Winternals ERD COMMANDER 2002 User Manual

Download

ERD Commander 2002

User’s Guide

Winternals Software LP

3101 Bee Caves Road, Suite 150

Austin, Texas 78746

(512) 330-9130

(512) 330-9131 Fax

www.winternals.com

ERD Commander 2002

Table of Contents

Table of Contents ................................................................................ i

1 Introduction................................................................................... 1

2 Overview of Use............................................................................ 2

3 ERD Commander 2002 Setup ...................................................... 5

3.1 Requirements ................................................................................5

3.2 Setup Ov e rview..............................................................................5

3.3 License..........................................................................................6

3.4 Password Protection......................................................................7

3.5 Image Location..............................................................................9

3.6 Burning the ERD Commander 2002 CD-ROM...............................9

4 Functional Overview .................................................................. 10

5 Logon .......................................................................................... 12

6 Windowing Shell......................................................................... 15

7 System Information.................................................................... 16

8 File Explorer................................................................................ 17

9 Volume Properties...................................................................... 19

10 Folder Properties........................................................................ 20

11 Resetting Permissions............................................................... 21

12 Mapping Network Drives............................................................ 22

13 Adding a Domain........................................................................ 24

14 Using File Search ....................................................................... 25

15 The Command-line Environment .............................................. 27

15.1 Overview......................................................................................27

15.2 The Command Set.......................................................................28

15.3 ATTRIB........................................................................................30

15.4 BUFFER ......................................................................................30

15.5 CALL............................................................................................30

15.6 CD/CHDIR ...................................................................................30

15.7 CLS..............................................................................................31

Winternals Software LP Page i

ERD Commander 2002

15.8 COPY...........................................................................................31

15.9 DATE...........................................................................................31

15.10 DEL/ERASE.................................................................................32

15.11 DIR 33

15.12 ECHO..........................................................................................33

15.13 EXIT.............................................................................................34

15.14 HELP...........................................................................................34

15.15 MAP.............................................................................................34

15.16 MKDIR/MD...................................................................................35

15.17 MOVE..........................................................................................35

15.18 RMDIR/RD...................................................................................35

15.19 SCREEN......................................................................................35

15.20 SET..............................................................................................36

15.21 START.........................................................................................36

15.22 TIME............................................................................................ 36

15.23 TYPE...........................................................................................36

15.24 VERSION/VER ............................................................................37

15.25 XCOPY........................................................................................38

15.26 CHKDSK......................................................................................39

16 Notepad ....................................................................................... 40

17 Regedit ........................................................................................ 41

18 Using Service and Driver Manager ........................................... 43

19 Using Event Log Viewer............................................................. 45

19.1 Filtering Events............................................................................46

20 Using TCP/IP Configuration....................................................... 47

21 Using Logical Volumes .............................................................. 49

22 Locksmith ................................................................................... 50

23 Running External Commands ................................................... 51

24 Frequently Asked Questions..................................................... 52

25 Technical Support ...................................................................... 54

Winternals Software LP Page ii

1 Introduction

When your Windows XP, 2000, or NT system becomes unbootable, you can rely on ERD Commander 2002 to provide you full access to your dead system with a familiar desktop environment. ERD Commander 2002 supplies the tools you need to help you quickly diagnose and repair the problem that is preventing your system from booting.

ERD Commander 2002 makes any Windows XP/2000/NT file system, including FAT, NTFS and CDFS, accessible through a graphical interface. ERD Commander 2002 includes a service and driver manager, Registry editor, Explorer-like file system browser, Notepad-like text editor, commandline console, Event Viewer, and a local password changer, Locksmith, that

ERD Commander 2002

allows you to gain access to accounts out of which you’ve been locked. And if you need to save files to another system on the network, or to copy files from another system as part of the repair process, ERD Commander 2002 gives you full access to network file shares.

With ERD Commander 2002, repairing your dead systems is fast, easy, and intuitive.

Winternals Software LP Page 1

2 Overview of Use

ERD Commander’s built-in tools allow you to perf orm many different t ypes of system diagnosis and repair. A few of the ways that ERD Com mander 2002 helps you solve problems include:

Removing or Replacing Buggy Drivers

You can use ERD Commander 2002 to delete or replace the image files of drivers or services that, because of a bug or misconfiguration, prevent Windows 2000/NT from booting.

Updating Out-of-Date System Files

Incorrectly applying service packs or system software updates can cause system DLLs to become out of sync with each other. In many cases this can

ERD Commander 2002

prevent Windows 2000/NT from booting successfully. ERD Commander 2002 can copy up-to-date versions of old files from floppy disks, CD-ROMs or other computers on your network.

Correcting Misconfigured NTFS Security

If security attributes that are too restrictive are applied to certain system files or directories on NTFS boot drives, Windows XP/2000/NT will become unbootable. Using ERD Commander 2002’s file explorer or the command prompt’s Access command you can reset permissions on files or directories to regain access.

Updating Locked Files

Once Windows XP/2000/NT is up and running many system files cannot be replaced because the system keeps them locked. ERD Commander 2002 makes it possible to update such files because it runs when Windows XP/2000/NT is off-line and the files are not open.

Winternals Software LP Page 2

ERD Commander 2002

Correcting Registry Problems

A significant number of Windows XP/2000/NT boot problems are the result of misconfigured Registry values. The ERD Commander 2002 Registry editor has all the capabilities and the same interface as t he Windows XP/2000/NT Registry editor, making it easy for you to inspect and change Registry settings.

Copying Important Files off of a Dead System

ERD Commander 2002 enables you to access files on a Windows XP/2000/NT system that fails to boot. You can copy files to removable media such as floppy disks, Zip drives, or Jaz drives, or use ERD Commander 2002’s network capabilities to copy them to another system on your network.

Regaining Access to a System That You've Been Locked Out Of

ERD Commander 2002 allows you to list the accounts for a Windows XP/2000/NT system and to change their passwords, including Administrator accounts.

Viewing the Event Logs Many times the Event Logs of a system contain clues that can help you diagnose a boot problem, so ERD Commander 2002 includes an E vent Log Viewer with the same interface as the Windows XP/2000 Event Log Viewer MMC-snap-in, allowing you to inspect logs for relevant records.

Accessing Fault Tolerant Drives including Mirrors, Volume Sets, and Striped Sets

With ERD Commander 2002 you can access the fault tolerant drives defined by a Windows XP/2000/NT system even when that system is not active.

Running CHKDSK on Corrupt Drives

ERD Commander 2002 will let you check the consistency of hard drives.

Winternals Software LP Page 3

ERD Commander 2002

Enabling and Disabling Services and Drivers

You can list and modify the start types of a system's drivers and services with ERD Commander 2002’s Service and Driver Manager utility. The utility implements an interface similar to the Windows XP/2000 Services MMCsnap-in, which makes it easy to identify services and drivers and to disable those that are preventing a system from booting.

Note that ERD Commander 2002 is not intended to resolve disk cor ruption, and that only drives that are consistent enough to be recognized by Windows 2000/NT file systems will be accessible with ERD Comm ander 2002. If you need to salvage files from a corrupt volume, or the partition table of a disk has become damaged, we recommend that you consider Disk Commander from Winternals Software (www.winternals.com).

Winternals Software LP Page 4

3 ERD Commander 2002 Setup

3.1 Requirements

ERD Commander 2002 requires that the target system have a bootable CDROM drive, and one of the following operating systems:

♦ Windows NT 4. Although you can use ERD Commander 2002 on

systems that do not have Service Pack (SP) 4 or higher, ERD Commander 2002 updates NTFS volumes to a version that requires the NTFS driver from SP 4 or higher. ERD Commander 2002 prompts you before updating NTFS volumes on pre-SP 4 systems.

♦ Windows 2000 ♦ Windows XP

ERD Commander 2002

Regardless of operating system, ERD Commander 2002 requires a minimum of 64MB of system memory and an x86 233Mhz or equivalent processor.

Note that ERD Commander 2002 also gives you access to the drives of Windows 95, 98, and Me systems, although many utilities, such as the password changer, Registry editor, and Event Log viewer, do not function when accessing installations of those operating system versions.

The ERD Commander 2002 Boot CD-ROM Wizard runs on Windows XP, 2000, NT, Me, and 9x.

3.2 Setup Overview

There are two delivery methods for ERD Commander 2002: as a Boot-CD Wizard and as a bootable CD-ROM. The Boot CD-ROM Wizard is what you receive as a download executable when you download ERD Commander 2002 after an online purchase, whereas the bootable CD-ROM is the physical media on which ERD Commander 2002 is shipped.

Use the Boot CD-ROM Wizard to create a bootable CD-ROM ISO image. A CD-ROM ISO image is a file that represents the raw contents of a CD-ROM that you can burn onto a writable CD-ROM with most popular CD-ROM

Winternals Software LP Page 5

ERD Commander 2002

burning software. You will need several items in addition to successfully create a bootable CD-ROM from the ISO image the Boot CD-ROM Wizard creates:

♦ CD-ROM burner ♦ CD-R or CD-RW disk

♦ CD-ROM burning software that supports the formatting of CD-ROMs

from CD-ROM ISO images

This section guides you through the use of the wizard to create a CD-ROM ISO image using the Boot C D-ROM Wizard.

3.3 License

After you start the Boot CD-ROM Wizard you will be presented with the dialog box shown in Figure 3-1 asking you to enter your licensing information. Online purchasers receive the licensing information as an e-mail attachment that can be imported into the Wizard. The Boot CD-ROM Wizard verifies the license information and embeds it into the I SO imag e so that, after you create a bootable CD-ROM from the image and start ERD Commander 2002 from the resultant CD-ROM, ERD Commander 2002 presents the licensing information when it starts.

Winternals Software LP Page 6

ERD Commander 2002

Figure 3-1

3.4 Password Protection

The Boot CD-ROM Wizard offers the option to password protect the ERD Commander 2002 CD-ROM that you create (see Figure 3- 2). This is helpful if it is desired that use of the bootable CD be restricted to authorized personnel.

Winternals Software LP Page 7

ERD Commander 2002

Figure 3-2

Winternals Software LP Page 8

ERD Commander 2002

3.5 Image Location

The Boot CD-ROM Wizard’s final interactive step prompts you to specify the destination of the generated ISO image (see Figure 3-3). The image requires approximately 180 MB (graphic below indicates 150 MB size) of disk st orage, and because most CD-ROM burning software requires ISO images to have a .iso file extension, the Boot CD-ROM Wizard also requires that extension.

Figure 3-3

3.6 Burning the ERD Commander 2002 CD-ROM

Most popular CD-ROM burning applications offer the option to write a CDROM from a CD-ROM ISO file. Check with your software’s document ation for information on how to do so.

Winternals Software LP Page 9

4 Functional Overview

Once ERD Commander 2002 boots, a stripped-down version of Windows XP will start and run the ERD Commander 2002 windowing environment. It’s important to keep in mind that, alt hough this graphical environment looks like Windows and even has similar utilities, it is not Windows code and therefore behaves slightly differently.

Also, your end-user license agreement prohibits use of ERD Commander 2002 as a general-purpose operating system, and the environment is designed to reboot automatically upon 24 hours of continuous usage.

Note: it is important that you do not rem ove the ERD Commander 2002 CDROM from the system while ERD Commander 2002 is running. Doing so could result in a lock-up of ERD Commander 2002, requiring a reboot.

ERD Commander 2002

The ERD Commander 2002 environment provides a number of powerful utilities that help you identify and repair problems that are preventing a system from booting. These include:

♦ Logon ♦ Windowing Shell ♦ System Information ♦ File Explorer ♦ File Search ♦ Command Prompt ♦ Chkdsk ♦ Notepad ♦ Registry Editor ♦ Service and Driver Manager ♦ Event Log Viewer

Winternals Software LP Page 10

♦ TCP/IP Configuration ♦ Logical Volumes ♦ Locksmith

ERD Commander 2002

Winternals Software LP Page 11

5 Logon

When ERD Commander 2002 boots it executes the Winternals Logon application. If the ERD Commander 2002 CD-ROM was generated by the Boot CD-ROM Wizard, the Logon application displays the licensing information entered during execution of the wizard. Otherwise it will prompt you to enter ERD Commander 2002 license text or specify a file containing an ERD Commander 2002 license.

If you boot an ERD Commander 2002 CD-ROM generated by the Boot CDROM Wizard and you have password protected the installation you are prompted to enter the password before being allowed to proceed.

After licensing information has been validated and, if applicable, a correct

ERD Commander 2002

password entered, the Logon application starts networking services. The services assume that a DHCP server is present on your network and attempt to obtain an IP address. If your network uses static IP addresses rather than DHCP you can use the TCP/IP Configuration utility (see Chapter 20) after logging in to specify a static IP address.

Once networking service initialization is complete the Logon application scans the system’s hard-disk volumes looking for Windows XP, 2000, and NT installations. It displays the system root directory of located installations, the type of operating system installed, and service pack information (see Figure 5-1).

Winternals Software LP Page 12

ERD Commander 2002

Figure 5-1

If the system you wish to repair is not in the list or the operating system is displayed as "unknown", then some or all of the Registry hives for that installation are damaged or missing. Registry hives are the Registry’s ondisk storage files and are stored under \SystemRoot\System32\Config (where SystemRoot is the system root directory of a Windows XP, 2000, and NT installation).

Select the installation you wish to repair fr om the list - by manually entering the system root path, or by browsing to the system root directory. W hen you make a selection the Logon application validates the SYST EM, SOFTWARE, SAM and SECURITY Registry hives and notifies you if any of them are corrupt or missing. Note that in this event, the corresponding portions of the Registry will be inaccessible by the Winternals Registry Editor, and other ERD Commander 2002 utilities may also have limited functionality.

Winternals Software LP Page 13

ERD Commander 2002

The Logon application allows you to choose a keyboard layout and time zone using the respective drop down controls. The default selections for keyboard layout and time zone are taken from the installation you have currently entered into the installation selection field if t he Registry of that installation is accessible.

Selecting an installation starts the ERD Commander 2002 W indowing Shell, which is described in the next section. After you have completed work on an installation and logoff the Windowing Shell, you return to the logon dialog. Pressing the Reboot button performs a clean shutdown and reboot of the computer.

Winternals Software LP Page 14

6 Windowing Shell

The ERD Commander 2002 Windowing Shell has a strong resemblance to Microsoft Explorer’s shell (see Figure 6-1). It has a task bar, St art menu, and desktop shortcuts. However, you cannot move the Window Shell’s task bar, edit the items on the Start Menu, move or modify existing desktop shortcuts, or create new desktop shortcuts. The Windowing Shell provides the familiar desktop motif and allows you to easily access ERD Commander 2002 applications, and allows you to manage multiple running applications with taskbar buttons.

Note: a limitation in the ERD Commander 2002 operating environment prevents the concurrent execution of more than 6 applications. ERD Commander 2002 will inform you when starting another application exceeds the limit.

ERD Commander 2002

Figure 6-1

Winternals Software LP Page 15

7 System Information

The ERD Commander 2002 System Information utility (see Figure 7-1) is accessed via the Administrative Tools folder of the Start menu. This utility reports an extensive amount of information about the system you are repairing, including the operating system version, service pack, hotfixes, registered owner and organization and more. It also displays the installation’s computer name as well as the computer name (listed as the "Real computer name") that ERD Commander 2002 randomly assigns while it is running. The value of the System root, which represents the root folder of the installation, can be important for determining where key system files, such as service and driver files and Registry hives, reside.

ERD Commander 2002

Figure 7-1

Winternals Software LP Page 16

8 File Explorer

ERD Commander 2002 Explorer (see Figure 8-1), accessible from the Start menu, allows you to browse the system’s volumes as well as the NetBIOS network neighborhood. (Active Directory browsing is not supported). The Explorer window has a treeview on the left and a listview on the right that displays the contents of the folder selected in the treeview. The My Computer and Network Neighborhood desktop shortcuts open instances of Explorer that select the associated folder.

ERD Commander 2002

Figure 8-1

ERD Commander 2002 Explorer supports many of the operat ions supported by the Windows Explorer, including drag-and-drop, the up-directory button, in-place rename, new-folder creation, delete, and property viewing for most

Winternals Software LP Page 17

ERD Commander 2002

items. It also allows those file shares exported by other systems on the network to be mapped to local drive letters.

ERD Commander 2002 Explorer obtains icon information for file being repaired. If the Software hive is corrupt or missing Explorer displays only basic icons.

Note that, unlike the default behavior of W indows Explorer, ERD Commander 2002 Explorer displays hidden folders and files (those with the hidden attribute set), displaying them with faded icons. Also unlike Windows Explorer, you cannot drag-and-drop items between different Explorer windows.

The following sections describe the property dialogs associated with different items, as well as how to map network shares to local drive letters.

Winternals Software LP Page 18

9 Volume Properties

Selecting the Properties menu entry from a volume’s context menu (accessible by right-clicking on a volume) or the Properties entry in the File menu launches a dialog (see Figure 9-1) that displays information about a volume, including statistics on total size and free space. See Chapter 11 for a description of the Reset Permissions button.

ERD Commander 2002

Figure 9-1

Winternals Software LP Page 19

10 Folder Properties

You can view detailed information (see Figure 10-1) about a folder by choosing the Properties menu entry from the folder’s context menu or the Properties menu entry in the File menu when the folder selected. The Map Network Drive button enables when you select a folder that represents a network share, allowing you to map the share to a local drive letter. Find more information in Mapping Network Drives in Chapter 12. See Chapter 11 for a description of the Reset Permissions button.

Editing a folder’s name in the propert ies dialog and then applying t he change renames the folder. Similarly, you can change the attributes of the folder in the Attributes area of the dialog, and use the Set Child Attributes to apply a

ERD Commander 2002

set of attributes to all of the files and folders contained within the selected folder.

Figure 10-1

Winternals Software LP Page 20

11 Resetting Permissions

One cause for a system becoming unbootable is that permissions have been set on NTFS folders or directories that prevent the operating system itself from accessing files it requires for the boot process. The Reset Permissions button on a volume or folder Properties dialog changes the permissions on the volume folder, and optionally on child folders, to a security descriptor that gives the Everyone group (all users) full access.

ERD Commander 2002

NOTE: Because resetting permissions makes folders and directories fully accessible to any user, opening potential security holes, you should lockdown the appropriate folders and directories after the system is booted normally.

Winternals Software LP Page 21

12 Mapping Network Drives

ERD Commander 2002 Explorer provides a Network Neighborhood folder for you to navigate to file shares. However, because only NetBIOS browsing is supported, in some cases it may be more convenient to access a file share through a mapped drive letter. To map file shares to a drive letter, use the Map Network Drive menu item in the Tools menu or the Map Network Drive button on a file share’s properties dialog. This method allows mapping of shares even on networks without NetBIOS, where shares are not visible in Network Neighborhood.

The Map Network Drives dialog (Figure 12-1) requires that you specify a free local drive letter, the path to the network file share that you want to map, and,

ERD Commander 2002

optionally, username and password information that Explorer should use to connect to the share. The network share path can consist of DNS (e.g. \\system.mydomain.com), NetBIOS (\\System) or TCP/IP (\\192.168.3.101) computer addresses.

Disconnect a mapped drive either by selecting the drive you wish to disconnect and selecting Disconnect from its context menu, or by selecting the drive in the Disconnect Network Drive dialog, accessed from the Tools menu.

Winternals Software LP Page 22

Figure 12-1

ERD Commander 2002

Winternals Software LP Page 23

13 Adding a Domain

ERD Commander 2002 requires you to enter the names of domains that you wish to browse via ERD Commander 2002 Explorer. The Add Domain feature is accessed via the Tools menu of ERD Commander 2002 Explorer.

ERD Commander 2002

Winternals Software LP Page 24

14 Using File Search

You can search for files on the hard disks of the system that you are repairing using ERD Commander 2002 File Search (see Figure 14-1). ERD Commander 2002 File Search has an interface that is nearly identical to that of the Windows 2000 File Search utility, and is a ccessible via the Start menu and from the context-menu of folders within ERD Commander 2002 Explorer. As with the Windows 2000 File Search, the search pattern you enter can contain any subset of the file or path names for which you wish to search, and can include the asterisk (*) wildcard character. You can also optionally modify your search to only include results with modifications within a certain time period, or of a particular size.

ERD Commander 2002

Figure 14-1

Winternals Software LP Page 25

ERD Commander 2002

Search displays the result of a search as a list in its right pane. After selecting one or more entries in the list you can perform the following operations, all of which are accessible via menu items in the File menu, the context menu (display the context menu by right clicking), and the toolbar:

♦ Copy ♦ Move ♦ View properties ♦ Explore (opens an instance of ERD Commander 2002 Explorer with

the target location opened)

♦ Open (opens documents and executes executable images) ♦ Double-clicking on a result also displays the properties (file or folder)

for that item.

Winternals Software LP Page 26

15 The Command-line Environment

15.1 Overview

ERD Commander 2002 Command Prompt (Figure 15-1) presents a subset of the functionality implemented by the Windows XP command-prompt that includes most built-in commands, the ability to execute external applications, and batch file capabilities. This section serves as r efer ence for the Command Prompt’s built-in commands.

ERD Commander 2002

Figure 15-1

Winternals Software LP Page 27

15.2 The Command Set

Syntax TIME

15.23 TYPE

Displays the A S CII cont ents of a f ile.

Syntax TYPE filename

Winternals Software LP Page 36

ERD Commander 2002

The TYPE command displays the contents of a file. You can pause the output at any time by pressing CTRL-S, and abort the output by pressing CTRL-C.

15.24 VERSION/VER

Displays ERD Commander 2002 's version number.

Syntax VERSION

VER

Winternals Software LP Page 37

ERD Commander 2002

15.25 XCOPY

Copies files and directory trees.

Syntax XCOPY source [destination] [/A | /M] [/P] [/S] [/W] [/C] [/I] [/Q] [/F] [/H]

[/R] [/T] [/U] [/K]

Notes source

destination

Switches /A

/P /S /W /C /E /I

Specifies the file(s) to copy

Specifies the location and/or name of the new files

Copies files with the archi ve attribute set, doesn't change the attribute

Copies files with the archi ve attribute set, turns off the archive attribute

Prompts you before creating each destination file Copies directories and subdirectories except empty ones Prompts you to press a key before copying Continues copying even if errors occur Copies empty subdirectories If destination does not exist and copying more than one file,

assumes that destination must be a directory Does not display file names while copying

/F /H /R /T

/U /K

Winternals Software LP Page 38

Displays full source and destination file names while copying Copies hidden and system files also Overwrites read-only files Creates directory structure , but does not copy files. Includes

empty directories or subdirectories Copies only files that already exist in destination

Copies attributes. Normal XCOPY will reset read-only attributes

ERD Commander 2002

15.26 CHKDSK

ERD Commander 2002 includes a clone of the Windows XP/2000 CHKDSK utility for analyzing and correcting file system corruption. CHKDSK is locat ed in the system32 directory of the ERD Commander 2002 CD-ROM and is run from a command prompt window. The ERD Commander 2002 CHKDSK supports a subset of the Windows CHKDSK command-line options:

Usage CHKDSK [/F] [/X] [/R] [drive:]

Switches /F

Fixes errors on the disk.

Forces the volume to dismount first if necessary.

Locates bad sectors and recovers readable information (implies /f)

If you specify a drive that has open files, for instance because you’re running an application from the drive, you must use the /X switch. However, t he /X switch does not work on the system drive of an installation you are repairing if you are running any utilities that access the Registry of t hat installation. The ERD Commander 2002 utilities that access the Registry include Regedit, Explorer, Service and Driver Manager, System Information, and Event Log Viewer. Make sure that you close these applications before running Chkdsk against the system drive.

Winternals Software LP Page 39

16 Notepad

ERD Commander 2002 Notepad (see Figure 16-1) is essentially a clone of the Windows XP Notepad application, allowing you to edit existing text files and create new ones.

ERD Commander 2002

Figure 16-1

Winternals Software LP Page 40

17 Regedit

The ERD Commander 2002 Regedit utility (Figure 17-1) is similar to the Windows XP Regedit, but enables you to edit the Registry of a system that is being repaired. Unlike Windows Regedit, you will only see two top-level keys in ERD Commander 2002 Regedit: HKEY_CLASSES_ROOT and HKEY_LOCAL_MACHINE. Because the ERD Commander 2002 CD-ROM (and not the system) is actually booted, there is no current hardware configuration loaded. This obviates the need for HKEY_CURRENT_CONFIG (the root key that links to the part of the Registry representing the active hardware profile) and there is no HARDWARE subkey under HKEY LOCAL MACHINE since the system creates the HARDWARE key for an installation when it boots.

ERD Commander 2002

Figure 17-1

If any of the Registry hives (the files t hat store Registry data) of the system that you are repairing are missing or corrupt one or more subkeys under HKEY_LOCAL_MACHINE will not be available. See the FAQ

Winternals Software LP Page 41

section for a

ERD Commander 2002

description of the correspondence between Registry hives and the keys that represent them.

ERD Commander 2002 Regedit understands the following Registry value types:

♦ String ♦ Multi-String ♦ Expandable String ♦ Binary ♦ DWORD

Winternals Software LP Page 42

18 Using Service and Driver Manager

The ERD Commander 2002 Service and Driver Manager (see Figure 18-1), accessible in the Administrative Tools folder of the Start menu, is an ERD Commander 2002 Computer Management utility snap-in. The Service and Driver Manager is actually an interface to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services part of the Registry where service and driver configuration subkeys are located for the system that you are repairing.

ERD Commander 2002

Figure 18-1

Every service and driver has a subkey that includes values that specify its start type, and an optional description and display name. The Service and Driver Manager shows this information and allows you to edit the start type when you view the properties of a selected service or driver. You access the properties dialog for a service or driver by selecting it and then choosing

Winternals Software LP Page 43

ERD Commander 2002

Properties from the Action menu or the context menu (right-click to activate the context menu) or by double-clicking.

Typical repair operations involve disabling a service or driver that is preventing a system from booting, or replacing a corrupt service or driver f ile. To disable a service or driver, display its properties and change the startup type to Disabled. The properties dialog (also shown on Figure 18-1) also reports the path to the service or driver’s executable image.

Winternals Software LP Page 44

19 Using Event Log Viewer

The ERD Commander 2002 Event Log Viewer (Figure 19-1) enables you to examine the System, Application, and Security event logs of the system you are repairing. It functions like the W indows Event Viewer, which allo ws you t o look for entries that might help you diagnose a problem that is preventing a system from booting. The Event Log Viewer includes blue-screen crash errors and errors or warnings that indicate problems with particular services or drivers.

ERD Commander 2002

Figure 19-1

The Event Log Viewer is a snap-in to the ERD Commander 2002 Com puter Management utility that is accessed via the Administrative Tools folder in the Start menu. The three event log files displayed by ERD Commander 2002 Event Viewer are stored in a system’s SystemRoot\System32\Config folder. If a any of these files are missing or corrupt you will see no entries in the corresponding node.

Winternals Software LP Page 45

ERD Commander 2002

To view detailed information about an entry, choose Properties from the Action menu or an event log entry’s context menu, or double-click on the entry. Use the up and down arrows in the propert ies dialog to move between different event entries.

19.1 Filtering Events

You can filter the events you want to see by selecting the Filt er menu entry from the Action menu of Computer Management. The f ilter dialog, shown in Figure 19-2, allows you to filter based on the event severity, source, category, date, and other attributes.

Figure 19-2

Winternals Software LP Page 46

20 Using TCP/IP Configuration

When you boot a computer with ERD Commander 2002 it starts the network adapters on the system using a default configuration that assumes that you have a DHCP server on your network from which an IP address, gateway, and DNS servers can be obtained. If your network requires explicit configuration of any of these values, use the ERD Commander 2002 TCP/IP Configuration utility (Figure 20-1) after logging in to the system you wish to repair. TCP/IP Configuration is accessible in the Administ rative Tools folder of the Start menu.

ERD Commander 2002

Figure 20-1

Winternals Software LP Page 47

ERD Commander 2002

The TCP/IP Configuration utility lets you select the net work adapter for which you want to make changes, and then to enter explicit TCP/IP sett ings for that adapter. The settings you enter become active immediately upon application.

Note that the name that ERD Commander 2002 assigns to the computer is randomly chosen. It is not possible to access the volumes of the system from a remote computer since ERD Commander 2002 does not have a file server service.

Winternals Software LP Page 48

21 Using Logical Volumes

The drive letters that ERD Commander 2002 assigns to volumes may not be the same as those made when you boot normally into the installation that you are repairing. To aid in identifying volumes there are two ways provided to view detailed drive letter mapping information. The first is with the MAP command in the ERD Commander 2002 Command prompt, and the second is using the ERD Commander 2002 Logical Volumes utility (Figure 21-1). The Logical Volumes utility is a snap-in in the ERD Commander 2002 Computer Management utility that is located in the Administrative Tools folder of the Start menu.

ERD Commander 2002

Figure 21-1

Winternals Software LP Page 49

22 Locksmith

If you are unable to logon to a system because you have lost the local administrator password or because the administrative password has been locked out, use the ERD Commander 2002 Locksmith password to a known value and unlock the account. The Locksmith Figure 22-1, located in the Administrative Tools folder of the Start menu, guides you through the process of selecting the account for which you want to change the password and entering the new password. The account will have the new password and be unlocked the next time you boot normally into the system that you are repairing.

ERD Commander 2002

utility to reset the

wizard,

Note that a previous password change will be lost if you rerun Locksmith

another password before booting the system. Note also that Locksmith requires the System Registry hive of installation to be intact.

Figure 22-1

Winternals Software LP Page 50

23 Running External Commands

The ERD Commander 2002 operating environment allows you to r un Win32 applications other than those included on your product CD. Such External Commands may be found on the volumes of the computer that you wish to repair, or on the network. However, because the ERD Commander 2002 environment is different than that of Windows, many applications launched within it either behave incorrectly or fail to run. It should also be noted that different Windows installations provide different versions of many commands, so a particular External Command found on one system may work, while that found on another system may not. For these reasons Winternals Software does not warrant or support use of commands other than those found on your ERD Commander 2002 product CD.

ERD Commander 2002

ERD Commander 2002 displays a dialog box warning you any time you launch an external command from the ERD Commander 2002 shell or an ERD Commander 2002 command prompt. If you wish to suppress the external command dialog for commands launched from within the ERD Commander 2002 command prompt, for instance when you execute batch files that spawn them, you can set the AllowExternalCommand environment variable to a value of "yes". If you do not want to allow the execution of any external commands set the AllowExternalCommand environment variable to "no". The default value of the variable is "warn".

Winternals Software LP Page 51

24 Frequently Asked Questions

Why do I get access denied errors when I try and replace a system’s Registry hives?

If you are running a utility that accesses the Registr y of the system you are repairing you will not be able to replace the Registry hives. The utilities that access the Registry include Regedit, Explorer, Service and Driver Manager, System Information, and Event Log Viewer.

Why didn’t you use the Windows versions of the tools instead of writing your own?

ERD Commander 2002

Besides the fact that doing so would have been a violation of Microsoft’s license, ERD Commander 2002 requires special versions of many utilities in order to provide int uitive int erfaces. For example, the W indows Regedit utility would only allow you to edit the ERD Commander 2002 Registry, whereas ERD Commander 2002 Regedit allows you to edit the Registry of the installation that you wish to repair.

Why can’t I have more than 6 applications active at the same time?

This limit results from the restricted environment in which ERD Commander 2002 executes.

Why are some Registry keys empty when I know I should see subkeys?

When you use Regedit ERD Commander 2002 attempts to load the Registry hives (files) that make up the Registry keys you are familiar with. The Logon application informs you if it cannot load a hive, and those that it cannot load result in empty Registry keys within Regedit and possibly limitations to the functionality of other ERD Commander 2002 applications. Registry hives reside in %systemroot%\system32\config

Winternals Software LP Page 52

ERD Commander 2002

and cannot be loaded if they are either missing or corrupt. The correspondence between hives and their Registry keys is as follows:

Hive Name Registry Key(s)

SAM HKLM\SAM SECURITY HKLM\SECURITY SOFTWARE HKLM\SOFTWARE SYSTEM HKLM\SYSTEM,

HKCR

Why does ERD Commander 2002 hang when I eject the ERD Commander 2002 CD-ROM?

ERD Commander 2002 applications are individually loaded into memor y when executed. If you remove the ERD Commander 2002 CD-ROM the system cannot read any applications that are not already in memory. This results in a fatal error for which there is no recovery other than to reboot the system and rerun ERD Commander 2002.

Why does my application behave strangely or fail to execute when I run it inside of ERD Commander 2002?

The ERD Commander 2002 environment is a stripped-down version of the standard Windows XP environment and is missing many non-core system files, services, and run-time support.

Winternals Software LP Page 53

25 Technical Support

♦ For access to the latest updates on ERD Commander 2002, or to

search the Winternals Knowledge Base, please visit our support website at:

http://www.winternals.com/support

♦ If you encounter a problem while using ERD Commander 2002 that

requires technical support, please e-mail us at:

support@winternals.com

♦ For urgent matters, please call the following number and request

Technical Support:

512-330-9861

ERD Commander 2002

Before contacting support, please determine if the problem is reproducible, and if so, record the steps necessary to reproduce it. In addition, please have the following information ready:

♦ Windows version (including Service Pack) of the system being

repaired

♦ Version of ERD Commander 2002 ♦ Memory size, disk types, and file system types ♦ The License Number shown on the lower right of your ERD

Commander 2002 desktop

Winternals Software LP Page 54

Winternals ERD COMMANDER 2002 User Manual

Specifications and Main Features

Frequently Asked Questions

User Manual

3 ERD Commander 2002 Setup

3.6 Burning the ERD Commander 2002 CD-ROM

12 Mapping Network Drives

15 The Command-line Environment

Syntax TIME

17 Regedit

18 Using Service and Driver Manager

19 Using Event Log Viewer

20 Using TCP/IP Configuration

23 Running External Commands

24 Frequently Asked Questions