu items and applying and saving the configuration settings you chose in the previous stages. It then
deletes the temporary setup files and reboots the computer.

When you perform a clean install by booting the computer from the Installation CD, or from a boot disk,
Setup begin step one by checking the hard disk drive for consistency and errors and inspecting the
computer’s hardware configuration before prompting you to accept the license agreement. It then allows you
to choose which file system you want to use and to format and partition the hard disk drive before copying
setup files to the hard disk drive. If the hard disk drive has already been formatted, Setup prompts you to
choose whether to keep the existing file system or to upgrade it to NTFS. Setup then reboots the computer.
In step two, Setup runs the Windows 2000 Setup Wizard which detects and installs devices such as the
keyboard and mouse. The Setup Wizard then gathers information from you. This includes information
related to regional settings, such as location and currency; the user name and organization; the computer
name; the date and time settings, including the time zone; and the Windows 2000 CD-key. It also creates the
local Administrator user account and requests a password for it.
In step three, Setup installs the network settings. It detects your network adapter card; allows you to choose
which network components, such as the network client, file and printer sharing and protocols, to install;
allows you to join a workgroup or domain. It then either installs and configures the default Windows 2000
Professional components or the Windows 2000 Professional components you have selected if you chose to
perform a custom installation.
In step four, Setup completes the installation by finalizing the start menu; applying the Windows 2000
Professional components and saving the configuration settings. It then deletes the temporary setup files and
reboots the computer.
Windows 2000 Professional can also be installed in a dual boot configuration. This requires that you start
the instillation from within the existing operating system and select a clean install rather than an upgrade.
The first step in this process differs slightly from a clean install of Windows 2000 Professional on a
computer with no existing operating system as Setup runs a Windows 2000 Readiness Analyzer to
determine if the computer’s hardware components are Windows 2000 compliant. All the other steps are the
same.
4.3.3.2 Upgrading to Windows 2000 Professional

You can upgrade all earlier Windows operating systems, with the exception of Windows 3.1, Windows for
Workgroups 3.1 and Windows NT Workstation 3.5, directly to Windows 2000. Windows 3.1 must first be
upgraded to Windows 95 or Windows 98 and can then be upgraded to Windows 2000 Professional.
Windows for Workgroups 3.1 and Windows NT Workstation 3.5 must first be upgrade to Windows NT
Workstation 3.5.1 or Windows NT Workstation 4.0 and can then be upgraded to Windows 2000
Professional.
www.testking.com
- 39 -
220 - 232
TABLE 4.5: Windows 2000 Professional Upgrade Paths

Operating System Upgrade Path
Windows 3.1 First upgrade to Windows 95 or Windows 98 and then
Windows 2000 Professional
Windows for Workgroups 3.1 First upgrade to Windows NT Workstation 3.5.1 or
Windows NT Workstation 4.0 and then Windows 2000
Professional
Windows 95 Windows 2000 Professional
Windows 98 Windows 2000 Professional
Windows NT Workstation 3.5 First upgrade to Windows NT Workstation 3.5.1 or
Windows NT Workstation 4.0 and then Windows 2000
Professional
Windows NT Workstation 3.5.1 Windows 2000 Professional
Windows NT Workstation 4.0 Windows 2000 Professional
You can use Windows 2000 to generate an upgrade compatibility report that can be used to check whether
the devices and drivers on the existing operating system are compatible with Windows 2000. You can
generate this compatibility report by running the winnt32 /checkupgradeonly command or the
Chkupgrade.exe utility, which runs the Windows 2000 Readiness Analyzer but must be downloaded from
Microsoft website. The /checkupgradeonly switch of the for winnt32 command runs the first part of the
Windows 2000 Setup program and checks only for compatible hardware and software.
When you upgrade Windows 9x or Windows NT Workstation to Windows 2000, you can choose for Setup
to retain the existing settings and applications for use with the new operating system. This simplifies the
installation process.
4.3.4 Additional Installation Tasks

Once the installation process is finished you must perform some additional tasks before Windows 2000
Professional can be used. These tasks are: setting up local user accounts, joining a network, and creating an
Emergency Rescue Disk (ERD).
• Setting Up Local User Accounts. When the computer starts after the installation process is complete, a
logon dialog box appears. You must press Ctrl+Alt+Delete key combination on the keyboard to proceed
to the user logon screen. The logon screen asks you for a user name and password. Entering a new name
and password creates a local user account that will provide access to the computer. For full rights you
must log on using an account that has administrative privileges, such as the one you created during the
setup process.
• Joining Networks and Domains. Both the administrative account and the new user account are specific
to the computer and do not grant access to any network or domain that you have specified during
installation. To gain full access to the network you must join the computer to any desired workgroup or
domain and set up the appropriate domain or workgroup user accounts needed to access them. That may
require administrative access to the servers for those networks.
• The last task is to create an Emergency Repair Disk (ERD). This disk contains the autoexec.nt,
config.nt, and setup.log files that are needed to restore the original registry created during the setup
www.testking.com
- 40 -
220 - 232
process. The ERD is not a bootable disk but can be used in conjunction with a boot disk to restore the
Registry should it become corrupt.
4.3.5 Troubleshooting Windows 2000 Professional Installations

Because of the rigid hardware compatibility requirements and the thorough nature of the Windows 2000
Professional Setup routine, the majority of Windows 2000 installations should complete without
encountering any problems. If problems are encountered:
• Check Hardware and Software. Run the compatibility check on all components. Make sure that all
hardware components are listed in the hardware compatibility list, replace any components that are not,
and make sure that any software already installed on the computer is Windows 2000 compliant. Check
the Windows 2000 Professional CD for any flaws and make sure the CD-ROM is working properly.
• Inspect the Log Files. Windows 2000 Professional creates several log files during the installation
process. These log files are located in the \Winnt directory and include:
Setupact.log, which is an action log that records every step that Setup performs in chronological
order. It also includes the errors that are written to the error log.
Setupapi.log, which is a log of the installation of the different device classes on the computer.
• Simplify the Hardware Configuration. If the cause of the problem cannot be pinpointed but you
suspect it to be hardware-related, you can remove components that are not critical to system operation
(like a sound card or video capture device) and run the installation program again. Once you have
successfully installed Windows 2000, you can add these components individually.
• Use the Recovery Console. Windows 2000 Professional provides a recovery console that can provide
basic repairs to a corrupted system, as well as offering command-line access to a variety of utilities for
inspecting and repairing components.
www.testking.com
- 41 -
220 - 232
5. Operating Windows 98
Windows 9x is an evolution of the MS-DOS and Windows 3.1x environments. It is a 32-bit operating
environment offering improved performance, pre-emptive multi-tasking and multi-threading operation,
advanced hardware support, improved stability, and the ability to manage large amounts of memory.
The Windows 98 operating system can be broken down into two major components: the core and ancillary
systems.
5.1 The Windows 98 Operating System Core Components

The Core consists of the Graphical Device Interface (GDI); the kernel; the user component; and the user
interface. These four components have 32-bit and 16-bit dynamic-link libraries (DLLs) to allow the
operating system to use the 32-bit mode while allowing backward 16-bit compatibility for old devices and
applications.
• Graphical Device Interface (GDI) is an imaging system that draws all the objects displayed on the
screen or reads the information to devices like printers that can receive graphical output. The GDI is also
the component responsible for interacting with the display system and its related drivers. It is one of the
most complex tasks performed by the operating system and many of the memory problems associated
with earlier versions of Windows could be traced back to graphics display problems and GDI
management.
• The User Interface is a 32-bit shell that includes a variety of tools to make use of the file system and
gain access to system services. These include My Computer, the Network Neighborhood, and Windows
Explorer. All Windows applications can make use of the shell services, including dialog boxes and the
ability to list and view files.
• The User Component of the operating system functions as the I/O manager. It receives and routes input
from the mouse, keyboard, microphone, and other input devices. It also routes traffic to and from the
communications ports, the system timer, and the sound card. In addition, it functions as the output
coordinator for the GDI by controlling the output of display elements like menus, dialog boxes, and
icons.
• The Kernel controls all the tasks of the operating system. It invokes the executable file when an
application opens, and terminates it when it is done; it loads and manages all DLLs and allocates
memory; and is responsible for all pre-emptive multi-tasking and multi-threading operations.
5.2 The Windows 98 Operating System Ancillary Systems

All of the ancillary systems operate using 32-bit mode. Windows 98 comes with a collection of 32-bit file
system drivers that support FAT16, FAT32, and ISO 9660 format CD-ROM discs, and the DVD Universal
Disc Format.
• The Process Scheduler is responsible for allocating system resources and provides pre-emptive multi-
tasking by dividing the amount of time each application can have to access to the CPU and other system
resources. These time slices are called threads. Thus the term multi-threaded can be applied to Windows
98. An application can have more than one thread open at a time, as a result, Windows 98 is known as a
multi-threading, multi-tasking operating system.
• File System Drivers. Like Windows 2000, Windows 98 offers support for the Windows Driver Model
(WDM), allowing compatible devices to use the same driver for both operating systems. Its Plug-and-
www.testking.com
- 42 -
220 - 232
Play feature is much improved over Windows 95. WDM drivers can be categorized into one of several
classes:
Device class drivers contain class-specific functions. These are used for classes of products like
mice, joysticks, and keyboards.
Bus class drivers are available for both USB and IEEE 1394 buses. They work to speed up
communications between the hardware layer and the minidrivers.
Minidrivers are hardware-specific and generally operate a class of devices operating on a
specific type of bus. This class includes support for SCSI, USB, DVD, IEEE 1394, and network
adapters. Minidrivers can be written to support multifunction cards like a video capture card that
includes both video and sound functions on a single product. Windows 98 dynamically loads and
unloads minidrivers as they are needed or released to save on memory and avoid usage conflicts.
Ntkern.vxd is the operating system services layer for Windows 98. This layer is always system-
specific and allows the minidrivers to function with more than one operating system. Under
Microsoft Windows NT, the operating system services layer is the hardware abstraction layer
(HAL).
Virtual device drivers (VxDs) are 32-bit protected mode drivers responsible for managing a
system resource. These drivers do not control the hardware device, but act as an interpreter
between the hardware and the application, ensuring that only one system process controls the
resource at any specific time. VxDs are only held in memory when they are actually in use. Some
VxDs are also used with legacy hardware and software to allow them to function within the
Windows 98 environment.
• The Virtual Machine Manager (VMM) manages the system’s virtual machine, the environment in
which all system processes operate. In other words, it manages the key resources required by both
applications and system processes. These include process scheduling, memory management, exception
handling, and mapping access to the system BIOS, device drivers, and TSR programs.

Windows 98 offers various means of initializing the operating system. These include loading the system into
a previous version of MS-DOS; to operate in a command-mode-only environment; or to troubleshoot
problems.
5.3.1 The Normal Boot Process

The normal Windows 98 boot process can be broken down into three broad phases: the BIOS initialization
phase; the hardware profile and real-mode driver loading phase; and the protected mode initialization phase.
5.3.1.1 The BIOS Initialization Phase

The system BIOS is a software program stored on the ROM BIOS chip and is used by the computer during
the startup routine. It is the first phase of the boot process and performs two functions: it runs the power-on
self test (POST) to check the computer system; and prepare the computer to run the hardware. How the
BIOS affects the Windows operating system depends on whether
The POST
the BIOS supports Plug-and-Play or not. Computers with a Plug-
and-Play-enabled BIOS initializes and completes the The power-on self test (POST) is an
internal self-diagnostic routine that sends
configuration of the Plug-and-Play-compliant devices before the out standardized commands to check every
POST begins, resolving possible conflicts. It then looks for the primary device in the computer and is run
existence of an operating system. At this point, Windows 98 whenever the computer is booted.
www.testking.com
- 43 -
220 - 232
begins taking control of the operating environment.
5.3.1.2 Real-Mode Driver Loading Phase

The first phases of the actual Windows 98 startup occurs real mode. The Windows 98 io.sys is the first
system file loaded into memory. In so doing it loads many of the core settings that were contained in the
config.sys file on earlier versions of Windows and MS-DOS. Figure 5.1 illustrates a typical Windows 98
io.sys file. io.sys loads himem.sys, ifshlp.sys, and setver.exe, as well as dblspace.bin or drvspace.bin if one of
these exist. Although you can open io.sys in a text editor, you cannot edit it without causing it to fail.
Therefore you should rename the files that you do not want io.sys to load.
FIG. 5.1: The Windows 98 io.sys File opened in Edit.com
Windows 98 determines the computer’s configuration and performs a detection sequence that examines
IRQs, the system BIOS, and Plug-and-Play data. It also loads settings in the msdos.sys file and processes the
config.sys and autoexec.bat files. The msdos.sys file replaces the functions of the config.sys file and should
be used to make custom boot configuration settings in Windows 98. Figure 5.2 shows a basic msdos.sys file.
You can use a text editor such as notepad or wordpad in Windows 98, or edit.com at a MS-DOS prompt to
alter the settings in the msdos.sys file. However, msdos.sys is a hidden system file. You must therefore first
enable your computer system to show hidden files. Tables 5.1 and 5.2 discuss the msdos.sys file entries and
their function.
TABLE 5.1: The Msdos.sys [Paths] Section Entries

Entry Description
HostWinBootDrv=C Defines the location of the boot drive root directory.
WinBootDir= Defines the location of the necessary startup files. The default is
defined during installation and is usually C:\Windows.
www.testking.com
- 44 -
220 - 232
WinDir= Defines the location of the Windows 98 directory as specified

during Setup.
TABLE 5.2: The Msdos.sys [Options] Section Entries

Entry Description
AutoScan= Enables or disables ScanDisk to run automatically when your
computer restarts after an improper shut down. When the value is
set to 0, this feature is disabled. When the value is set to 1,
ScanDisk prompts the user to indicate if they want to run
ScanDisk; if they do not respond after 1 minute, ScanDisk runs
automatically. When the value is set to 2, ScanDisk runs
automatically after an improper shut down.
BootDelay= Sets the initial startup delay to the specified number of seconds so
as to give the user sufficient time to press F8 after the Starting
Windows message appears. The default is 2. BootKeys=0 disables
the delay.
BootFailSafe= Enables or disables safe mode for system startup. The default is 0.
BootGUI= Enables or disables automatic graphical startup into Windows 98.
The default is 1.
BootKeys= Enables or disables the startup option keys, viz F5, F6, and F8. The
default is 1. Setting this value to 0 overrides the value of
BootDelay=x and prevents any startup keys from functioning.
BootMenu= Enables or disables automatic display of the Windows 98 Startup
menu, so that the user must press Ctrl to see the menu. The default
is 0. Setting this value to 1 eliminates the need to press Ctrl to see
the menu.
BootMenuDefault= Sets the default menu item on the Windows Startup menu; the
default is 3 for a computer with no networking components and 4
for a networked computer.
BootMenuDelay= Sets the number of seconds to display the Windows Startup menu
before running the default menu item. The default is 30.
BootMulti= Enables or disables dual-boot capabilities. The default is 0. Setting
this value to 1 enables you to start MS-DOS by pressing F4 or by
pressing F8 to use the Windows Startup menu.
BootWarn= Enables or disables the safe mode startup warning. The default is 1.
BootWin= Enables or disables Windows 98 as the default operating system.
Setting this value to 0 disables Windows 98 as the default; this is
useful only with MS-DOS version 5 or 6.xx on the computer. The
default is 1.
DblSpace= Enables or disables automatic loading of dblspace.bin. The default
is 1.
DoubleBuffer= Enables or disables loading of a double-buffering driver for a SCSI
www.testking.com
- 45 -
220 - 232
controller. The default is 0. Setting this value to 1 enables double

buffering if required by the SCSI controller.
DrvSpace= Enables or disables automatic loading of drvspace.bin. The default
is 1.
LoadTop= Enables or disables loading of command.com or drvspace.bin at the
top of 640 K memory. The default is 1.
Logo= Enables or disables display of the animated logo. The default is 1.
Setting this value to 0 avoids a variety of interrupts that can create
incompatibilities with certain third-party memory managers.
Network= Safe mode with networking is not supported in Windows 98. This
value should be set to 0 or left blank to disable this feature.
Although it not recommended, you can use both config.sys and autoexec.bat to modify how Windows 98
operates. Both these files work as they did under MS-DOS. However, you cannot include any mouse support
in either file as Windows 98 has internal support for most of these devices; Windows 98 has its own disk
caching and double-buffering algorithms, so you do not need to include the smartdrv.sys command in
config.sys; the comspec, path, prompt, net start, and temp settings set in the autoexec.bat file under MS-
DOS are handled by io.sys in Windows 98; and device and memory settings should be handled via the
Device Manager or Registry in Windows 98 rather than the config.sys and autoexec.bat files.
FIG. 5.2: A Windows 98 msdos.sys File opened in Edit.com
5.3.1.3 Protected Mode Initialization Phase

Once the real mode phase is complete, the startup invokes win.com. This file manages the initial system
inspection for 32-bit operation and loads the core Windows operating system components. It loads a series
of static and dynamic VxDs, including vmm32.vxd, which is a composite VxD that contains the VMM and
www.testking.com
- 46 -
220 - 232
the real mode loader. It also invokes any other VxDs that reside in the Windows\System\Vmm32 folder. The
exact list of VxDs that are loaded varies fro one computer to another and is based on the computer’s
hardware configuration. A list of the VxDs can be determined by examining the [386Enh] section of the
system.ini file.
Once the virtual machine is running, the system.ini file is processed, and the system is fined tuned with those
settings. Next, the configuration manager is started, employing information from the Plug-and-Play BIOS,
or if the system does not have one, by developing its own device list and loading the appropriate drivers.
The configuration manager resolves any conflicts and then initializes the drivers. If a conflict cannot be
resolved, one or more of the devices may be disabled.
Once this is done, the final system components are be loaded. These include: kernel32.dll, which provides
the main Windows 98 components, krnl386.exe, which loads device drivers, gdi.exe and gdi32.exe, both of
which manage and provide the GUI, and user.exe and user32.exe, both of which provide the user interface
code.
5.3.2 Alternate Boot Processes

Alternative methods of starting a Windows 98 computer can be used to load the system into a previous
version of MS-DOS; to operate in a command-mode-only environment; or to troubleshoot problems.
Windows 98 offers two methods for bypassing the normal startup procedure and gaining access to a
command prompt or safe mode. Once at the command prompt, you can attempt to load Windows 98 by
using the win.com command and one or more switches. Table 5.3 discusses the win.com command-line
switches.
TABLE 5.3: The Win.com Command-Line Switches

Switch Purpose
/d and /d:m Start Windows 98 in safe mode.
/f Disables 32-bit disk access. This is equivalent to disabling the hard disk
controller(s) in Device Manager and 32BitAccess = FALSE in system.ini.
/m Starts Windows 98 in safe mode.
/s Specifies that Windows 98 should not use ROM address space between
F000:0000 and 1 MB for a break point. This is equivalent to
SystemROMBreakPoint = FALSE in system.ini.
/v Specifies that the ROM routine will handle interrupts from the hard disk
controller. This is equivalent to VirtualHDIRQ = FALSE in system.ini.
/x Excludes all of the adapter area from the range of memory that Windows
98 scans to find unused space. This is equivalent to EMMExclude = A000-
FFFF in system.ini.
5.3.2.1 The Windows 98 Startup Menu

If the system was shut down improperly, the Startup menu should appear the next time the computer is
booted. It can also be invoked manually by pressing the Ctrl key on the keyboard while the computer is
booting. The Startup menu has a number of options from which you can choose the appropriate mode for the
www.testking.com
- 47 -
220 - 232
desired startup method. The exact options available on the Startup menu vary from one computer to another
and is based on the system configuration and the reasons for which it was brought up. Table 5.4 discusses
the common Startup menu options and their functions.
TABLE 5.4: Common Windows 98 Startup Menu Options

Menu Option Description
Normal This invokes the normal startup procedure.
Logged (BOOTLOG.TXT) Writes startup entries to the bootlog.txt log file while starting
Windows 98. This log file can be used to isolate problems that
might be preventing the normal boot procedure.
Safe Mode Starts Windows 98 using only basic system drivers, including a
basic VGA display driver while bypassing all secondary startup
files, including the registry, config.sys, autoexec.bat, and the
[Boot] and [386Enh] sections of system.ini to allow
troubleshooting and adjustment of the system configuration
files. You can also start this option by pressing F5 or typing
win /d:m at the command prompt.
Step-By-Step Starts Windows 98 by allowing you to confirm or disable
Confirmation
startup files line by line. You can also start this option by
pressing F8 when the Startup menu is displayed.
Command Prompt Only Starts the operating system with startup files and Registry,
displaying only the command prompt.
Safe Mode Command Starts the operating system in safe mode and displays only the
Prompt Only
command prompt, bypassing startup files. This has the same
effect as pressing Shift+F5.
Previous Version of Starts the version of MS-DOS previously installed on this
MS-DOS
computer. This is only available on computers upgraded from a
previous MS-DOS environment. You can also start this option
by pressing F4 if the BootMulti=1 entry exists in msdos.sys.
5.3.2.2 The Windows 98 Startup Disk

You can also use the Windows 98 startup disk that was created when Windows 98 was installed. This disk
provides the drivers necessary to access the CD-ROM drive, enable 32-bit file system access, and start the
system in command mode. This boot method provides access to a number of troubleshooting utilities.
www.testking.com
- 48 -
220 - 232
6. Operating Windows 2000 Professional

Although Windows 2000 and Windows 98 share a common user interface, use similar file naming
conventions, and come from the same manufacturer, Windows 2000 is a radically different operating system
environment from Windows 98. Some of the key differences are Windows 2000’s ability to provide
symmetric multiprocessing (SMP) support, allowing the computer system to use more than one processor at
the same time; Windows 2000’s ability to operate applications written both to the Win32 and the Portable
Operating System Interface for UNIX (POSIX) environment; the NT File System (NTFS) that can be used
by Windows 2000 to support the security features not found in Windows 9x; and Windows advanced
networking controls.
The Windows 2000 operating system can be broken down into two components: the kernel mode and user
mode, each of which contains several subsystems that can be visualized as a series of layers.
6.1 The Kernel Mode

The kernel mode is the part of the operating system that has direct access to both the physical hardware
devices and the system data that runs on it. This is the layer that provides access to memory and prioritizes
access to system resources like. Therefore its operations are contained in a protected memory area. The
kernel mode consists of several components. These are: the hardware abstraction layer (hal.dll); the
Windows 2000 Executive; and the Kernel Mode Drivers.
6.1.1 The Hardware Abstraction Layer (hal.dll)

The hardware abstraction layer (hal.dll) enables Windows 2000 to support multiple processors and to run on
platforms built with different CPU architectures. The hardware abstraction layer is responsible for operating
the interface among all the different I/O devices on the system, interrupting controllers, and providing
platform-specific hardware support for every device on the system.
6.1.2 The Windows 2000 Executive

The Windows 2000 Executive functions as the interface between the hardware abstraction layer and the
system components contained in the user mode. The components of the Windows 2000 Executive provide
core services through a set of internal routines that make sure that two hardware or software components,
like an application, a virtual machine, or the CPU, are not allowed to access the same device at the same
instant.
• The I/O Manager processes commands issued through the user mode into I/O request packets and
services I/O operations related to device drivers. Its subcomponents include the Cache Manager, which
improves disk performance by performing reads to disks in the background and holding recent disk reads
in system memory; and low-level device drivers that directly manipulate hardware I/O.
• The GDI and Window Manager manage the display system. Both are contained within the win32k.sys
device driver. The GDI component manages the functions required for drawing and manipulating
graphics on the screen or graphics that are output directly to devices like a printer while the Window
Manager controls screen output and window displays, as well as accepting and forwarding signals from
the keyboard and pointing devices to the active application.
www.testking.com
- 49 -
220 - 232
• Client/server communications are managed by the Interprocess Communications (IPC) Manager. The
IPC subsystem requests information from the server functions of the Windows 2000 Executive. The IPC
has two components:
The Local Procedure Call (LPC) facility which manages client/server traffic that exists within a
single computer; and
The Remote Procedure Call (RPC) facility which manages client/server traffic that takes place
between two or more networked computers.
• The Security Reference Monitor (SRM) is responsible for enforcing all security policies that are
defined on the local computer.
• The Object Manager is responsible for managing all transitory objects, including threads and processes
that Windows 2000 creates during its operation.
• The Process Manager is responsible for the actual creation and ending of threads and processes.
• The Plug-and-Play Manager coordinates the operation of Plug-and-Play device drivers among the
hardware abstraction layer, the Windows 2000 Executive, the appropriate interface or system buses, and
the relevant device drivers.
• The Power Manager performs a similar function with power management APIs, coordinating events,
generating Interrupt Request Packets (IRPs), and starting and stopping devices that make use of power
management functions.
• The Virtual Memory Manager provides a private virtual memory address space for each process or
thread and protects that space against encroachment by other system objects. The Virtual Memory
Manager controls this function for physical RAM and hard disk space, as well as managing demand
paging.
6.1.3 The Kernel Mode Drivers

Kernel mode drivers act as an interface between the hardware abstraction layer and the Windows 2000
Executive. The direct control of these drivers is the responsibility of the I/O Manager. Kernel mode drivers
are divided into three layers based on their function. These are:
• Low-level drivers which are usually used to exert direct physical control over devices such as a Plug-
and-Play hardware bus. This class of drivers also includes legacy Windows NT device drivers.
• Intermediate-level drivers which include WDM drivers. These are generally Plug-and-Play function
drivers designed to control specific peripheral devices and minidrivers; and are used for tasks such as
hard disk drive mirroring.
• High-level drivers which include those drivers that operate translations between different file system
devices such as FAT, NTFS, and CD-ROM File System (CDFS) and the operating system. This class of
drivers is known as file system drivers.
6.2 The User Mode

All communications with the kernel are managed by the user mode. It also provides the APIs needed to
emulate application and network environments. This enables Windows 2000 to run applications written for
Windows 9x, MS-DOS, and POSIX. User mode is comprised of a series of subsystems of which there are
two primary groups: integral and environmental. A security subsystem which manages logon requests from
users is an example of an integral user mode subsystem. It manages all the rights and permissions granted to
www.testking.com
- 50 -
220 - 232
user accounts and controls access to resources. The Win32 environment is an example of an environmental
user mode subsystem. It functions as an intermediary between legacy Win16 and MS-DOS applications and
controls, and Win32-based applications running in a Windows 2000 environment.

The Windows 2000 Professional boot process differs from the Windows 98 boot process. The Windows
2000 Professional boot process also requires a set of files that differs from those required by the Windows
98 boot process. Table 6.1 lists these files as well as their default locations and the stages of the boot process
associated with each file.
TABLE 6.1: Files Used in the Windows 2000 Boot Process

File Location Boot stage
Ntldr System partition root (C:\ ) Preboot and boot
Boot.ini System partition root Boot
Bootsect.dos System partition root Boot (optional)
Ntdetect.com System partition root Boot
Ntbootdd.sys System partition root Boot (optional)
Ntoskrnl.exe %systemroot%\System32 Kernel load
Hal.dll %systemroot%\System32 Kernel load
System %systemroot%\System32\Config Kernel initialization
Device drivers %systemroot%\System32\Drivers Kernel initialization
Note: The string %systemroot% represents the folder in the boot partition on
which the Windows 2000 system files were placed during installation. The
default is C:\Winnt.
The Windows 2000 Professional boot sequence consists of two sequences, the preboot sequence and the
boot sequence.
6.3.1 The Preboot Sequence

During startup the Windows 2000 computer initializes the boot portion of the hard disk and begins the
preboot sequence. This sequence consists of three steps:
• The computer runs power-on self test (POST) process to determine the amount of physical memory; and
the hardware components are present.
• If the computer has a Plug and Play BIOS, enumeration and configuration of hardware devices occurs.
• The system BIOS locates the boot device and loads and runs the master boot record (MBR).
6.3.2 The Boot Sequence
www.testking.com
- 51 -
220 - 232
After the computer loads ntldr into memory, the boot sequence gathers information about hardware and
drivers in preparation for the Windows 2000 load phases. The boot sequence uses the following files: ntldr,
noot.ini, nootsect.dos (optional), ntdetect.com, and ntoskrnl.exe. The boot sequence has seven phases:
• Initial Boot Loader During the initial boot loader phase, ntldr switches the microprocessor from real
mode to 32-bit flat memory mode, which ntldr requires. Then, ntldr starts the appropriate the minifile
system drivers. The minifile system drivers are built into ntldr so that ntldr can find and load Windows
2000 Professional from partitions formatted with either the FAT or NTFS file system.
• Bootstrap Loading Windows 2000 does not presume to be the only operating system on the computer.
It also does not require that all of its primary system files reside on the primary partition of the first hard
drive, as is the case with MS-DOS and Windows 9x. Instead it uses the boot.ini file, which is read by
ntldr, to allow the user to choose which operating system to initialize and to locate the required
operating system files. This is known as a bootstrap loading process. If the boot.ini file is not present,
ntldr attempts to load Windows 2000 from the winnt folder on the first partition of the first disk. This is
usually C:\Winnt.
• Hardware Detection On Intel-based computers, ntdetect.com and ntoskrnl.exe perform hardware
detection. ntdetect.com executes if Windows 2000 should be loads. ntdetect.com collects a list of
installed hardware components and returns this list to ntldr for later inclusion in the registry under the
HKEY_LOCAL_MACHINE\HARDWARE key.
• Configuration Selection After ntldr starts loading Windows 2000 and collects hardware information,
the operating system loader process displays the Hardware Profile/Configuration Recovery Menu
screen, which contains a list of the hardware profiles that have been created on the computer, if more that
one hard profile exists on the computer. The first hardware profile is highlighted. You can press the
Down arrow key to select another profile. You can also press L to invoke the Last Known Good
Configuration option.
• The Kernel Load Phase After the configuration selection, ntoskrnl.exe, the Windows 2000 kernel loads
into RAM and is initialized. ntoskrnl.exe also loads and initializes device drivers and loads services. If
you press Enter when the Hardware Profile/Configuration Recovery Menu screen displays, or if ntldr
makes the selection automatically, the computer enters the kernel load phase. The screen clears and a
series of white rectangles appears across the bottom of the screen. During the kernel load phase, ntldr:
Loads Ntoskrnl.exe but does not initialize it.
Loads the hardware abstraction layer file (hal.dll).
Loads the HKEY_LOCAL_MACHINE\SYSTEM registry key.
Selects the control set required to initialize the computer.
Loads device drivers with a value of 0x0 for the Start entry. These are typically low-level
hardware device drivers, such as those for a hard disk.
• The Kernel Initialization Phase When the kernel load phase is complete, the kernel initializes and takes
over control of the computer system from ntldr. The system displays a graphical screen with a status bar
that indicates load status. During the kernel initialization stage four tasks are performed:
The Hardware key is created.
The Clone control set is created.
Device drivers are loaded and initialized.
Services are started.
• The Logon Phase is the last phase and begins at the end of the kernel initialization phase, when the
Win32 subsystem automatically starts winlogon.exe, which starts Local Security Authority (lsass.exe)
and displays the Logon dialog box. The user must press Ctrl+Alt+Del and enter his or her user account
www.testking.com
- 52 -
220 - 232
name and password. This allows you to log on while Windows 2000 initializes the network device
drivers. The Windows 2000 Boot process is not considered successful until a user has successfully
logged on at the computer.
www.testking.com
- 53 -
220 - 232
7. Managing and Maintaining the Windows Operating System

The Microsoft Windows operating system and data files contained on a Windows-based computer requires
periodic maintenance. Regular maintenance of the operating system and hard disk drives are critical to the
performance of the operating system. Every time a file is created, opened, or closed, and every time a new
software application or hardware device is added to the computer, the content of the file system and the
Registry is changed. Over time, the underlying organization of files on the computer becomes fragmented,
reducing system performance. In addition, numerous temporary files are also created by the operating
system on a regular basis. These are not always removed and can clutter the storage system. Early versions
of Windows lacked robust support for managing these tasks, but both Windows 98 and Windows 2000
Professional have a variety of tools that can be used to perform these tasks.
Microsoft offers periodic updates to its operating systems while many vendors offer periodic patches to their
software. You should regularly check for software updates and patches that should be deployed on all
computers that would benefit from it.
There are several things that should be done on a regular basis to keep the Windows operating and file
systems secure and running at peak performance:
• Provide virus protection.
• Remove old and unused files on a regular basis and keep adequate open space on hard disks that are used
for virtual memory.
• Scan the storage media for errors and fix any problems.
• Defragment the hard disk drives.
• Backup files and keep updated recovery disks.
• Periodically check for updates, and apply them appropriately.
In addition, the System Registry should be maintained and managed correctly.
7.1 The Windows System Registry

As a technician you must be familiar with the System Registry and the tools used to work with it: the
Windows Control Panel and the Microsoft Management Console (MMC) in the case of Windows 2000.
You will use them on a regular basis to configure, fine tune, and repair your clients’ computers.
Microsoft Windows treats all the devices, device drivers, software services, and applications that use it as
objects. The System Registry tracks and makes available to the kernel information on all those objects,
hardware, network settings, user preferences, and storage systems.
Windows 3.x made use of initialization (.ini) files to create a bridge between the application and the
Windows operating system, as well as a host of other text files such as autoexec.bat and config.sys to
manage operations. Some systems had more than 150 files responsible for the operation of the computer and
the Windows environment, many of them from third-party providers. This often resulted in erratic and
unreliable operation. It also made writing drivers and installation routines much more difficult.
During the development of Windows 3.11 a new file type called reg.dat was introduced into the
programming environment. The file was the precursor to the Windows 95 Registry. reg.dat included
information used for drag-and-drop operations, OLE (object linking and embedding), and establishing
www.testking.com
- 54 -
220 - 232
associations between data files and their programs. The reg.dat file was accompanied by its editor,
regedit.exe. Reg.dat had a size limit of 64 KB. This limitation was overcome during the development of
Windows 95.
During system startup and regular operation, the kernel, system services, background hardware detection
devices for Plug-and-Play operation, device drivers, and applications are checking with the Registry to
confirm settings. If the Registry becomes corrupt or has the wrong data for an object, it can degrade or even
halt system operation. Because of this, Windows provides work tools and safeguards to make it easy to
safely modify settings, while ensuring integrity of the Registry files. There are some differences in the
Registry structure and tools provided between Windows 95, Windows 98, Windows ME, Windows NT, and
Windows 2000 but the basics of working with the Registry for both families of Windows are the same.
The Registry is comprised of several files. Hardware- and application-specific settings are stored in one file,
user-specific data, such as user profiles, are stored in another and system-specific policies form a third,
which can be used to override settings in the other two files. During system operation, the active elements of
the Registry are brought into RAM as a single repository.
7.1.1 The Registry Root Keys

The Windows 9x Registry consists of six root keys, each of which reflects a different aspect of the
configuration. Windows NT and Windows 2000 make use of only five of the keys. The information in the
Registry is presented as a series of trees and branches arranged in a hierarchical order. Each branch of the
Registry is known as a key and groups information that logically belongs together. All top-level keys are
called root keys and are defined and named by Windows; these cannot be changed. Root keys can be
followed by several subkeys. These subkeys can be added, deleted, or renamed. The five Windows 2000
Professional root keys are: HKEY_CLASSES_ROOT; HKEY_CURRENT_USER; HKEY_LOCAL_MACHINE; HKEY_USERS;
and HKEY_CURRENT_CONFIG. Windows 98 has an additional root key named HKEY_DYN_DATA.
7.1.1.1 HKEY_CLASSES_ROOT
In Windows 9x, the HKEY_CLASSES_ROOT root key defines the standard-class objects used by Windows. You
should not make any changes to this key unless it is absolutely necessary. This key linked to
HKEY_LOCAL_MACHINE\ SOFTWARE\Classes, which provides compatibility with the Windows 3.1x
registration database to provide compatibility with Windows 3.1x 16-bit applications.
In Windows 2000 Professional, the HKEY_CLASSES_ROOT root key contains software configuration data, file
class associations, and any information needed for OLE support.
7.1.1.2 HKEY_CURRENT_USER
In both Windows 9x and Windows 2000 Professional the HKEY_CURRENT_USER root key defines the current
user settings. Personalized user settings like default fonts, desktop icons, and colors can be changed here.
7.1.1.3 HKEY_LOCAL_MACHINE
In Windows 2000 Professional, the HKEY_LOCAL_MACHINE root key is the largest key in the Registry and
contains all the data for the computer system’s non-user-specific configurations, including hardware device
www.testking.com
- 55 -
220 - 232
configuration, peripheral devices, installed software, OLE compatibility, software configuration, and
Windows operating system configuration. In Windows 9x this data is stored in the system.dat file.
7.1.1.4 HKEY_USERS
In both Windows 9x and Windows 2000 Professional, the HKEY_USERS root key is where the different user
settings are stored if the computer is configured for multiple users. If the computer is not configured for
multiple users, the HKEY_USERS root key will have a single subkey named DEFAULT. If the computer is
configured for multiple users, two profiles are created when you log on: HKEY_USERS\DEFAULT and
HKEY_USERS\<user name>\user.dat. If it is a two-user system, the other user’s settings are held in
memory. This makes it impossible to alter user settings without logging on under that user’s name and
password.
7.1.1.5 HKEY_CURRENT_CONFIG
In both Windows 9x and Windows 2000 Professional, the HKEY_CURRENT_CONFIG root key handles Plug and
Play and contains information about the current configuration of a multiple-hardware-configured computer.
On Windows 9x machines, this key works in conjunction with HKEY_LOCAL_MACHINE\Config\<subkey>,
where <subkey> that represents the numeric value of the current hardware configuration. On Windows 2000
Professional computers the HKEY_CURRENT_CONFIG root key contains the data for the active hardware profile.
7.1.1.6 HKEY_DYN_DATA
The HKEY_DYN_DATA root key only exists in Windows 9x. It is the Registry data, which is stored in RAM to
speed up system configuration. A snapshot of all hardware in use is stored here. It is updated on startup and
when any changes are made in the system configuration file. This portion of the Registry is dynamic. It is
where VxDs are installed, where Plug and Play hardware information is maintained, and where performance
statistics are calculated. Because this information is accessed and changed constantly, this portion of the
Registry is never written to the hard disk. It resides in the computer’s RAM.
7.1.2 Managing the Registry

Windows 9x offers two methods of modifying the Registry: the Windows Control Panel, which is the
recommended method or the registry editor, regedit.exe, that ships with Windows 9x. Windows 2000 offers
an additional method, the Microsoft Management Console (MMC), while also adding another registry editor,
regedt32.exe.
7.1.2.1 The Windows Control Panel

The Windows Control Panel is the most commonly used tool for modifying the Registry or adjusting the
computer system’s configuration. Although there is a slight difference in the organization and number of
tools contained within the Control Panel, it operation is virtually the same in all versions of Windows. You
can open the Control Panel by clicking on the START button to display the Start menu, point to
SETTINGS, and then click on CONTROL PANEL.
www.testking.com
- 56 -
220 - 232
FIG 7.1: The Windows 98 Control Panel
The System Properties is one of the Control Panel components. It provides detailed information on the
system configuration and often helps pinpoint components that are not working properly or do not have
properly functioning drivers. To access it, double-click the System icon. This opens the General tab of the
System Properties dialog box which provides the version of the operating system in use; if it is registered
and to whom; and system information related to the CPU, computer type, and the amount of RAM. The
string of numbers in the registration information portion uniquely identifies this installation of Windows and
is tied to the registered user. You need this number to call Microsoft for support in connection with this
machine.
The Device Manager tab of the System Properties dialog box can be used to identify the components on the
computer, determine if they are functional, and provide detailed information about the device driver. In
Windows 9x click the Device Manager tab in the System Properties dialog box to display the Device
Manager tab. If you are using Windows 2000, click the Hardware tab, and then click the Device Manager
button. With Windows 2000, you can use Device Manager to manage the Registry on remote computers if
you have the proper administrative credentials to work on the remote system and it is configured to provide
this feature. When you right-click on one of the device icons that are displayed in the Device Manager
window and click Properties on the popup menu, a detailed information about the specific device is shown.
All this information is taken directly from the Registry and when you modify the information, the Registry
www.testking.com
- 57 -
220 - 232
is updated with your changes. The General tab of the Device Manager tab shows whether the devices on the
computer are working properly or not. If the device is not working properly, has been disabled, or has
produced a conflict with another device on the system, its icon appears with either a yellow caution or a red
warning circle placed over a portion of the icon.
7.1.2.2 The Microsoft Management Console (MMC)

Windows 2000 Professional also provides a number of Microsoft Management Consoles (MMCs) that are
also referred to as administrative tools and can be used to modify the registry, managing tasks and
troubleshoot the Windows 2000 Professional operating system. These MMCs are available from the
Administrative Tools folder found inside the Windows 2000 Professional Control Panel. MMCs generally
offer easier access and provide some utilities not directly available in the Control Panel. Windows 2000
Professional has a set of built-in administrative tools, but third-party vendors and administrators can build
custom consoles and utilities called snap-ins.
7.1.2.2.1 The Event Viewer Snap-In

Windows 2000 Professional tracks every event that occurs on the computer system and recodes this
information to a series of logs:
• The system log, which contains a listing of all internally generated warnings, errors, and critical events
related the operation of the system;
• The security log, which monitors all attempts to access the system, recording whether they succeed or
fail, and tracks any other security parameters set as part of a system policy; and
• The application log, which tracks the operation of applications that run on the computer system and
records any errors, warnings, or other events that are related to a specific application.
The Event Viewer snap-in shown can be used to examine these log files.
7.1.2.2.2 The Disk Management Snap-In

Windows 2000 and Windows XP support two types of hard disk storage: basic storage and dynamic
storage.
• Basic storage is the same type of storage that is found on most other operating systems. Basic storage
uses a program like fdisk to divide the drive into partitions; once created, these partitions cannot be
modified without destroying the data on them.
• Dynamic storage is unique to Windows 2000 and Windows XP. Drives initialized using the dynamic
method are set up as a single partition that spans the entire physical disk, but is not limited to a single
disk; therefore, a single volume can span several disks. In addition, you can create mirrored and striped
volumes to improve performance or combine several of these into a Level-5 RAID to increase data
security.
The Disk Management snap-in is used to mount dynamic volumes, create partitions, set up or convert file
systems, and dynamically allocate storage space. When an unpartitioned and unformatted hard disk drive is
added to a Windows 2000 computer, it is displayed in the Disk Manager snap-in as a foreign disk. Right-
clicking on it in the Disk Management snap-in invokes a wizard that allows you to prepare the disk for use
and import the new disk into the system. Basic disks can be upgraded to dynamic disks at any time using a
www.testking.com
- 58 -
220 - 232
similar wizard. Right-clicking on a disk shows all system information concerning the disk, including its
capacity, space allocation, type, capacity, status, adapter information, and volume information. Network
administrators with appropriate permissions on a Windows 2000 server can use the MMC to manage disks
on any other computer running Windows 2000 within the province of the domain or of a trusted domain
from any other computer running Windows 2000 on the network.
7.1.2.3 The Registry Editors

In both Windows 9x and Windows 2000 Professional, you can use regedit.exe to view or change the
Registry entries. In Windows 2000 Professional you can also use regedt32.exe. The latter has a security
menu and support several commands that are not available in regedit.exe. Neither of these two Registry
editors is available from the Start menu. Instead you must enter the appropriate command name in the RUN
dialog box to start the editor. These editors change the Registry in real time, in other words, your
modifications are effected immediately as they are made.
Regedit.exe can also be used from inside real-mode MS-DOS and is available on the Windows 98 startup
disk that is created during the installation of the operating system. When you use regedit.exe in real-mode,
you must provide it with the location of the two key Windows 9x Registry files: system.dat and user.dat.
You must also use command-line switches to perform registry modifications when running regedit.exe in
real-mode. Table 7.1 lists the most common regedit.exe switches.
TABLE 7.1: The Regedit.exe Command-Line Switches

Switch Function
/? Displays the regedit.exe command-line syntax
/L:system Provides the location and filename of system.dat
/R:user Provides the location and filename of user.dat
/E <filename> <regpath> Creates a Registry (.reg) file
/C <filename>
Replaces the entire Registry with the contents of your .reg
file
7.1.2.4 Backing Up the Windows 98 Registry

You should backup the Registry before making any changes to it, including when these changes are made in
the Control Panel or an MMC. In Windows 98 you can backup the registry by using the Registry Checker,
which is a command-line application named scanregw.exe. To run the Registry Checker, click on the
START button, click on RUN and type scanregw.exe in the RUN dialog box. The Registry Checker first
scans the Registry and makes sure that the files are sound before allowing you to backup the Registry. When
you do backup the Registry, the Registry Checker copies the Registry files and store them in a Windows
cabinet (.cab) file in the \Windows\Sysbckup directory.
7.2 Anti-Virus Protection

Viruses are little programs that can wreak havoc on a computer and its data. Many viruses are simple
annoyances, but some of them can cause irreparable harm to files. Viruses can be caught from various
sources including shareware, files downloaded from the Internet, software from unknown origins, and
bulletin boards.
www.testking.com
- 59 -
220 - 232
There are several different types of viruses:

• File infectors attach themselves to executable files and spread to other files when the program is run.
• Boot sector viruses replace or hide inside the master boot record or boot sector on a floppy disk and
write themselves into memory any time the computer is booted.
• Trojan horses are disguised as legitimate programs, but harm the system when loaded.
• Macro viruses attach themselves as executable code inside a document such as a Microsoft Word
document and run when the document is opened.
• Polymorphic viruses modify themselves over time and replicate new forms. This makes them both
unpredictable and harder to detect.
There is no complete defence against the threat of viruses, but virus detection and remedial software should
be used to minimize the threat. Anti-virus software can be purchased and downloaded from the Internet or
obtained through computer retail outlets. Because viruses change rapidly and new ones appear regularly, you
should purchase anti-virus software that provides free or low-cost regular upgrades. The anti-virus software
must be compatible with the version of Windows on the computer.
In addition to anti-virus software, you could also disable boot-sector writes if the computer has a BIOS
setting that allows you to; be careful when reading a floppy disk of unknown origin or using your disk on an
unfamiliar computer; and use extreme caution on the Internet when you download files, especially if they
come from sources other than a manufacturer’s Web site.
7.3 Disk Cleanup

Cleaning up old files that are no longer used not only saves disk space and reduces backup time but also
improves file system performance. Both Windows 98 and Windows 2000 have Disk Cleanup wizards that
are available on the System Tools menu. These Disk Cleanup wizards scans the file system to identify
temporary files, unnecessary program files, files that have been moved to the Recycle Bin, and Internet files
that are cached locally on the disk. It then allows you to select which of these files are to be deleted.
7.4 Maintaining Drive Integrity

ScanDisk can be used to maintain the integrity of hard disks drives, floppy drives, RAM drives, and some
memory cards. It inspects the file system on these devices and can fix problems while the system is in use.
ScanDisk is available in both a command-line version and one that operates within the Windows GUI. It
works with compressed drives set up using DoubleSpace and DriveSpace. It can inspect the physical surface
of the drive for bad sectors; inspect the file structure, compression structure, and volume signatures of any
compressed drives; locate and repair crossed-linked files and lost clusters; verify the integrity of FAT16 and
FAT32 file systems; and verify and repair problems with the directory tree structure of a drive.
ScanDisk operates in two modes: standard and thorough. In standard mode, Scandisk performs a check of
both files and folders while in thorough mode it inspects the integrity of the disk drive’s physical surface in
addition to checking the files and folders. You can also set ScanDisk to run automatically and fix errors or
to prompt you before making any corrections.
Windows 2000 Professional has a similar tool that is accessed in the PROPERTIES dialog box for a disk
drive. Open the TOOLS tab and select the ERROR-CHECKING option. Click OK to start the program if
www.testking.com
- 60 -
220 - 232
the disk is not shared and in use. If the disk is shared and in use, the program will be set to run automatically
the next time the computer is started.
7.5 Hard Disk Fragmentation

Operating systems, applications and users constantly create, open and close files. The file systems do not
necessarily place data on the storage media as a single block when they write a file to disk. As a result, over
time, the files on the drive can be spread across different sectors of the hard drive. When files are spread
over different sectors of a hard drive, the drive is said to be fragmented. This fragmentation can seriously
degrade system performance, as each time a file is opened it must be gathered from several places and stored
in memory.
Disk Defragmenter can be used to analyze the amount of fragmentation on a disk and can rearrange the disk,
placing the files in contiguous blocks. The newest versions of Disk Defragmenter have logic that makes
them aware of the way the operating system reads executable and dynamic-link library (DLL) files, so they
can place clusters in the order they are read. Both of these operations can significantly improve system
performance. This utility should be run at least once a month.
You can schedule the defragmentation to take place when the computer is not in use though screen savers
and other programs that run in the background should be disabled during defragmentation.
7.6 File Backups

Data loss is inevitable as hard drives do fail and critical files do become corrupted. The best way to ensure
that your client’s critical data is secure is by developing an automated backup strategy. Windows has built-in
backup software that supports a variety of storage media, including tape drives, hard drives, or removable
media. However, in Windows 98 it is not installed by default and must add via the Add/Remove Software
component of the Control Panel. Third-party vendors provide additional backup software that can write to
CD-R, CD-RW, DVD-RAM, and other forms of inexpensive, high-volume media.
7.6.1 Developing a Backup Strategy

When developing a backup strategy you must take into account the amount of data to be backed up, the
frequency of backup, and the available backup hardware devices. The various Windows file systems provide
an attribute that can be attached to a file to indicate when it was backed up. When these files are altered, the
attribute is reset. This attribute can be used to filter which files are copied based on the last time they were
backed up or if they have been backed up at all.
There are five different types of backups based on frequency and which files are added to the archive. With
some versions of software, you must select the files manually, whereas in others a wizard or a predefined
file list determines what data is moved to the archive. The backup types are:
• Normal backup. Copies specifically selected files to the archive, no matter when the files were last
backed up or if they have been modified. You can choose individual files or entire drives and directories.
When instituting a backup plan, the first step should be to create a normal copy of every important file.
As each file is copied, it is marked as having been backed up.
• Straight copy backup. Similar to normal backup, copies all selected files, whether they've been backed
up recently or not. The difference is that it does not mark the file as having been backed up. This is
www.testking.com
- 61 -
220 - 232
useful if you are making a separate backup copy of a set of files, because it will not exclude them from
the next regular backup.
• Daily backup. Copies all the selected files modified on the date the backup was performed. The files are
not marked as being copied to the archive.
• Incremental backup. Copies just the files that have been created or modified since the last regular
backup. This process changes the archives setting on the file when it is copied. Incremental backup is
used in combination with normal backup. If it is necessary to restore a drive, the last normal backup is
placed back on the volume, followed by the contents of the most recent differential backup.
• Differential backup. Archives only those files that do not show that they have been backed up since the
last normal or incremental backup.
A backup strategy incorporates different backup methods into a series of regular copies of data that produces
an archive refreshed frequently enough to meet the user’s needs. In some cases, backups must be very
frequent and complete because core data is constantly changing. In other cases, most of the files hardly
change at all, so infrequent differential copies may work.
The amount of data and the backup frequency will also dictate the type of hardware to be used. Inexpensive
external storage devices like a Zip drive can be used for low-volume applications. For high-volume, high-
speed archiving, one or more high-speed SCSI tape drives or a redundant array of independent disks (RAID).
Your backup copies should be stored in a safe, environmentally sound, and secure location with a second set
kept off site in case of fire or other disaster.
7.6.2 Backing Up the Registry and Critical System Files

One of the most important parts of the system backup is the system Registry. Windows 9x and Windows
2000 use the Registry to store critical configuration data. Any time you need to edit the Registry, either by
adding a new piece of software or hardware, or by using the registry editors, you should create a full backup
of critical system files. These procedures are not the same for Windows 98 and Windows 2000 Professional.
• In Windows 2000 Professional, when you perform a backup and select the System State option in the
BACKUP Tab, all the critical system files are backed up automatically. This includes the boot files; all
the files contained in the %system root%\System 32\ CatRoot\F750E6C3-38EE-11D1-85E5-
00C04FC295EE folder; the Registry; the database that contains all the registration information for the
Component Services Class portion of the kernel; and the information maintained by the system on the
Performance Counter Configuration. You must be logged on with administrator privileges or be a
member of the backup operators’ group to have access to the Backup tool or the Backup Wizard.
• In Windows 98 you can backup the registry by using the Registry Checker, which is a command-line
application named scanregw.exe. To run the Registry Checker, click on the START button, click on
RUN and type scanregw.exe in the RUN dialog box. The Registry Checker first scans the Registry and
makes sure that the files are sound before allowing you to backup the Registry. When you do backup the
Registry, the Registry Checker copies the Registry files and store them in a Windows cabinet (.cab) file
in the \Windows\Sysbckup directory.
7.7 Checking Critical System Files
www.testking.com
- 62 -
220 - 232
System files can be corrupted for a variety of reasons, including improper system shutdown, problems with
disk media, or a new application improperly overwriting a necessary driver with its version. In both
Windows 98 and Windows 2000 Professional, the Windows File Protection (WFS) system is used to
minimize this. The WFP system tracks all changes to system files and makes sure that any new files
assigned to replace a protected file are valid. It also sends a message to the system administrator when an
improper file replacement of one of these protected files is attempted.
The WFP system includes the System File Checker (SFC) utility, which can be run at the command prompt
to verify the versions of all system files under protection and reload saved copies from a hidden cache. The
SFC reports any files that do not match the SFC default.sfc file. If you know a specific system file shown on
the list is corrupt or missing or you expect it is the cause of some problem, you can extract it from the
Windows installation disk using the SFC Extract option. In SFC, choose Extract One File From
Installation Disk, enter the full filename when prompted, and click Start. Then give the program the
location of the disk with the file and where you want it to be copied. When you click OK, the SFC extracts
the file to the desired location.
7.8 Creating Emergency Repair and Startup Disks

Every Windows computer should have either a Startup disk or an Emergency Repair Disk (ERD). The
Windows 95 or Windows 98 Startup disk is the same for all computers using that version of the operating
system. You can also use a Windows 98 Startup disk to start a Windows 95, Windows 2000 or Windows NT
computer as long as the file system is compatible. You will also be able to view and work with files on the
computer. However, you should use the utilities on a disk for only that specific version of Windows with
which the system Startup disk was created. Windows 95 and Windows 98, offer the option of creating a
startup disk during the installation of the operating system but you can also create a startup disk at the
Add/Remove Programs component of the Control Panel, and clicking the create Start Up Disk tab.
The Windows 2000 and Windows NT Emergency Rescue Disk (ERD) is different. These disks are specific
to the computer on which they were created. They contain three files: autoexec.nt, config.nt, and setup.log.
These are copies of the files with the same name that are contained in the %SystemRoot%\Repair folder. The
autoexec.nt and config.nt files are used to initialize the MS-DOS environment while the setup.log file is used
by the Windows 2000 and Windows NT emergency repair process. The ERD should be updated when ever a
change is made to the structure of the operating system or when new hardware is added to the computer.
In Windows 2000 a wizard can be used to create the ERD. It is located in Programs\Accessories\System
Tools\Backup. The ERD should, however, not be used to repair Registry problems.
www.testking.com
- 63 -
220 - 232
8. Troubleshooting Microsoft Windows

The Microsoft Windows operating system is not perfect and will require troubleshooting from time to time.
The operating system design is complexity and its need to interact with the hardware components means that
the problems a technician encounters are diverse and sometimes very difficult to isolate. Fortunately,
Windows does include a number of tools that can be used for trouble shooting purposes.
8.1 The Basic Windows Troubleshooting Approach

As with hardware troubleshooting, the successful Windows troubleshooting requires correct planning and
involves a number of steps, start with information gatherings. You should analyze the problem and eliminate
any common problems by resolving them. Then, identify the source of a problem, produce a plan, and
execute it.
When gathering information, the natural place to begin is with the user’s complaint. Determine if the system
has worked and if the problem is random or recurring. Gather information about the system configuration
and the operating system. Locate any backups, startup disks or Emergency Repair Disks (ERD), or other
external diagnostic or recovery tools. Find out if the user was presented with any error messages and exactly
what he or she was doing when the system failed. If there appears to be a hardware problem, that must be
resolved before any work on the operating system proceeds. Find out if any hardware or software was
installed just prior to the failure.
Next, determine if the computer will boot. If the computer does boots, determine if you need to move or
back up data files for the user before you proceed with repairs. Then try to generate the failure yourself. If
the computer does not boot into normal operation, attempt to boot into safe mode. Identify any obvious
problems.
It is important to focus on a single issue at a time, even if there are multiple problems on the system. Prepare
a list and prioritize the problems. If you locate a problem that may resolve the issue, repair it and make sure
that there are no other problems. Work in the operating system until you are sure that there is no other
problem that caused the problem you just resolved. If the problem was due to lack of regular maintenance,
operator error, or some other easily identifiable cause, take steps to eliminate the potential for further harm
to the system.
Both during the operation and at its conclusion, be sure to document your findings, the steps you take, the
results, and any requirements for follow-up action. If there are things the user should do, be sure to write
them down and present them with a copy.
8.2 Performing Differential Diagnosis

To identify a problem and pinpoint a resolution, it is often useful to employ a technique known as
differential diagnosis. This means examining the behavior of the computer system, matching that behavior
with possible problems, and filtering out the most likely causes.
If someone complains of a computer that freezes every time a certain application is launched, then that
application is a likely starting point for investigation. At the same time, the real problem might lie in a new
video driver or a corrupted data file in use by the program. As with hardware troubleshooting, listening
www.testking.com
- 64 -
220 - 232
carefully, using a step-by-step process to eliminate other potential causes, good documentation and
experience are valuable tools.
In developing a differential diagnosis, you contrast possible causes and work to eliminate all but one. You
then validate your assumption by seeing if there is a demonstrable problem with that component. If there is,
and fixing it makes the underlying problem disappear, then you have empirical proof that your diagnosis
was correct. If not, you must proceed with the process of elimination.
8.3 The System Operational Cycle

When working on operating system problems, a differential diagnosis can start with observing where in the
operational cycle the problem occurs. The system operational cycle can be broken into three components:
• System startup, which begins at the point at which the operating system starts to load and it ends when
the user can start making use of the operating system;
• The operating phase, which is when the operating system is operational and the user can make use of it;
and
• System shutdown, which begins when a user issues a shutdown command and ends when the operating
system is unloaded from memory.
There is a natural order to working through these phases. If the operating system starts, you can move on to
the operating phase. If the operating system fails to start, you have to resolve that issue before going further.
8.3.1 Resolving System Startup Problems

The failure of a computer to properly load the operating system properly can usually be traced to a hardware
problem or difficulty related to new drivers or software. The first step in resolving such a problem is to
identify any changes that have been made to the operating system by the installation of new software
addition or software updates; the uninstalling of software; or installation or removal of hardware
components in the computer. You should also ask for copies of the system configuration, emergency startup
or recovery disks, and backups of core system files.
You should also assess the computer skill level of the user as it is possible that a novice may have shut down
the system improperly or accidentally erased critical system files. If the computer is connected to the
Internet or LAN, or the user has just loaded files from another computer, a virus may be the cause of the
problem.
Both Windows 2000 and Windows 98 offer some tools to gain access to the system even when the operating
system cannot be loaded. These may not work in all cases, but they usually work if it is only a software issue
or if the hardware problem can be resolved without having to reformat the hard disk or replace it.
Before actually attempting to boot a system that is exhibiting operating system problems, you should make
sure that the computer meets the system requirements for running the operating system involved and that the
components are all compatible. This information is available on the Microsoft Web site. Also check for the
latest drivers for major system components like the display adapter and any hard disk controllers.
www.testking.com
- 65 -
220 - 232
You should also make sure that the system is receiving adequate, clean power. If there are no obvious
hardware problems, you may wish to enable the BIOS virus checker or use a third-party anti-virus program
to see if a virus infection is preventing the computer from loading the operating system.
During startup you should observe all messages on the screen and make sure that the POST executes
properly. Problems during this phase are directly related to hardware. If new hardware has just been added,
try removing it and then restarting the system. If that does not resolve the problem or there have been no
recent hardware additions, boot the computer in safe mode. This loads the operating system with only a
minimal set of drivers and a simple 16-color VGA display. To enter safe mode press F8 just after the POST
completes. This will display the startup menu, which offers several alternate methods of booting the system.
If the critical system files have been corrupted, it may not be possible to boot the computer in safe mode. If
the hard disk is still functional, you may attempt to start the system in command mode. This is another
option on the start menu that is displayed when you press F8. If possible, you should try to work within safe
mode, rather than using the command mode alone. Safe mode offers access to a wider variety of tools to
help isolate and repair problems. Many of the regular Windows system management tools are available in
safe mode, whereas in command mode most of the diagnostic and recovery tools are variations on the old
MS-DOS utility programs.
If the system manages to boot properly, you can proceed to the operating phase.
8.3.2. Resolving Operational Phase Problems

Applications, network connections, or system services that do not work are usually isolated problems. The
very nature of the problem usually pinpoints the area where the difficulty resides. If the device attached to
the system is not working, it may be related to a specific driver or a conflict with another device. Erratic
problems during operation that cannot be directly pinpointed to a specific application or device can be more
difficult to diagnose. In most cases, systemwide devices or services like virtual memory or display drivers
are likely causes.
If you can boot the computer in safe mode, there are a variety of tools available that can be used to
troubleshoot and repair the computer system. Table 8.1 discusses these tools and their functions.
TABLE 8.1: Windows Troubleshooting Tools

Tool Description
Microsoft System This is one of the most useful diagnostic tools available both
Information (MSI) Windows 98 and Windows 2000. It can display virtually every
aspect of a computer system’s settings and resources. The exact
features available vary with the operating system involved.
Anyone working as a technician on any Windows system should
become familiar with this tool. In Windows 2000 the MSI is a
Microsoft Management Console (MMC) snap-in.
Computer Management Windows 2000 has a number of MMC snap-ins that provides
easy access to a variety of maintenance and management tools
including the MSI tool and the Device Manager.
Device Manager In both Windows 98 and Windows 2000 is a part of the System
Properties component of the Control Panel. It provides some of
www.testking.com
- 66 -
220 - 232
the same functionality found in the MSI tool, but it does not offer
a complete and collected set of reports, or a number of other
troubleshooting tools.
System Configuration In both Windows 98 and Windows 2000 this tool is incorporated
Utility and System into the help structure and provides interactive troubleshooting
Troubleshooter support. By answering questions, the user is presented with
various possible resolutions to common problems.
System Services In Windows 2000, this utility is one of the administrative tools
Window components. It shows what services are running on the machine,
their current status, and how they are started. It can be used to
stop services for troubleshooting.
Microsoft System On a Windows 98 based computer, this program installs a
Recovery minimal Windows 98 environment that provides full access to
32-bit application programming interfaces (APIs) and device
drivers, and works with Microsoft backup to recover files. It is
located on the Windows 98 distribution disk in the \Tools\Sysrec
folder, with the filename pcrestor.bat.
Windows Maintenance In both Windows 98 and Windows 2000, these scheduling tools
Wizard and Task can be used to automatically run tools such as Backup,
Scheduler ScanDisk, and DiskDefragmenter at regular intervals.
Dr. Watson In both Windows 98 and Windows 2000 this system utility can
be routed to track system events when application faults occur. It
creates a log with a .wig extension in the \Windows\Drwatson
folder. The log includes an indication of the application that
caused the error and the related memory addresses.
Boot log All versions of Windows 9x and Windows NT can produce a
complex log detailing every aspect of system startup. The
contents of this log can be examined in a text editor. They are
invaluable in trying to track down random system startup
problems.
Microsoft Backup This program exists in various editions in both Windows 98 and
Windows 2000 but is not automatically installed in Windows 98,
and can be used to both back up and restore the entire system or
selected files.
Registry Checker Both Windows and MS-DOS-based versions of the Registry
Checker are available in both Windows 98 and Windows 2000. It
can be used to perform a variety of Registry-related tasks
including editing, backing up, and restoring the Registry.
Registry Editor There are two versions of the registry editor: Windows 98
includes regedit.exe while Windows 2000 includes both
regedit.exe and regedt32.exe. The latter should be used under
Windows 2000 for full-featured editing capability.
Windows Update In both Windows 98 and Windows 2000, the Windows Update
tool offers an online method of quickly identifying and applying
www.testking.com
- 67 -
220 - 232
updates to various Windows components and related applications

such as Microsoft Internet Explorer. It works in conjunction with
special Web pages at the Microsoft Web site.
Recovery Console In Windows 2000, the Recovery Console is a special text-mode
operating environment for MS-DOS operations. It offers
sophisticated tools to start and stop services, repair the Windows
2000 operating system, and fix damaged drive volumes. It allows
access to FAT16, FAT32, and NTFS volumes.
Automatic Skip Driver In Windows 98 this utility located in the \Windows folder under
Agent the name asd.exe and can be used to detect and skip over device
drivers that are interfering with the Windows startup process.
IPConfig and Winipcfg Winipcfg in Windows 98 and ipconfig in Windows 2000 are
command-line utilities that can provide information about the IP
address for the computer and can be used to diagnose network
problems related to TCP/IP configuration.
Ping Ping is a command-line utility that can be used in both Windows
98 and Windows 2000 to perform a simple TCP/IP test that can
check the network connectivity of a computer.
Error messages Both Windows 98 and Windows 2000 provide a variety of
messages under all their operating environments to warn the
operator of difficulties. The most serious error message is
sometimes referred to as the blue screen of death, which signifies
a fatal error that causes a system to stop. In Windows 2000, these
error messages bear a code that can be looked up for help in
pinpointing the problem and its resolution. They also usually
include additional information about what processes, files, and
memory addresses were involved in the error.
Event Viewer Windows 2000 has an Event Viewer, available in the Control
Panel, which tracks system, application, and security operations,
errors, and faults.
System logs Both Windows 98 and Windows 2000 provide a variety of logs
that track various aspects of system operations and problems.
System File Checker In both Windows 98 and Windows 2000, the System File
Checker (SFC) is an application that scans the system and
monitors changed, deleted, or corrupt system files.
Signature Verification In both Windows 98 and Windows 2000, this tool determines
Tool whether a file has a valid digital signature and if the file has been
modified since being given that signature.
Digital Signature Check In both Windows 98 and Windows 2000, this program allows
network administrators to identify whether drivers have been
digitally signed by Microsoft. It can be turned on either by using
the Policy Editor in Windows 2000 or by direct modification to
the Registry.
Windows and MS-DOS These are user tools that automate the reporting process so a
www.testking.com
- 68 -
220 - 232
report tools remote technical support service or the on-scene-technician can

obtain a complete report concerning the system files.
Performance Monitor In Windows 2000, the Performance Monitor is a tool available
and System Monitor through the Control Panel, under Administrative Tools. This is a
very sophisticated graphing tool that can monitor the
performance of the major system components in great detail. The
results can be viewed directly and saved in a spreadsheet and
database formats, or using other analysis tools. Results can also
be logged. In Windows 98, the System Monitor provides a less
sophisticated series of real-time reports about how various
system processes are performing.
8.3.2.1 Using the Windows 2000 Computer Management Snap-In

The Computer Management component of the MMC is a very useful tool for monitoring system events,
managing system services, accessing MSI, accessing the Device Manager, and monitoring remote systems.
You will however require administrator privileges for full access to all of Computer Management’s features.
You can access the Event Viewer, system information, and the majority of the diagnostic tools mentioned by
clicking the Tools menu and making a selection. The new MMC interface avoids the back-and-forth hassles
of the Control Panel, and the user with the proper privileges can customize the contents to suit personal
habits or the common tasks performed.
8.3.2.2 Using the System Configuration Utility

The Windows 98 operating system offers the System Configuration utility as part of Information Manager,
available from the Tools menu. This is a very useful tool for examining startup files and system initialization
settings. If you are having trouble starting a system and can enter safe mode, this should be one of your first
stops.
You can use the System Configuration utility from the Startup menu by selecting the Step By Step
Confirmation option on the start menu to debug problems with Windows startup. You can narrow the
problem area by disabling certain options during startup using System Configuration. Once you have
narrowed the field, enable the offending section and choose a step-by-step confirmation mode. In most cases,
the system hangs just after you select the offending driver or device. You can then disable it and resolve the
issue in normal startup mode.
8.3.2.3 Using the Device Manager

All current versions of Windows have a version of the Device Manager. If you suspect a hardware device is
not loading properly or has stopped functioning, you can confirm it a quickly by checking the Device
Manager. If the device is not responding properly, or if there is a problem with the driver, the Device
Manager will have a colored marker over the device’s icon. A red dot means a critical error, such as a
hardware conflict with another device or a memory error, has completely stopped the device from working,
while a yellow dot indicates a less serious problem.
If a device is incorrectly configured or incorrectly communicating with the operating system, you may see a
device shown that is not really on the system or may appear twice. If Windows does not know exactly what
device it is, it may represent it with a question mark shaped icon. You can use Device Manager to
www.testking.com
- 69 -
220 - 232
investigate whether Windows is seeing the proper driver and whether it is working. It also shows hardware-
specific conflicts that it can recognize. These kinds of errors occur most often with problems with Plug and
Play compatibility for legacy devices. If newer drivers are available, remove the older driver, then try
installing the newer one. If you see multiple devices listed where only one exists on the system, right-click
each one and select Remove. Reboot the system and see if the problem has been resolved; if not, you may
have to work deeper in resolving the settings on the individual device. This can all be accomplished within
Device Manager.
8.3.3 Resolving Shutdown Problems

Computers that unexpectedly hang during normal operation, shift into restart mode without warning, or
refuse to close when a proper shutdown command has been given are often some of the most difficult to
diagnose and repair. This type of problem can stem from faulty device drivers, or applications, memory
management problems, or hardware problems.
Shutting down Windows improperly can leave the operating system in an unstable state and can lead to
corrupted files. Shutdown issues should be resolved, rather than just turning off the power to the computer.
A computer often hangs during shutdown due to an application that is not properly releasing control or a
process that is not terminating. Two of the most valuable tools for resolving these problems are selective
startup and the Windows 2000 Task Manager. By selectively choosing which options are installed on the
system during operation, you can isolate the problem. If a feature is disabled and the system begins to shut
down normally, you may have identified the cause.
8.3.3.1 The Windows 2000 Task Manager

Windows 2000 has a Task Manager which is not available in Windows 9x and can be accessed by pressing
Ctrl+Alt+Del while the computer system is running. The Windows 2000 Task Manager has three tabs:
Applications, Processes, and Performance. Task Manager displays which applications and processes are
running and how the system is using CPU and memory resources. Extremely high CPU usage is an
indication that something is not running correctly, or that the system is running low on resources and needs
to be reconfigured. If you suspect an application is causing a problem, close it and observe the relative
change in system resources. You can also use Task Manager to shut down an application or process that
refuses to close normally. In Windows 9x there is a less functional Close Program utility that merely lets you
end a specific task or shut down the computer. The Task Manager Performance tab displays system usage in
real time. You can leave it running on top of other applications to track the effects starting and stopping a
program has on the system.
8.3.3.2 The Windows 98 System and Resource Monitor

Windows 98 also offers performance metering similar to that offered by Task Manager in two separate
utilities, System Monitor and Resource Meter. System Monitor provides real-time reports about how various
system processes are performing. It displays various functions in a line, bar, or a numeric graph. To run
System Monitor, from the Start menu, select Programs, Accessories, System Tools, and System Monitor. By
default, the System Monitor shows only the Kernel Process Usage setting. You can control the items you
monitor by selecting Add Items from the System Monitor Edit menu or by clicking the Add Items button in
the toolbar. Two useful items are the kernel, which tracks CPU usage, and the Memory Manager, which
tracks allocated memory, cache size, and swap file size.
www.testking.com
- 70 -
220 - 232
These tools can help you determine whether it is time to upgrade a computer. If the processor is constantly
running at more than 75 percent, it might be time to upgrade. Also, if the total allocated memory exceeds the
amount of RAM in the computer, it might be time to add more RAM.
8.4 Troubleshooting and Recovering the Registry

8.4.1 Troubleshooting Windows 9x Registry
Each time a Windows 9x based computer system is started, the Registry Checker automatically inspects
and backs up the Registry. If it finds errors, the Registry Checker first tries to fix the problem itself by
restarting the computer and examining the current Registry file in scan mode fixing the problem and then
starts the operating system normally. If the problem creates a situation in which there is not enough memory
to run the Registry Checker, you are prompted to reboot the system and run the program yourself. To do so
you must start it at a MS-DOS prompt with the /fix switch. Reboot the system and press F8 as soon as the
POST is completed. Choose the Start With Command Prompt Only mode option, and type scanreg
/fix at the MS-DOS prompt.
If a Registry is fatally flawed or cannot successfully boot the system, you have to replace it with a backup
copy. You will need to restart the system in MS-DOS mode. Once you are at the prompt, start the Registry
Checker in restore mode by typing scanreg /restore. The program starts and displays a list of the
compressed Registry files, along with the date and time on which they were created. Beside each file listing
you will see either the words started or not started. This indicates whether that copy of a backup Registry has
ever actually started Windows successfully. Select the last good backup of the Registry. If you recently
installed new hardware, which may be causing the problem, you may wish to remove it from the system
before attempting the registry repair. The system default for a maximum number of Registry backups is five,
although an administrator can change this using the Scan Registry program.
8.4.2 The Windows 2000 Recovery Console

Windows 2000 uses the Recovery Console to restore a damaged or corrupted Registry but you must have
regularly created an ERD every time a significant change is made to the computer system that modifies the
Registry. If you use the ERD that was made when the system was first installed, the Registry is set back to
the initial version at the time setup was complete. This means that any changes to the system are lost. If this
produces conflicts that cannot be resolved due to subsequent changes to the operating environment or the
computer configuration, the system still may not start.
The Recovery Console is a command-line interface that can be used to perform a variety of troubleshooting
and recovery tasks, including
• Recovering the Registry;
• Starting and stopping services;
• Reading and writing data on a local drive; and
• Formatting hard disks.
However, the Recovery Console is not automatically installed during a normal Windows 2000 setup but you
can install the Recovery Console from the Windows 2000 Professional Installation CD by running the
winnt32 command with the /cmdcons switch from the command prompt. After Recovery Console is
installed, you can access it from the Please Select Operating System To Start menu. You can also use the
www.testking.com
- 71 -
220 - 232
Windows 2000 Professional Installation CD to start your computer and then select the Recovery Console
option when you are prompted to choose repair options.
Note: You can instruct the Windows 2000 Setup program to install the Recovery Console
when you install Windows 2000 Professional by installing Windows 2000 Professional
with the winnt command and adding the /e and /cmdcons switches. The /e switch
specifies that the Windows 2000 Setup program must run a command after the final
stage of the installation of Windows 2000 is finished and the /cmdcons switch specifies
that the command must install the recovery console onto the hard drive. The full
command would be something like: winnt/e:z:\i386\winnt/cmdcons
The Recovery Console provides you with a limited set of MS-DOS-based administrative commands that you
can use to repair your Windows 2000 installation. A list of the Recovery Console commands is shown in
Table 8.2.
TABLE 8.2: Some Recovery Console Commands

Command Description
Chdir or cd Displays the name of the current folder or changes the current
folder
Chkdsk Checks a hard drive and displays a status report
Copy Copies a single file from a floppy drive or CD-Rom drive to the
hard drive
Delete or del Deletes one or more files
Dir Displays a list of files and subfolders in a folder
Disable Disables a system service or a device driver
Enable Starts or enables a system service or a device driver
Exit Exits the Recovery Console and restarts your computer
Fdisk Manages partitions on your hard disks
Fixboot Writes a new partition boot sector onto the system partition
Fixmbr Repairs the master boot record of the partition boot sector
Format Formats a disk
Help Lists all of the Recovery Console commands
Listsvc Lists the device drivers and services that are currently installed on
the computer
Mkdir or md Creates a new folder
Rmdir or rd Deletes an existing folder
Rename or ren Renames a single file
Systemroot Sets the current folder to the systemroot folder of the system that
you are currently logged on to
www.testking.com
- 72 -
220 - 232
Type Displays the contents of a text file
To recover the Registry, start the system and start the Recovery Console rather than the regular operating
system. At the command prompt type:
cd repair\regback
copy <filename> <drive letter>:\<systemroot>\system32\config
This procedure should only be used if you are certain that the Registry file must be restored and you are
certain that the restored version of the Registry will not damage the computer. Before you proceed to restore
the Registry, you should rename the existing files in the %system%\Repair\Config folder that you intend to
restore. This may give you a second chance to make the change should the initial process fail. To perform
the procedure,
8.5 Resolving MS-DOS Application Problems

Although most MS-DOS applications run better in Windows 9x and Windows 2000 than in Windows 3.1x,
Windows 9x and Windows 2000 can still experience problems running MS-DOS applications. MS-DOS
applications refuse to run under Windows because they cannot find a version of MS-DOS they recognize.
Some older MS-DOS applications make use of system resources in ways that are not compatible with
Windows 9x or Windows 2000 and will not run.
One of the most common causes for MS-DOS and Windows application crashes in Windows 9x is that many
applications check the version number of MS-DOS before running. If the software reads the wrong version
number or a version number in the wrong range, an error occurs and the program crashes. To get around this,
Windows 9x can use the setver.exe application to determine what MS-DOS version number the application
requires and can pass that version number to applications. This requires that the config.sys file contain the
line device=c:\windows\setver.exe.
Some times MS-DOS applications fail to execute because of missing drivers or the presence of Windows
itself. By using the Properties tab of a program’s .exe file, you can modify many of the settings that cause
your program to fail. To perform this modification: open WINDOWS EXPLORER and find the
problematic MS-DOS .exe file. Then, right-click the file and select PROPERTIES from the popup menu.
Click the PROGRAM tab and click ADVANCED to display the Advanced dialog box. The Advanced
dialog box as a number of options:
• Prevent MS-DOS-Based Programs From Detecting Windows. This hides Windows in memory so
MS-DOS programs cannot detect it.
• Suggest MS-DOS Mode As Necessary. If Windows 9x detects an application that is likely to run better
in MS-DOS, it starts a wizard so that you can customize the application to run in MS-DOS.
• MS-DOS Mode. This setting has three additional options that determine how the application runs in
MS-DOS mode. These are:
Warn Before Entering MS-DOS. When entering MS-DOS mode, you should close any open
Windows applications and files. This warns you to save files and close any applications that are
running.
Use Current MS-DOS Configuration. This uses all the current system settings that have been
passed along, including settings in config.sys, autoexec.bat, io.sys, and the Registry.
www.testking.com
- 73 -
220 - 232
Specify A New MS-DOS Configuration. This allows you to modify config.sys and autoexec.bat
for the MS-DOS mode to be used by the application.
8.6 Resolving Printing Problems

If you need to resolve a printer problem, first ascertain if it is a hardware or software related problem. If it is
hardware related, resolve the problem run a test print. If it is software related, Windows 9x has a Print
Troubleshooter that can be used to resolve such problems. This tool can be found by clicking the START
button, then selecting HELP. This opens the Windows Online Help. Click the CONTENTS tab, select
TROUBLESHOOT, and display the topic: If You Have Trouble Printing. The troubleshooter asks a
series of questions that lead you through the problem and provides possible solutions.
If the Print Troubleshooter does not solve the problem, you can try the Enhanced Print Troubleshooter
that is available with some versions of Windows. This program is found on the installation CD in the /EPTS
folder. Copy it with its files from the installation CD to the hard disk drive. Then start the program epts.exe.
This program operates in the same way as the standard version, but is much more detailed.
Also, if the printer takes a long time to print, make sure print spooling is enabled and that Windows is
spooling; make sure the drive on which Windows is installed has enough free hard disk space; Defragment
the hard disk if necessary; make sure the computer has sufficient system resources; check for updated printer
driver on the manufacturer’s the Web site; and make sure Windows is sending TrueType fonts as outlines
and not bitmaps.
If your printouts contain random characters, make sure the printer language and type is correctly identified
for the print job; verify that there is enough printer memory to perform the print job; use raw spooling
instead of Enhanced Metafile Spooling (EMF); sent one print job to the printer at a time; make sure the
printable area is not larger than what is supported by the printer; verify that a printer driver is installed and
update the driver if possible.
If you cannot print from an MS-DOS program, deactivate Spool MS-DOS Print Jobs option on the printer’s
properties sheet.
www.testking.com
- 74 -
220 - 232
9. Practice Labs
9.1. Creating a MS-DOS Boot Disk
1. Click on the START Button to display the Start menu
2. On the Start menu, click RUN
3. In the Run dialog box, type command
4. The click on the OK button
This starts an MS-DOS prompt
www.testking.com
- 75 -
220 - 232
5. At the Command Prompt, type format a: /s
6. If you are not sure what the /s switch does, type format /? at the Command Prompt instead.
www.testking.com
- 76 -
220 - 232
7. Insert a blank floppy disk into the floppy disk drive and press ENTER.
www.testking.com
- 77 -
220 - 232
9.2 Creating a Windows 98 Startup Disk
1. Click on the START button to display the Start menu
2. On the Start menu, point to SETTINGS
3. Click on CONTROL PANEL to display the Control Panel
www.testking.com
- 78 -
220 - 232
4. Double-click on the ADD/REMOVE PROGRAMS icon to display the Add/Remove Programs

dialog box
5. On the Add/Remove Programs dialog box that appears, click on the STARTUP DISK tab
6. Then click on the CREATE DISK button
www.testking.com
- 79 -
220 - 232
7. Insert a floppy disk in the floppy drive and click on the OK button
www.testking.com
- 80 -
220 - 232
9.3 Running ScanDisc to check for Hard Drive errors
1. Click on the START button to display the Start menu
2. On the Start menu, point to PROGRAMS
3. Point to ACCESSORIES
4. Point to SYSTEM TOOLS
5. Then click on SCANDISK to display the ScanDisk dialog box
www.testking.com
- 81 -
220 - 232
6. On the ScanDisk dialog box, select the drive to scan
7. Click on the THOROUGH radio button
8. Then click on the START button
www.testking.com
- 82 -

A+ Learn

Enviado por

Dados do documento

Descrição original:

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

A+ Learn

Enviado por

Direitos autorais:

Formatos disponíveis

220-232 220 - 232

1. Operating System Fundamentals

1.2 Major Types of Operating Systems

1.3 File Systems

2.2 The MS-DOS File System

2.3 MS-DOS Mode

2.4 Working with Config.sys and Autoexec.bat

3.2 Resource Management

3.3 Beyond MS-DOS

4. Installing Microsoft Windows

4.2 Installing Windows 98

4.3 Installing Windows 2000 Professional

5.2 The Windows 98 Operating System Ancillary Systems

5.3 The Windows 98 Boot Process

5.3.2.1 The Windows 98 Startup Menu

6. Operating Windows 2000 Professional

6.2 The User Mode

6.3 The Windows 2000 Boot Process

7. Managing and Maintaining the Windows Operating System

7.2 Anti-Virus Protection

7.3 Disk Cleanup

7.4 Maintaining Drive Integrity

7.5 Hard Disk Fragmentation

7.6 File Backups

7.7 Checking Critical System Files

7.8 Creating Emergency Repair and Startup Disks

8. Troubleshooting Microsoft Windows

8.2 Performing Differential Diagnosis

8.3 The System Operational Cycle

8.4 Troubleshooting and Recovering the Registry

8.5 Resolving MS-DOS Application Problems

8.6 Resolving Printing Problems

TABLE 2.1: Common File Extensions

A+ Operating System Technologies

About This Study Guide

How To Use This Study Guide

1. Operating System Fundamentals

1.1 Operating System Basics

1.2 Major Types of Operating Systems

1.2.3 Microsoft Windows

1.3.1 The File Allocation Table (FAT) File Systems

FIG. 1.1: The ATTRIB Command

1.3.2 The NT File System (NTFS)

There are six NTFS permissions:

2. MS-DOS and MS-DOS Mode

2.1 The MS-DOS Boot Sequence

2.2 The MS-DOS File System

TABLE 2.1: Common File Extensions

2.3 MS-DOS Mode

2.3.1 Internal MS-DOS Commands

TABLE 2.2: Some Common Internal MS-DOS Commands

2.3.2 External MS-DOS Commands

TABLE 2.3: Some Common Internal MS-DOS Commands

2.3.3 MS-DOS Mode Navigation

2.3.4 Using MS-DOS Commands

2.3.4.2 The EDIT Command

2.4 Working with Config.sys and Autoexec.bat

2.4.1 Config.sys Settings

TABLE 2.4: Config.sys Settings

FIG. 2.1: A Config.sys File opened in Edit.com

2.4.2 Autoexec.bat Commands

TABLE 2.5: Autoexec.bat Commands

FIG. 2.2: An Autoexec.bat File opened in Edit.com