Copyright: Messages
Citation: Messages


Welcome
Welcome	1 of 4

Welcome

Welcome to Windows NT Server Messages for the Microsoft® Windows NT™ operating system, a guide to error and system-information messages.

This introductory section covers the following topics:

A description of the information provided in this book

How to set up, start, and quit the Messages database

How to maintain the Messages database


About This Book
Welcome	2 of 4

About This Book

Windows NT Server Messages for Windows NT Workstation and Windows NT Server is the printed guide to most of the error and system-information messages generated by the Windows NT operating system. Some messages generated by applications or device drivers have also been included. An online database with additional messages is also provided and includes a run-time version of Microsoft Access® with a customized graphical user interface.

This book and its accompanying database are not intended as an exclusive reference. You may find other sources, such as online Help, more immediately helpful for network error messages. If, for example, you encounter one in the command prompt window, you can find help for the network problem by typing net helpmsg and the message identification number.

Context-sensitive as well as procedural Help is provided on using the database and its graphical user interface. If you have any questions about an option or command, select the item and then press F1 to display Help information. A glossary of common terms used in messages, and some possible user actions, are included in Help as well as in this book.

Chapter 1, "Common Message Terms and User Actions," provides in-depth discussions, including both definitions and examples, of many technical terms that you may encounter in messages. The printed book also contains some additional reference information that is not available online. For example, Chapter 2, "Windows NT Executive Messages," discusses in detail the various types of messages generated by the Windows NT Executive, and categorizes them by their type and severity and also by possible user action. It also includes basic information on how to set up and use the Windows NT debugger program. Chapter 3, "Network Reference Tables," includes lists in numerical order of two types of network error messages.

Chapter 4, "Message Reference," contains the error and system-information messages, which have been organized as follows:

Messages are presented in alphabetical order. However, messages that begin with a replaceable parameter are alphabetized at the beginning of the list by the variable name used to replace that parameter. For a complete list of the variable names used in the Messages database, see the following section, "Variable Names List."

Variable names appear between arrow brackets in the online Messages database and in italics in the printed book. Otherwise, the text is formatted the same in the book as in the online Messages database, which reflects the formatting used in the on-screen messages.

Messages are normally followed by a description of the circumstances that might generate the message and, if appropriate or needed, by a suggested user action.

Some self-explanatory or simple messages are available only in the online Messages database and not in the book. Most status messages that require no user action are not documented.

Where possible, each message is associated with one or more components of the operating system, such as Notepad or File Manager.

Network messages are included in the alphabetical list along with their network message ID number. Two numerically ordered lists of network messages are also provided in Chapter 3, "Network Reference Tables."

Variable Names List

If you cannot find the message that appears on your screen in Chapter 4, "Message Reference," check at the beginning of the list. The message may begin with a replaceable parameter. Variable names, which are placeholders for the specific word or number that appears in the message, are used as substitutes for replaceable parameters. They appear in italics in the printed book and, when a message starts with one, you will find it alphabetized separately at the beginning of the list. For example, if the book says, "Time is not a valid specification for minutes," the message that appears on your screen will contain the actual time in minutes.

The following is a list of all the variable names used in the Messages database as substitutes for replaceable parameters:

address

application

code

command

computer name

date

drive letter

file system

filename

group

name

number

parameter

path

systemroot

text

time

user name

Product Support Suggestions

Sometimes, the only suggested user action is to obtain help from your own or another technical support group. In that case, we suggest you collect the following information before contacting technical support:

The type of hardware that you are using, including networking hardware, if applicable

The exact content of the message that appears on the screen

A description of what happened and what you were doing when the problem occurred

Microsoft offers a variety of support options to help you get the most from your Microsoft product. For information on these options, please refer to the "Microsoft Support Services" section in the "Welcome" chapter of your Windows NT Server Installation Guide.


Setting Up, Starting, and Quitting the Messages Database
Welcome	3 of 4

Setting Up, Starting, and Quitting the Messages Database

Use the Setup program (SETUP.EXE) located on the Windows NT Server compact disc to install the Microsoft Windows NT Messages database on your own computer for individual use or on a network server for shared use.

To set up the Messages database from a CD-ROM drive

1.	Start Windows NT.

If you want to share the Messages database with other users, be sure to log on as the Administrator before installing the database.

2.	Insert the Windows NT Server compact disc in the CD-ROM drive.

3.	In Program Manager, choose Run from the File menu.

The Run dialog box appears.

4.	Type CD-ROM drive letter:\SUPPORT\SUPTOOLS\WINNTMSG\SETUP in the Command Line box.

5.	Choose the OK button.

6.	Follow the instructions on screen to complete Setup.

If you want to share the Messages database with other users, specify a path to a network server when Setup asks where you want to install it.

When it asks if you want to join an existing workgroup, choose the No button unless you have already set one up on the network. You can use the Change WorkGroup icon to do that later.

After installing the files you need, the Setup program creates a Microsoft Windows NT Messages program group and puts the following icons in the program group: Microsoft Windows NT Messages, Compact Database, Change WorkGroup, and Readme.

Note

If you have installed the Messages database on a Windows NT file system (NTFS) partition, use the File Manager Security menu to ensure that all users have Change (RWXD) permission for the directory and its contents.

To start the Messages database from Program Manager

1.	In Program Manager, open the Microsoft Windows NT Messages program group.

2.	Double-click the Microsoft Windows NT Messages icon.

The Messages startup screen appears within the Microsoft Access main application window.

To start the Messages database from the Windows NT command line

1.	In Program Manager, open the Main program group.

2.	Double-click the Command Prompt icon.

3.	At the command line, change to the directory containing the database, which could be either on your own computer or on a network server.

4.	Type msarn110 winntmsg.mdb.

The Messages startup screen appears within the Microsoft Access main application window.

To quit the Messages database

From the Microsoft Access File menu, choose Exit to quit the Messages database and Microsoft Access.

Note

If you are running the Messages database with the full Microsoft Access program, rather than the run-time version supplied with Windows NT, you can choose Close to close only the database form. You can then use any feature of the full Microsoft Access program to work with your Messages data.

Running the Database Under Windows NT

Detailed procedures on how to use the Find, Notes, and Print buttons on the Messages form to work in the database are provided in the online Help files that accompany this database. They include information on the following topics:

Searching for information in the Messages database

Using a variable as a search criterion

Initiating a new search

Adding and removing notes to the Messages database

Setting up to print

Printing a database report

Running the Database Under MS-DOS with Windows

To use the Messages database on a computer that has MS-DOS® with Microsoft Windows™ 3.1 or later, you need the following:

IBM-compatible personal computer with an 80386 or higher processor (including 80386sx)

Hard disk with 4.5 to 5 megabytes of free space

Microsoft Mouse or other compatible pointing device (optional)

VGA or higher, or compatible display

MS-DOS version 5 or later

You can use the same Windows NT Server CD-ROM to set up and run the Messages database on MS-DOS with Windows as you did to run it under Windows NT.


Maintaining the Database
Welcome	4 of 4

Maintaining the Database

Microsoft Windows NT Messages provides functionality for maintaining your database and the Messages table. You can perform regular backups of both the database and the Messages table. You can also compact the database whenever you notice a marked increase in the file size, as displayed in File Manager, after adding notes or running search queries.

Backing Up the Database

Backups protect you against the loss of your data and the information that describes your data. If you make unwanted, irreversible changes to a database, you can always return to the most recent backup copy.

Important

When backing up your database, you should also create a backup of the system database file, SYSTEM.MDA, which stores the default user options and security account information. If your SYSTEM.MDA file is lost or damaged, you will not be able to start the Messages database. If you do not have a backup of that file, you can copy the SYSTEM.MDA file from the Windows NT Server CD to your Messages directory.

To back up the entire Messages database

1.	Close the Messages database and Microsoft Access by choosing Exit from the Microsoft Access File menu.

In a multiuser environment, make sure that all other users have also closed the database. You can check to see who is connected to your computer by using the Server option in Control Panel.

2.	Using the backup method of your choice (such as File Manager, backup software, or the copy command), copy the WINNTMSG.MDB file to another file, such as WINNTBAK.MDB, on a backup medium such as tape, floppy disk, or another network drive.

To restore the Messages database from a backup copy

Copy the backup version of the WINNTMSG.MDB file (WINNTBAK.MDB) to your database directory.

In a multiuser environment, first make sure that all other users have closed the database. You can check to see who is connected to your computer by using the Server option in Control Panel.

After having backed up the entire database at least once to a WINNTBAK.MDB file, you now have the option of just backing up the Messages table while the Messages database is still open.

To back up and restore just the Messages table

1.	If you do not want to close the Messages database, choose the Backup button on the Messages form (or the Backup command under the Microsoft Access File menu) to back up only the messages data, including notes, to a previously created WINNTBAK.MDB file.

2.	To restore the Messages table data, choose the Restore command on the Microsoft Access File menu.

Compacting the Database

Because the database adds your notes and also keeps a temporary record of your search queries, it can gradually increase in size. Periodically, you should compact your database to make the file smaller.

When you compact a database, the data and security permission settings from your original file are copied to a temporary file and then copied back over the original one, WINNTMSG.MDB. Before compacting, you should make sure that you have enough storage space on your disk (at least an additional 4 MB of free space) for both the original and the temporary compacted version of the database. The compacting operation will fail if you do not have enough storage space.

To compact the Messages database

1.	Close the Messages database.

In a multiuser environment, make sure that all other users have also closed the database. You can check to see who is connected to your computer by using the Server option in Control Panel.

2.	In the Microsoft Windows NT Messages program group, double-click the Compact Database icon.


Common Message Terms and User Actions
Chapter 1	1 of 22

Common Message Terms and User Actions

This chapter goes beyond providing simple definitions of terms, and includes in-depth information and many suggested user actions or examples wherever appropriate. The terms are also defined with regard to how they relate to Windows NT messages. Many of these terms are very technical and do not appear in the Windows NT Workstation System Guide or Windows NT Server System Guide. Those terms that do may be slightly altered here to provide more information for understanding how they are used in messages.

Reading the information presented here should make subsequent technical discussions more understandable, both in reading this book and talking with technical support people.


Common Message Terms - A
Common Message Terms and User Actions	2 of 22

A B C D E F G H I K L M N O P R S T U V W

access control entry (ACE)

An entry in an access control list (ACL). Each access control entry defines the protection or auditing to be applied to a file or other object for a specific user or group of users.

access control list (ACL)

The part of a security descriptor that enumerates both the protections to accessing and the auditing of that accessing that are applied to an object. The owner of an object has discretionary access control of the object and can change the object's ACL to allow or disallow others access to the object. Access control lists are ordered lists of access control entries (ACEs).

access right

A permission granted to a process to manipulate a particular object in a particular way (for example, by calling a service). Different object types support different access rights, which are stored in an object's access control list (ACL).

access token, or security token

An object that uniquely identifies a user who has logged on. An access token is attached to all the user's processes and contains the user's security ID (SID), the SIDs of any groups to which the user belongs, any privileges that the user owns, the default owner of any objects that the user's processes create, and the default access control list (ACL) to be applied to any objects that the user's processes create. See also privilege.

access violation

An attempt to carry out a memory operation that is not allowed by Windows NT memory management. An access violation has nothing to do with the Security Manager's checking of User-mode access rights to objects.

There are four basic kinds of actions that can cause access violations:

Attempting an invalid operation, such as writing to a read-only buffer

Attempting to access memory beyond the limit of the current program's address space (also known as a "length violation")

Attempting to access a page to which the system forbids access. (For example, code is not allowed to run in the low-order 64K of the Windows NT User-mode address.)

Attempting to access a page that is currently resident but dedicated to the use of an Executive component. (For example, User-mode code is not allowed access to a page that the Kernel is using.)

address space, or virtual address space

The set of addresses available for a process's threads to use. In Windows NT, every process has a unique address space of 4 GB.

algorithm

In its most general sense, an algorithm is any set of instructions that can be followed to carry out a particular task. In computer usage, an algorithm is a set of instructions within a program. If, for example, in the Network option in Control Panel, you encounter a message that says that "A binding algorithm failed," this means that the program was unable to execute a set of instructions designed to bind together elements necessary for a functional network configuration.

allocation units

See clusters.

anonymous-level security token

The type of security token used when a server impersonates a client. If, when the client calls the server, the client specifies an anonymous impersonation mode, the server cannot access any of the client's identification information, such as its security identifier (SID) or privileges. The server will have to use an anonymous-level security token when representing the client in successive operations. See also access token.

application programming interface (API)

A set of routines that an application program uses to request and carry out lower-level services performed by the operating system.

For example, programming code is built using a series of function calls or routines that perform certain actions. Suppose that every workday you got up at 7 A.M., showered, dressed, fixed and ate breakfast, brushed your teeth, and then drove to work. If you were really a computer and never deviated from this pattern, a programmer could write a program for you called DAILY_ROUTINE that would perform these actions automatically. So, instead of having to specify each action, the programmer could just write DAILY_ROUTINE in the code, and the actions would be carried out. Thus, in this example, DAILY_ROUTINE would constitute an API.

authentication package

A subsystem that verifies that the logon information that a user supplies matches the information stored in a security database.

AUTOEXEC.NT and CONFIG.NT files

Windows NT configures the MS-DOS environment by reading the AUTOEXEC.BAT file when you log on, and by reading the AUTOEXEC.NT and CONFIG.NT files when you start an application in a new command window. The AUTOEXEC.NT and CONFIG.NT files are the Windows NT versions of AUTOEXEC.BAT and CONFIG.SYS.

When you log on to Windows NT, the path and environment variables stored in the AUTOEXEC.BAT file are appended to the Windows NT path and environment settings. Because this portion of the operating environment is established at logon, the values set for the path and environment variables are available to each application you use. If you change these values, you must log off from and then log on to Windows NT again so that the changes take effect.

When you start an MS-DOS-based or a 16-bit Windows-based application in a new command window, Windows NT reads the CONFIG.NT and AUTOEXEC.NT files to configure the environment for the application. If, for example, you change an application's driver in the CONFIG.NT file, restarting the application puts the change into effect. You can edit these files just as you would CONFIG.SYS and AUTOEXEC.BAT. The files are located in the C:\systemroot\SYSTEM32 directory.


Common Message Terms - B
Common Message Terms and User Actions	3 of 22

A B C D E F G H I K L M N O P R S T U V W

bad-sector mapping

A technique used by the NTFS file system to handle write errors. When an error is detected, the file system takes a free block, writes the data to that block instead of to the bad block, and updates a bad-block map. A copy of this map is written to disk.

binding

A series of bound paths from the upper-layer network services and protocols to the lowest layer of adapter card device drivers. Each network component can be bound to one or more network components above it or below it to make the component's services available to any component that can benefit from them.

boot partition

The boot partition for Windows NT is the volume, formatted for either a Windows NT file system (NTFS), file allocation table (FAT), or high-performance file system (HPFS), that has the Windows NT operating system and its support files. The boot partition can be (but does not have to be) the same as the system partition. It cannot be part of a stripe set or volume set, but it can be part of a mirror set. See also system partition.


Common Message Terms - C
Common Message Terms and User Actions	4 of 22

A B C D E F G H I K L M N O P R S T U V W

circular dependency

A dependency in which an action that appears later in a chain is contingent upon an earlier action. For example, three services (A, B, and C) are linked. A is dependent upon B to start. B is dependent upon C to start. A circular dependency results when C is dependent upon A to start. See also dependency.

clusters, or allocation units

In data storage, a cluster is a disk-storage unit consisting of a fixed number of sectors (storage segments on the disk) that the operating system uses to read or write information to; typically, a cluster consists of two to eight sectors, each of which holds a certain number of bytes (characters).

A formatted disk is divided into sectors, and a cluster is a set of contiguous sectors allocated to files as a single unit. This clustering of sectors reduces disk fragmentation but may result in wasted space within the cluster.

Under both the NTFS and FAT file systems, the size of a cluster is based upon the size of the partition. However, with NTFS, you can override this with a switch, which forces a smaller (or larger) cluster size. Under FAT, the size of a cluster cannot be changed; the larger the partition, the more sectors you will have per cluster. Therefore, under FAT, you can have 1, 2, 4, 8, 16, 32, and 64 sectors per cluster.

CONFIG.NT files

See AUTOEXEC.NT and CONFIG.NT files.

control set

All Windows NT startup-related data that is not computed during startup is saved in one of the Registry hives. This startup data is organized into control sets, each of which contains a complete set of parameters for starting up devices and services. The Registry always contains at least two control sets, each of which contains information about all the configurable options for the computer: the current control set and the LastKnownGood control set. See also LastKnownGood (LKG) control set.

corrupted data

Data in memory or on disk that has been unintentionally changed, thereby altering or obliterating its meaning.

current control set

The control set that was used most recently to start the computer and that contains any changes made to the startup information during the current session. See also LastKnownGood (LKG) control set.

cyclic redundancy check (CRC)

A procedure used on disk drives to ensure that the data written to a sector is read correctly later.

This procedure is also used in checking for errors in data transmission. The procedure is known as a redundancy check because each data transmission includes not only data but extra (redundant) error-checking values. The sending device generates a number based on the data to be transmitted and sends its result along with the data to the receiving device. The receiving device repeats the same calculation after transmission. If both devices obtain the same result, it is assumed that the transmission is error-free.


Common Message Terms - D
Common Message Terms and User Actions	5 of 22

A B C D E F G H I K L M N O P R S T U V W

deadlock condition

A run-time error condition that occurs when two threads of execution are blocked, each waiting to acquire a resource that the other holds, and both unable to continue running.

debugger breakpoints

Set by the user of the Kernel debugger (KD) before running the Windows NT Executive, a breakpoint is put into the Executive code at an instruction. Then, when the Executive is run, if and when that instruction is executed, execution is stopped, and the current values of registers and flags are displayed. KD breakpoints are "sticky" in the sense that they remain in the program until explicitly removed. It is possible for code to have breakpoints in it that are never explicitly removed. See also Kernel debugger.

dependency

A situation in which one action must take place before another can happen. For example, if action A does not occur, then action D cannot occur.

Some Windows NT drivers have dependencies on other drivers or groups of drivers. For example, driver A will not load unless some driver from the G group loads first. See also circular dependency.

domain

For Windows NT Server, a collection of computers that share a common accounts database and security policy. Each domain has a unique name.

A set of servers and workstations grouped together for efficiency and security, and the basic administrative unit in Windows NT Server. A network can be divided, for example, into domains by department, workgroup, or building floor.

Domains keep large networks manageable. For example, users displaying a list of servers will see only the servers for their domain. But they can still access resources on servers in any domain if they have been granted the necessary rights.

domain controller

For a Windows NT Server domain, this refers to the server that maintains the security policy and the master database for a domain and, along with backup domain controllers, authenticates domain logons.

down level

A term that refers to earlier operating systems, such as Windows for Workgroups or LAN Manager, that can still interoperate with Windows NT Workstation or Windows NT Server.

dynamic-link library (DLL)

A library of routines that User-mode applications access through ordinary procedure calls. The operating system automatically modifies the user's executable image to point to DLL procedures at run time. That way, the code for the procedures does not have to be included in the user's executable image.


Common Message Terms - E
Common Message Terms and User Actions	6 of 22

A B C D E F G H I K L M N O P R S T U V W

enumeration operation

The counting, accessing, or listing of an entire set of similar objects. When the last object in the set has been counted, accessed, or listed, the enumeration operation is complete.

error logging

The process by which errors that cannot readily be corrected by the majority of end users are written to a file instead of being displayed on the screen. System administrators, support technicians, and users can use this log file to monitor the condition of the hardware in a Windows NT computer, to tune the configuration of the computer for better performance, and to debug problems as they occur.

exception

A synchronous error condition resulting from the execution of a particular computer instruction. Exceptions can be either hardware-detected errors, such as division by zero, or software-detected errors, such as a guard-page violation.

Executive

The Executive is the part of the Windows NT operating system that runs in Kernel mode. Kernel mode is a privileged processor mode in which a thread has access to system memory and to hardware. (In contrast, User mode is a nonprivileged processor mode in which a thread can only access system resources by calling system services.) The Windows NT Executive provides process structure, thread scheduling, interprocess communication, memory management, object management, object security, interrupt processing, I/O capabilities, and networking.

The Windows NT Kernel is the part of the Windows NT Executive that manages the processor. It performs thread scheduling and dispatching, interrupt and exception handling, and multiprocessor synchronization. It also provides primitive objects to the Windows NT Executive, which uses them to create User-mode objects.

Executive messages

Two types of character-mode messages occur when the Windows NT Kernel detects an inconsistent condition from which it cannot recover: STOP messages and hardware-malfunction messages.

Character-mode STOP messages are always displayed on a full character-mode screen rather than in a Windows-mode message box. They are also uniquely identified by a hexadecimal number and a symbolic string, as in the following example:

*** STOP: 0x00000001

APC_INDEX_MISMATCH

The content of the symbolic string may suggest, to a trained technician, the part of the Kernel that detected the condition from which there was no recourse but to stop. However, keep in mind that the cause may actually be in another part of the system.

Character-mode hardware-malfunction messages are caused by a hardware condition detected by the processor. The first one or two lines of a hardware-malfunction message may differ depending on which company manufactured the computer. However, these lines always convey the same idea, as shown in the following example for an x86-based computer:

Hardware malfunction.

Call your hardware vendor for support.

The additional lines in each manufacturer's message screen also differ in format and content.

The Executive displays a Windows-mode STATUS message box when it detects conditions within a process (generally, an application) that you should know about. STATUS messages can be divided into three types:

System-information messages. All you need to do is read the information in the message box and choose the OK button. The Kernel will continue running the process or thread.

Warning messages. Some advise you to take an action that will enable the Kernel to keep running the process or thread. Others warn you that, although the process or thread will continue running, the results may not be correct.

Application-termination messages. These warn you that the Kernel is about to terminate either a process or a thread.

For an in-depth discussion of the these messages, see Chapter 2, "Windows NT Executive Messages."

extended attribute

Windows NT FAT files have four basic parts:  the data, the file system attributes (such as creation time and date, and FAT attributes), the security descriptors, and the extended attributes (EAs). EAs make up the set of extended information about a file, and are structured as name/value pairs. Typical Windows NT system uses of EAs are actions such as storing the icon of an executable image or indicating that the file is a symbolic link.

extended partition

This is created from free space on a hard disk and can be subpartitioned into zero or more logical drives. The free space in an extended partition can also be used to create volume sets or other kinds of volumes for fault-tolerance purposes. Only one of the four partitions allowed per physical disk can be an extended partition, and no primary partition needs to be present to create an extended partition.


Common Message Terms - F
Common Message Terms and User Actions	7 of 22

A B C D E F G H I K L M N O P R S T U V W

file control block (FCB)

In MS-DOS, a 36-byte block of memory that contains all the information MS-DOS needs to know about an open file, such as the filename, what drive it is on, current file size, and date and time of creation.


Common Message Terms - G
Common Message Terms and User Actions	8 of 22

A B C D E F G H I K L M N O P R S T U V W

globally unique identifier (GUID)

See universally unique identifier (UUID).

guard-page protection

The Windows NT Virtual Memory Manager can put a guard page at the end of a data structure, such as a dynamic array, and generate a warning message when a User-mode thread accesses the guard-page memory. The User-mode process can respond appropriately, for example, by extending the array.


Common Message Terms - H
Common Message Terms and User Actions	9 of 22

A B C D E F G H I K L M N O P R S T U V W

handle

In general, a unique identifier (often an integer) by which a client refers to an object in the Windows NT operating system. Clients call servers to get a handle to an object on which the client wants to operate. Then the client sends requests for operations to the object, referring to the object by its handle. The server actually does the operation. This ensures that the client does not operate on the object directly.

In the Registry, each of the first-level key names begins with HKEY_ to indicate to software developers that this is a handle that can be read by a program. A handle is a value used to provide a unique identifier for a resource so that a program can access it.

hexadecimal

A base-16 number system that consists of the digits 0 through 9 and the uppercase and lowercase letters A (equivalent to decimal 10) through F (equivalent to decimal 15).

high memory area (HMA)

A 64K memory block located just above the 1 MB address in a Virtual DOS Machine (VDM). This memory becomes visible when the A20 address line is turned on, enabling 21-bit addressing in the VDM.

hive

The Registry is divided into parts called hives, so named as an analogy to the cellular structure of a beehive. A hive is a part of the Registry that maps to a file on your hard disk. Each user profile is a separate hive, which means that it is also a separate file. Therefore, an administrator can copy a user profile as a file, and view, repair, or copy entries using Registry Editor on another computer.

hot key

In a user interface, hot keys provide an alternative to the mouse for manipulating interface objects. For example, instead of using the mouse, you can press the key combination ALT+F to open the File menu on the menu bar. ALT+F is a hot key.


Common Message Terms - I
Common Message Terms and User Actions	10 of 22

A B C D E F G H I K L M N O P R S T U V W

impersonation

The ability of a thread in one process to take on the security identity of a thread in another process and to perform operations on the other thread's behalf. Impersonation is used by the Windows NT environment subsystems and network services to access remote resources on behalf of client applications.

.INF file

One of a set of files used by the Setup program, either during Windows NT installation or during maintenance Setup, or both. An .INF file generally contains a script for Setup to follow, along with configuration data that ends up in the Registry.

input/output control (IOCTL)

An IOCTL command enables a program to communicate directly with a device driver. This is done, for example, by sending a string of control information recognized by the driver. None of the information passed from the program to the device driver is sent to the device itself (in other words, the control string sent to a printer driver is not displayed on the printer).

installable file system (IFS)

A file system that can be loaded into the operating system dynamically. Windows NT can support multiple installable file systems at one time, including the file allocation table (FAT) file system, the high-performance file system (HPFS), the Windows NT file system (NTFS), and the CD-ROM file system (CDFS). Windows NT automatically determines the format of a storage medium, and reads and writes files in the correct format.

interrupt

An asynchronous operating system condition that disrupts normal execution and transfers control to an interrupt handler. Interrupts can be issued by both software and hardware devices requiring service from the processor. When software issues an interrupt, it calls an interrupt service routine (ISR). When hardware issues an interrupt, it signals an interrupt request (IRQ) line.

interrupt request level (IRQL)

A ranking of interrupts by priority. A processor has an interrupt request level (IRQL) setting that threads can raise or lower. Interrupts that occur at or below the processor's IRQL setting are masked, whereas interrupts that occur above the processor's IRQL setting are not. Software interrupts are almost always lower priority than hardware interrupts.

I/O bus

A hardware path inside a computer that is used for transferring information to and from the processor and various input and output devices.


Common Message Terms - K
Common Message Terms and User Actions	11 of 22

A B C D E F G H I K L M N O P R S T U V W

Kernel

The Windows NT Kernel is the part of the Windows NT Executive that manages the processor. It performs thread scheduling and dispatching, interrupt and exception handling, and multiprocessor synchronization. It also provides primitive objects to the Windows NT Executive, which uses them to create User-mode objects.

Kernel debugger

The Windows NT Kernel debugger (KD) is a 32-bit application that is used to debug the Kernel and device drivers, and to log the events leading up to a Windows NT Executive STOP, STATUS, or hardware-malfunction message.

The Kernel debugger runs on another Windows NT host computer that is connected to your Windows NT target computer. The two computers send debugging (troubleshooting) information back and forth through a communications port that must be running at the same baud rate on each computer. See also debugger breakpoints; system debugger, and WINDBG.EXE.

Kernel mode

See Executive.

keyword

A special type of command parameter that includes a value. The syntax of the "width" keyword illustrates this: width = 40.


Common Message Terms - L
Common Message Terms and User Actions	12 of 22

A B C D E F G H I K L M N O P R S T U V W

LastKnownGood (LKG) control set

The most recent control set that correctly started the system and resulted in a successful startup. The control set is saved as the LKG control set when you have a successful logon.

A copy of the control set used to start the system is also stored as the Clone subkey in the Registry. At startup time, the Service Control Manager copies the Clone subkey to the LastKnownGood control set before any new changes are made to the control set. This helps to ensure that the computer always contains a working control set. See also current control set.

local security authority (LSA)

A component of the Windows NT security system that maintains all aspects of local security on a system. This collection of information is known as the local security policy. The local security policy identifies, among other things, the following:  domains trusted to authenticate logon attempts, who may access the system, how they may access it (locally, from the network, or as a service), who is assigned privileges, and what security auditing is to be performed.


Common Message Terms - M
Common Message Terms and User Actions	13 of 22

A B C D E F G H I K L M N O P R S T U V W

mapped I/O, or mapped file I/O

This is file I/O that is performed by reading and writing to virtual memory that is backed by a file.

memory control block (MCB)

MS-DOS organizes available memory as a pool of blocks that are maintained as a chain (or linked list). The memory control block (MCB) occupies the bottom 16 bytes of each memory block and, among other things, points to the next memory block in the chain. If a memory control block is corrupted, MS-DOS cannot find the next block in the chain and does not know which memory blocks have been allocated and which have not.

mounting a volume

Finding a file system that recognizes the format of a volume, and associating the file system with the volume. Windows NT does this automatically the first time a program accesses a volume (or, for other forms of removable media such as floppy disks or CD-ROMs, each time the user reinserts the floppy disk or CD into a drive and performs I/O on it). A volume must be mounted before I/O operations can be done on it.


Common Message Terms - N
Common Message Terms and User Actions	14 of 22

A B C D E F G H I K L M N O P R S T U V W

named pipe

An interprocess communication mechanism that enables one process to send data to another local or remote process. See also pipe.

network control block (NCB)

A block of sequential data of fixed length. This data includes an operation code that indicates the operation to be performed, and elements that indicate the status of the operation. See also opcode.

network transport

This can be either a particular layer of the OSI reference model between the Network Layer and the Session Layer, or a communications protocol between two different computers on a network.


Common Message Terms - O
Common Message Terms and User Actions	15 of 22

A B C D E F G H I K L M N O P R S T U V W

object

A single run-time instance of a Windows NT-defined object type. It contains data that can be manipulated only by using a set of services provided for objects of its type.

In Windows NT Performance Monitor, an object is a standard mechanism for identifying and using a system resource. Objects are created to represent individual processes, sections of shared memory, and physical devices. Performance Monitor groups counters by object type. Each object type can also have several instances. For example, the Processor object type will have multiple instances if a system has multiple processors. The Physical Disk object type has two instances if a system has two disks. Some object types (such as Memory and Server) do not have instances.

opcode

Operation code; a code, usually a number, that specifies an operation to be performed. An opcode is often the first component in a contiguous block of data; it indicates how other data in the block should be interpreted. See also network control block.


Common Message Terms - P
Common Message Terms and User Actions	16 of 22

A B C D E F G H I K L M N O P R S T U V W

paging file, or swap file

A system file that contains the contents of virtual pages that have been temporarily removed from physical memory by the Virtual Memory Manager.

With virtual memory under Windows NT, some of the program code and other information are kept in RAM, while other information is temporarily swapped to a virtual-memory paging file. When that information is required again, Windows NT pulls it back into RAM and, if necessary, swaps other information to virtual memory. This activity is invisible, although you might notice that your hard disk is working. The resulting benefit is that you can run more programs at one time than your system's RAM would usually allow. See also virtual memory.

parameter

Parameters are used in commands entered at the Windows NT command prompt to customize that particular use of the command. For example, the MS-DOS copy command has two parameters: the path to the file to copy and the path to where the copy will be put. These two parameter values could be any valid path; by changing these each time you use the copy command, you are customizing the command.

partition

A portion of a physical disk that functions as though it were a physically separate unit. You can use a partitioning program, such as FDISK for the MS-DOS and OS/2® operating systems and Disk Administrator for Windows NT, to create these unformatted units. You must then use the format command (either from the command prompt or from within Disk Administrator) to format them for use with a specific file system. A partition is usually referred to as either a primary or an extended partition. See also volume.

partition table

A structure on a disk that the operating system uses to divide a disk into logical divisions called partitions, which can then be formatted to a specific file system. Primary partitions are defined by a data entry in the main partition table of a hard disk. Extended partitions are defined by a nondata entry in the main partition table.

permission

A rule associated with an object (usually a directory, file, or printer) in the form of a discretionary access control list (DACL) that is used to regulate which users or groups can have access to the object and in what manner. You can set file and directory permissions only on drives formatted to use the Windows NT File System (NTFS). See also right.

pipe

An interprocess communication mechanism. Writing to and reading from a pipe is much like writing to and reading from a file, except that the two processes are actually using a shared memory segment to communicate data. See also named pipe.

primary partition

A portion of a physical disk that can be marked as active for use by an operating system. Active means that the POST (power-on self-test) routine can locate a boot sector on the partition. There can be up to four primary partitions (or up to three if there is already an extended partition) per physical disk. A primary partition cannot be subpartitioned.

privilege

The representation of most user rights in access tokens. An example of one is the backup privilege. Holders of that privilege are allowed to bypass file-system security. In a secure system, not all users will have that privilege. See also access token.

privileged instruction

Processor-privileged instructions have access to system memory and the hardware.

process

A logical division of labor in an operating system.

A Windows NT process is created when a program runs. A process can be either an application (such as Microsoft Word or Corel® Draw), a service (such as Event Log or Computer Browser), or a subsystem (such as POSIX). In Windows NT, it comprises a virtual address space, an executable program, one or more threads of execution, some portion of the user's resource quotas, and the system resources that the operating system has allocated to the process's threads. A process is implemented as an object. See also object.


Common Message Terms - R
Common Message Terms and User Actions	17 of 22

A B C D E F G H I K L M N O P R S T U V W

Registry

A secure, unified database that stores application configuration data, hardware configuration data (such as device-driver configuration data, and network protocol and adapter card settings), and user data in a hierarchical form for a Windows NT Workstation or Windows NT Server computer.

Registry key

The configuration data in the Registry is stored in a hierarchical form, and keys are the building blocks of this hierarchy. In the Registry, there are four top-level keys that contain per-computer and per-user databases. Each key can contain data items, called value entries, and can also contain additional subkeys. In the Registry structure, keys are analogous to directories, and the value entries are analogous to files. See also value entries.

remote procedure call (RPC)

A message-passing facility that enables a distributed application to call services available on various computers in a network without regard to their locations. Remote network operations are handled automatically. RPC provides a procedural, rather than a transport-centered, view of networked operations.

remote procedure call (RPC) binding

A logical connection between the client and server, or the process by which the client establishes a logical connection to the server.

remote procedure call (RPC) connection

A transport-level virtual circuit between the client and server. The RPC run time establishes the circuit when the client binds to the server interface instance. Connections are not visible to the client. A client may have more than one connection to the server.

remote procedure call (RPC) endpoint

An endpoint identifies a specific server instance (or address space) on a host. The format of the endpoint depends on the transport protocol used. There are well-known endpoints and dynamic endpoints. Well-known endpoints are registered in the name service database. Dynamic endpoints are assigned to server instances at run time.

remote procedure call (RPC) protocol sequence

A character string that identifies the network protocols used to establish a relationship between a client and a server. The protocol sequence contains a set of options that the RPC run time must know about to establish a binding. These options include the RPC protocol, the format of the network address, and the transport protocol. For example, a protocol sequence string might be as follows:

ncacn_ip_tcp

remote procedure call (RPC) server

The program or computer that processes remote procedure calls from a client.

revision level

A revision level is built into many Windows NT data structures, such as security descriptors and access control lists (ACLs). This enables the structure to be passed between systems or stored on disk even though it is expected to change in the future.

right

A right authorizes a user to perform certain actions on the system. In most situations, rights should be provided to a user by adding that user's account to one of the built-in groups that already possesses the needed rights, rather than by administering the user rights policy. Rights apply to the system as a whole, and are different from permissions, which apply to specific objects. See also permission.

root directory

In a file system structured as a hierarchy of directories on a partition or volume, the root directory is the parent of all the other directories. The root directory name in FAT, HPFS, and NTFS is a backslash (\).


Common Message Terms - S
Common Message Terms and User Actions	18 of 22

A B C D E F G H I K L M N O P R S T U V W

secrets

Encrypted pieces of information.

security accounts manager (SAM)

A Windows NT-protected subsystem that maintains the security accounts database.

security descriptor

A data structure that houses all the security information related to an object. It contains a discretionary access control list (DACL), a system access control list (SACL) that controls auditing on the object, an owner, and a primary group of the object.

security ID (SID)

A number that identifies a user, a global group of users, a local group of users, or a domain within Windows NT.

security token

See access token.

semaphore

Generally, semaphores are signaling devices or mechanisms. However, in Windows NT, system semaphores are objects used to synchronize activities on an interprocess level. For example, when two or more processes share a common resource such as a printer, video screen, or memory segment, semaphores are used to control access to those resources so that only one process can alter them at any particular time.

server message block (SMB)

A block of data that contains a work request from a workstation to a server, or that contains the response from the server to the workstation. SMBs are used for all communications that go through the server or workstation service, such as file I/O, creating and removing remote connections, or performing any other network function that the redirector needs to carry out.

Microsoft network redirectors use this structure to send remote requests or information over the network to a remote computer, which can be either a Windows NT Workstation or Windows NT Server computer.

single system image (SSI)

A domain that has the Logon service running and that propagates its user accounts database throughout the domain.

stand-alone

A workstation or server that is not currently a member of a domain. Or, a workstation or server at which logon requests are not validated by a logon server.

swap file

See paging file.

switch

A special type of command parameter that is denoted by a leading slash (/) or leading dash (-). Switches are normally used for parameters that are simple toggles (on/off switches). For example, in the chkdsk command, an optional parameter is the /f switch. If it is used, chkdsk attempts to fix any problems it finds on a disk. If it is not used, chkdsk only reports the problems and does not attempt to fix them.

syntax

The rules governing the structure and content of commands entered into the computer. For example, when you enter commands at the Windows NT command prompt, if the structure and content of a command violate the syntax rules, the Windows NT command processor cannot interpret the command and generates a syntax error message.

system debugger

The Windows NT system debugger (NTSD) is a 32-bit application that supports the debugging of User-mode applications and dynamic-link libraries (DLLs). NTSD can also read and write paged and nonpaged memory, and supports multiple-thread debugging and multiprocess debugging.

NTSD enables you to display and execute program code, set breakpoints that stop the execution of your program, and examine and change values in memory. NTSD also enables you to refer to data and instructions by name rather than by address. It can access program locations through addresses, global symbols, or line-number references, making it easy to locate and debug specific sections of code. You can debug C programs at the source-file level as well as at the machine-code level. You can also display the source statements of a program, the disassembled machine code of the program, or a combination of source statements and disassembled machine code.

In contrast to NTSD, the Windows NT Kernel debugger (KD) supports the debugging of Kernel-mode code. It cannot be used to set breakpoints in User-mode nor to read or write paged-out memory. KD also does not provide support for threads. However, it does support multiprocess debugging.

You would, therefore, use NTSD for debugging User-mode programs and KD for debugging the Kernel and device drivers. See also Kernel debugger and WINDBG.EXE.

system files

Files that are used by either the operating system or the file system to store special system data. NTFS uses them to store special data on the file system.

Operating systems use these files to store information and programs that are used to start the computer and load the operating system. MS-DOS system files include IO.SYS, MSDOS.SYS, and COMMAND.COM. Windows NT system files include NTLDR, NTDETECT.COM, BOOT.INI, and several of the files in the \systemroot\SYSTEM32 directory.

system partition

The system partition for Windows NT is the volume that has the hardware-specific files needed to load Windows NT. On x86-based computers, it must be a primary partition that has been marked as active for startup purposes and must be located on the disk that the computer accesses when starting up the system. There can be only one active system partition at a time, which is denoted on the screen by an asterisk. If you want to use another operating system, you must first mark its system partition as active before restarting the computer.

Partitions on a RISC-based computer are not marked active. Instead, they are configured by a hardware configuration program supplied by the manufacturer. On RISC-based computers, the system partition must be formatted for the FAT file system. On either type of computer, the system partition can never be part of a stripe set or volume set, but it can be part of a mirror set. See also boot partition.


Common Message Terms - T
Common Message Terms and User Actions	19 of 22

A B C D E F G H I K L M N O P R S T U V W

terminated process

In Windows NT, a process object is a program invocation, including the address space and resources required to run the program. When the Windows NT Executive terminates a process, it quits running the program and returns the address space and resources to the system. From the user's point of view, the application is no longer running.

thread

An executable entity that belongs to one (and only one) process. It comprises a program counter, a User-mode stack, a Kernel-mode stack, and a set of register values. All threads in a process have equal access to the process's address space, object handles, and other resources.

In Windows NT Performance Monitor, threads are objects within processes that execute program instructions. They allow concurrent operations within a process and enable one process to execute different parts of its program on different processors simultaneously. Each thread running on a system shows up as an instance for the Thread object type and is identified by association with its parent process. For example, if Print Manager has two active threads, Performance Monitor identifies them as Thread object instances Printman ==> 0 and Printman ==> 1.

transport driver interface (TDI)

A Windows NT interface for network redirectors and servers to use in sending network-bound requests to network transport drivers. This interface provides transport independence by abstracting transport-specific information.

trap

A processor's mechanism for capturing an executing thread when an unusual event (such as an exception or interrupt) occurs, and then transferring control to a fixed location in memory where the handler code resides. The trap handler determines the type of condition and transfers control to an appropriate handling routine.

trust relationship

Trust relationships are links between domains that enable pass-through authentication, in which a user has only one user account in one domain, yet can access the entire network. User accounts and global groups defined in a trusted domain can be given rights and resource permissions in a trusting domain, even though those accounts don't exist in the trusting domain's database. A trusting domain honors the logon authentications of a trusted domain.


Common Message Terms - U
Common Message Terms and User Actions	20 of 22

A B C D E F G H I K L M N O P R S T U V W

universal naming convention (UNC) name

A name given to a device, computer, or resource to enable other users and applications to establish an explicit connection and access the resources over the network. Also known as the uniform naming convention. The following example shows the syntax of a UNC name:

\\<computername>\<sharename>\<filename>

universally unique identifier (UUID)

A unique identification string associated with the remote procedure call interface. Also known as a globally unique identifier (GUID).

These identifiers consist of eight hexadecimal digits followed first by a hyphen, then by three groups of four hexadecimal digits with each group followed by a hyphen, and finally by twelve hexadecimal digits. For example, 12345678-1234-1234-1234-123456789ABC is a syntactically correct identifier. The identifiers on the client and server must match for the client and server to bind.

User mode

See Executive.


Common Message Terms - V
Common Message Terms and User Actions	21 of 22

A B C D E F G H I K L M N O P R S T U V W

value entries

The value for a specific entry under a key or subkey in the Registry. Value entries appear as a string with three components: a name, a type, and the value. See also Registry key.

virtual address space

See address space.

virtual DOS machine (VDM)

Provides a complete MS-DOS environment and a character-based window in which to run an MS-DOS – based application. Any number of VDMs can run simultaneously.

virtual memory

A logical view of memory that does not necessarily correspond to the memory's physical structure.

Normally, virtual memory is the space on your hard disk that Windows NT uses as if it were actually memory. Windows NT does this through the use of the paging file. However, virtual memory can also be unused address space that is allocated to a process but not yet in use. In this case, the memory will not physically exist anywhere until it is actually used (that is, until data or code is loaded into it).

The benefit of using virtual memory is that you can run more applications at one time than your system's physical memory would otherwise allow. The drawbacks are the disk space required for the virtual-memory paging file and the decreased execution speed when swapping is required. See also paging file.

volume

A file-based medium that has been initialized with a file system structure (for example, a floppy disk, a hard disk, a tape reel, or a particular partition on a hard disk). A disk partition or collection of partitions that have been formatted for use by a file system and that can also be used as volume sets, stripe sets, and mirror sets. See also partition.


Common Message Terms - W
Common Message Terms and User Actions	22 of 22

A B C D E F G H I K L M N O P R S T U V W

WINDBG.EXE

The Windows NT debugger (WINDBG.EXE) is a 32-bit application that, along with a collection of DLLs, is used for debugging the Kernel, device drivers, and applications. The same application can also be used on all hardware platforms, although there is a different build of it for each platform. It can be used for either remote or local debugging and can also be used in conjunction with the System Recovery option in Control Panel.

working set

The set of virtual pages that are in physical memory at any moment for a particular process. In a virtual memory system like Windows NT, a memory management system provides a large address space to each process by mapping the processes' virtual addresses into physical addresses as the processes' threads use them. When physical memory becomes full, the memory management system swaps selected memory contents to disk, reloading them from disk on demand.


Windows NT Executive Messages
Chapter 2	1 of 15

Windows NT Executive Messages

The Executive is the part of the Windows NT operating system that runs in Kernel mode. Kernel mode is a privileged processor mode in which a thread has access to system memory and to hardware. (In contrast, User mode is a nonprivileged processor mode in which a thread can only access system resources by calling system services.) The Windows NT Executive provides process structure, thread scheduling, interprocess communication, memory management, object management, object security, interrupt processing, I/O capabilities, and networking.

The Windows NT Kernel is the part of the Windows NT Executive that manages the processor. It performs thread scheduling and dispatching, interrupt and exception handling, and multiprocessor synchronization. It also provides primitive objects to the Windows NT Executive, which uses them to create User-mode objects.

There are three types of Windows NT Executive messages:

Character-mode STOP messages

Character-mode hardware-malfunction messages

Windows-mode STATUS messages

Many of these messages were created to cover everything else that could possibly happen, so you may never see them. For example, one of the STOP messages is "Unhandled Kernel exception." This message is only displayed after the Kernel exception dispatcher has exhausted its search of the Kernel call stack for exception-handling code. Similarly, a STATUS message announces the termination of a thread only after the Executive has searched the entire user call stack and the subsystem associated with the application for exception-handling code.

For help with hardware-malfunction messages, you should first contact a technician within your own organization to run hardware diagnostics on your computer. If you then need to find help outside your organization, contact the hardware vendor for your specific brand of computer, adapter, or peripheral device.

Most users will also need to ask for help with the STOP messages from a technical support person who has been trained to support Windows NT. Information on what you can do to help that trained technician use the Windows NT debugger application (WINDBG.EXE) appears in the "Windows NT Debugger" section at the end of this chapter.


Character-Mode Messages
Windows NT Executive Messages	2 of 15

Character-Mode Messages

Two types of character-mode messages occur when the Windows NT Kernel detects an inconsistent condition from which it cannot recover: STOP messages and hardware-malfunction messages. You can organize these messages into the following groups:

STOP messages that could happen only during the relatively short Windows NT startup period, which is Phase 4 of the Windows NT boot sequence

STOP messages that can be traced back to a software condition detected by the processor

Hardware-malfunction messages that can be traced back to a hardware condition detected by the processor

All the rest of the STOP messages


The STOP Message Screen
Windows NT Executive Messages	3 of 15

Character-Mode Messages

The STOP Message Screen

Character-mode STOP messages are always displayed on a full character-mode screen rather than in a Windows-mode message box. They are also uniquely identified by a hexadecimal number and a symbolic string, as in the following example:

*** STOP: 0x00000001

APC_INDEX_MISMATCH

The content of the symbolic string may suggest, to a trained technician, the part of the Kernel that detected the condition from which there was no recourse but to stop. However, keep in mind that the cause may actually be in another part of the system.

The following is an example of a complete STOP message screen generated by the Windows NT Kernel.

*** STOP: 0x0000001E (0x80000003,0x80106fc0,0x8025ea21,0xfd6829e8)

Unhandled Kernel exception c0000047 from fa8418b4 (8025ea21,fd6829e8)

Dll Base	Date Stamp	- Name	Dll Base	Date Stamp	- Name
80100000	2be154c9	- ntoskrnl.exe	80400000	2bc153b0	- hal.dll
80258000	2bd49628	- ncrc710.sys	8025c000	2bd49688	- SCSIPORT.SYS
80267000	2bd49683	- scsidisk.sys	802a6000	2bd496b9	- Fastfat.sys
fa800000	2bd49666	- Floppy.SYS	fa810000	2bd496db	- Hpfs_Rec.SYS
fa820000	2bd49676	- Null.SYS	fa830000	2bd4965a	- Beep.SYS
fa840000	2bdaab00	- i8042prt.SYS	fa850000	2bd5a020	- SERMOUSE.SYS
fa860000	2bd4966f	- kbdclass.SYS	fa870000	2bd49671	- MOUCLASS.SYS
fa880000	2bd9c0be	- Videoprt.SYS	fa890000	2bd49638	- NCR77C22.SYS
fa8a0000	2bd4a4ce	- Vga.SYS	fa8b0000	2bd496d0	- Msfs.SYS
fa8c0000	2bd496c3	- Npfs.SYS	fa8e0000	2bd496c9	- Ntfs.SYS
fa940000	2bd496df	- NDIS.SYS	fa930000	2bd49707	- wdlan.sys
fa970000	2bd49712	- TDI.SYS	fa950000	2bd5a7fb	- nbf.sys
fa980000	2bd72406	- streams.sys	fa9b0000	2bd4975f	- ubnb.sys
fa9c0000	2bd5bfd7	- mcsxns.sys	fa9d0000	2bd4971d	- netbios.sys
fa9e0000	2bd49678	- Parallel.sys	fa9f0000	2bd4969f	- serial.SYS
faa00000	2bd49739	- mup.sys	faa40000	2bd4971f	- SMBTRSUP.SYS
faa10000	2bd6f2a2	- srv.sys	faa50000	2bd4971a	- afd.sys
faa60000	2bd6fd80	- rdr.sys	faaa0000	2bd49735	- bowser.sys
Address	dword dump					Dll Base	Name
801afc20	80106fc0	80106fc0	00000000	00000000	80149905	: fa840000	- i8042prt.SYS
801afc24	80149905	80149905	ff8e6b8c	80129c2c	ff8e6b94	: 8025c000	- SCSIPORT.SYS
801afc2c	80129c2c	80129c2c	ff8e6b94	00000000	ff8e6b94	: 80100000	- ntoskrnl.exe
801afc34	801240f2	80124f02	ff8e6df4	ff8e6f60	ff8e6c58	: 80100000	- ntoskrnl.exe
801afc54	80124f16	80124f16	ff8e6f60	ff8e6c3c	8015ac7e	: 80100000	- ntoskrnl.exe
801afc64	8015ac7e	8015ac7e	ff8e6df4	ff8e6f60	ff8e6c58	: 80100000	- ntoskrnl.exe
801afc70	80129bda	80129bda	00000000	80088000	80106fc0	: 80100000	- ntoskrnl.exe
Kernel Debugger Using: COM2 (Port 0x2f8, Baud Rate 19200)

Restart and set the recovery options in the system control panel or the

/CRASHDEBUG system start option. If this message reappears, contact

your system administrator or technical support group.

As shown in the preceding example, STOP messages are presented in four parts:

The first part contains the most important error diagnostic information. In the preceding example, that diagnostic information is contained in the first two lines. These lines contain the STOP error code, its four parameters, and the text of the STOP error message.

You should always record, at least, those first few lines before trying to restart your computer. While those lines are important and a knowledgeable technician can often diagnose the source of a STOP condition with that information alone, they can be used best when combined with the information in the rest of the STOP screen.

Note

Under some conditions, the Kernel will be able to display only the top line of the STOP message. The services it needs to display the rest of the information may not be available.

The second part is a two-column display of the names of all the drivers loaded on the computer at the time the STOP message occurred, along with their base addresses in memory and a date-stamp that indicates the driver's file date. This section is important because many STOP messages contain in their parameter list the address of the instruction that caused the error. If the address falls within the base address of one of the drivers on this list, then that driver may be the cause of this error.

The third part is a dump of some of the calls on the stack that led up to the STOP message. Sometimes, the first few lines can tell an experienced support technician what component or driver caused the error. However, the last calls on the stack are not always the cause of the problem.

The fourth part provides confirmation of the communications parameters used by the Kernel debugger on the target computer, if enabled, and the following standard user response to a STOP message:

Restart and set the recovery options in the system control panel or the/CRASHDEBUG system start option. If this message reappears, contact your system administrator or technical support group.

The user response in the fourth part of the STOP message implies the following:

If you restart your computer, the STOP condition may not happen again. If the error does persist, you need to enable the Kernel debugger in either DEBUG or CRASHDEBUG mode on this computer. Instructions on configuring the computer for debugging can be found in the "Windows NT Debugger" section at the end of this chapter.

In general, debugging requires a trained technician, who will need all the information displayed in the STOP message to determine the cause of the error. The technician may also have to connect to the computer either locally or remotely using a modem to resolve the STOP condition.

Trained technicians are often available within one's own organization. Even if they cannot diagnose the condition, they are probably the people best able to talk with a technical support group about the contents of the STOP message.

Sample STOP Messages

The following two messages are typical examples of STOP messages.

Message ID	Text string
0x0000000A	Memory at <address> was referenced at IRQL <number> for <number> access from <address>
0x0000001E	Unhandled Kernel exception <code> from <address> (<parameter>, <parameter>)
The top two lines of the STOP message screen might look like the following ones for the STOP message uniquely identified by the hexadecimal number 0x0A.

*** STOP: 0x0000000A (0x0019524C,0x00000002,0x00000000,0x801122E5)

Memory at 19524c was referenced at IRQL 2 for 0 access from 801122e5.

The four most important pieces of diagnostic information are shown here twice: once as a parameter list on the top line, and then again embedded in the message text on the second line. The second and third parameters in this STOP message give the IRQL level (in this case, 2) and the access mode (where 0 = Read, and 1 = Write).

The fourth parameter, from address, identifies the location in memory of the instruction that caused the STOP error. This address can be used to identify the program module that was running at the time of the error. In the example of a complete STOP message given in the preceding section, the module I8042PRT.SYS has a base address at FA840000, which is the closest base address to FA8418B4.

The top two lines of the STOP message screen might look like the following ones for the STOP message uniquely identified by the hexadecimal number 0x1E.

*** STOP: 0x0000001E (0x80000003,0x80106FD0,0x00000000,0x00000000)

Unhandled Kernel exception 80000003 from 80106fd0 (0,0).

In this case, the second parameter identifies the module that was running at the time of the error.

The third and fourth parameters may be zero or nonzero. In the preceding example, they are both zero. The content of these two parameters is specific to the exception code generated. In other words, the value of the first parameter determines the values of the third and fourth parameters. Also, the third and fourth parameter values can only be interpreted in the context of the first parameter value.


STOP Messages That Occur Only at Executive Initialization
Windows NT Executive Messages	4 of 15

Character-Mode Messages

STOP Messages That Occur Only at Executive Initialization

There is a group of STOP messages that happen only during the relatively short Windows NT startup period, which is Phase 4 of the Windows NT boot sequence. Executive initialization is one step during Phase 4. That step can be further broken down into two phases: Phase 0 and Phase 1. During Phase 0 initialization, interrupts are disabled and only a few Executive components, such as the hardware abstraction layer (HAL), are initialized. During Phase 1 initialization, the system is fully operational, and the Windows NT subcomponents do a full initialization.

If you get one of the following Phase 0 initialization STOP messages, run the hardware diagnostics. If no hardware problems are found, reinstall Windows NT and try to initialize it again. If you get the same message again, contact a trained technician.

Table 2.1    Phase 0 Initialization STOP Messages

Message ID	Symbolic name
0x0031	PHASE0_INITIALIZATION_FAILED
0x005C	HAL_INITIALIZATION_FAILED
0x005D	HEAP_INITIALIZATION_FAILED
0x005E	OBJECT_INITIALIZATION_FAILED
0x005F	SECURITY_INITIALIZATION_FAILED
0x0060	PROCESS_INITIALIZATION_FAILED
If you get one of the following Phase 1 initialization STOP messages, reinstall Windows NT and try to initialize it again. If you still get the same message, contact a trained technician.

Table 2.2    Phase 1 Initialization STOP Messages

Message ID	Symbolic name
0x0032	PHASE1_INITIALIZATION_FAILED
0x0061	HAL1_INITIALIZATION_FAILED
0x0062	OBJECT1_INITIALIZATION_FAILED
0x0063	SECURITY1_INITIALIZATION_FAILED
0x0064	SYMBOLIC_INITIALIZATION_FAILED
0x0065	MEMORY1_INITIALIZATION_FAILED
0x0066	CACHE_INITIALIZATION_FAILED
0x0067	CONFIG_INITIALIZATION_FAILED
0x0068	FILE_INITIALIZATION_FAILED
0x0069	IO1_INITIALIZATION_FAILED
0x006A	LPC_INITIALIZATION_FAILED
0x006B	PROCESS1_INITIALIZATION_FAILED
0x006C	REFMON_INITIALIZATION_FAILED
0x006D	SESSION1_INITIALIZATION_FAILED
0x006E	SESSION2_INITIALIZATION_FAILED
0x006F	SESSION3_INITIALIZATION_FAILED
0x0070	SESSION4_INITIALIZATION_FAILED
0x0071	SESSION5_INITIALIZATION_FAILED


STOP Messages Caused by a Software Trap
Windows NT Executive Messages	5 of 15

Character-Mode Messages

STOP Messages Caused by a Software Trap

Another group of STOP messages is caused by a software condition detected by the processor. This condition, called a software trap, happens when a processor detects a problem in an executing instruction from which the processor will not continue. For instance, a processor will not carry out an instruction that contains invalid operands.

When you get a STOP message that is caused by a software trap, follow the steps given in "Remaining STOP Messages," later in this chapter.

The following is an example of the first line of the STOP message that is displayed for all software traps:

*** STOP: 0x0000007F (0x0000000n, 00000000, 00000000, 00000000)

UNEXPECTED_KERNEL_MODE_TRAP

The first parameter (shown as 0x0000000n in the example) in the message parameter list indicates which of twelve possible traps has occurred. For instance, in the case of an instruction that contains invalid operands, the message will appear as follows:

*** STOP: 0x0000007F (0x00000006, 00000000, 00000000, 00000000)

UNEXPECTED_KERNEL_MODE_TRAP

The following table shows the possible values and their meanings for that first parameter.

Parameter	Processor detected

0x00000000	An attempt to divide by zero.

0x00000001	A system-debugger call.

0x00000003	A debugger breakpoint.

0x00000004	An arithmetic operation overflow.

0x00000005	An array index that exceeds the array bounds.

0x00000006	Invalid operands in an instruction or an attempt to execute a protected-mode instruction while running in real mode.

0x00000007	A hardware coprocessor instruction, with no coprocessor present.

0x00000008	An error while processing an error (also known as a "double fault").

0x0000000A	A corrupt Task State Segment.

0x0000000B	An access to a memory segment that was not present.

0x0000000C	An access to memory beyond the limits of a stack.

0x0000000D	An exception not covered by some other exception (also known as a "general protection fault").


Hardware-Malfunction Messages
Windows NT Executive Messages	6 of 15

Character-Mode Messages

Hardware-Malfunction Messages

Hardware-malfunction messages are caused by a hardware condition detected by the processor. The first one or two lines of a hardware-malfunction message may differ depending on which company manufactured the computer. However, these lines always convey the same idea, as shown in the following example for an x86-based computer:

Hardware malfunction.

Call your hardware vendor for support.

The additional lines in each manufacturer's message screen also differ in format and content. Therefore, before doing what the sample message recommends, contact a technician within your own organization to run hardware diagnostics on your computer. The information provided below the first two lines will help your technician decide which hardware diagnostics to run. For example, for x86-based ISA bus computers, information is displayed that indicates whether this is a memory-parity error or a bus-data error. On x86-based EISA computers, if the hardware problem is in an adapter, the adapter slot number on the system board is displayed.

If you then still need to find help from outside your organization to interpret the information on the screen, contact the hardware vendor for your specific brand of computer, adapter, or peripheral device.


Remaining STOP Messages
Windows NT Executive Messages	7 of 15

Character-Mode Messages

Remaining STOP Messages

A typical user will not be able to diagnose the cause of any of the remaining STOP messages. When you get one of these messages, first record the top few lines of the STOP message and then restart the computer. If the STOP message occurs again, you have four options for diagnosing the STOP condition, all of which should be handled by a trained technician at your own site:

Diagnose the problem using the information displayed in the STOP message and any pertinent information from the Windows NT forum on CompuServe®, where Microsoft maintains an up-to-date list of causes for these STOP messages.

Use the Windows NT debugger to get more information about the problem.

If you use this option or the next one, be sure to switch Windows NT to debug mode before you restart your computer. See "Windows NT Debugger," later in this chapter, for information on how to prepare your computer for debugging.

Contact your own or another technical support group for assistance in using the Windows NT debugger remotely.

Contact your own or another technical support group to discuss the information in the STOP message. They may see a familiar pattern in the information and save everyone time.

The following list provides the ranges of unique hexadecimal numbers for the STOP messages that are least likely to happen. However, if one does occur, it will be after Windows NT Executive startup is complete and will not be caused by hardware or software traps in a processor. If you want more information about these messages, you can refer to the alphabetical list provided in Chapter 4, "Message Reference." However, most trained technicians will only need the unique hexadecimal number.

0x00000001 through 0x00000009

0x0000000B through 0x0000001D

0x0000001F through 0x00000030

0x00000033 through 0x0000005B

0x00000072 through 0x0000007B


Windows-Mode STATUS Messages
Windows NT Executive Messages	8 of 15

Windows-Mode STATUS Messages

The Executive displays a Windows-mode STATUS message box when it detects conditions within a process (generally, an application) that you should know about. STATUS messages can be divided into three types:

System-information messages. All you can do is read the information in the message box and choose the OK button. The Kernel will continue running the process or thread.

Warning messages. Some advise you to take an action that will enable the Kernel to keep running the process or thread. Others warn you that, although the process or thread will continue running, the results may not be correct.

Application-termination messages. These warn you that the Kernel is about to terminate either a process or a thread.


System-Information Messages
Windows NT Executive Messages	9 of 15

Windows-Mode STATUS Messages

System-Information Messages

System-information messages from the Executive provide status information on conditions within a process that should be noted but that will not stop the application from running. All that you can do with these messages is read the information and choose the OK button. If one of the following messages appears frequently while you are working in the same application, contact either the supplier of the application or your system administrator to adjust the configuration of your Windows NT computer.

Expedited Data Received		Partial Expedited Data Received		Serial IOCTL Complete
Image Relocated		Password Too Complex		Serial IOCTL Timeout
Invalid Current Directory		Redundant Read		TDI Event Done
Local Session Key		Redundant Write		TDI Event Pending
Object Exists		Registry Recovery		Thread Suspended
Partial Data Received		Segment Load		Working Set Range Error


Warning Messages
Windows NT Executive Messages	10 of 15

Windows-Mode STATUS Messages

Warning Messages

Warning messages from the Executive provide status information on more serious conditions within a process that could potentially stop the application or cause damage to your data. Some warning messages will prompt you indirectly for a user action, as in the following example:

Out of Paper:  The printer is out of paper.

If one of the following messages appears frequently while you are working in the same application, contact either the supplier of the application or your system administrator to adjust the configuration of your Windows NT computer.

Alignment Fault		Illegal EA	Out of Paper
Breakpoint		Inconsistent EA List	Page Locked
Buffer Overflow		Invalid EA Flag	Page Unlocked
Device Busy		I/O Bus Reset	Partial Copy
Device Offline		Kernel Debugger Awakened	Single Step
Device Power Is Off		Media Changed	Too Much Information
End of Media		No more EAs	Verifying Disk
Filemark Found		No More Entries
Guard Page Exception		No More Files
GUID Substitution		Non-Inheritable ACL
Handles Closed


Application-Termination Messages
Windows NT Executive Messages	11 of 15

Windows-Mode STATUS Messages

Application-Termination Messages

Application-termination messages from the Executive appear when the Kernel is about to terminate either the process in which an application is running or the thread of an application. Some of these messages will advise you to perform an action before restarting the application, as in the following example:

The application or DLL <filename> is not a valid Windows NT image.

Please check this against your installation disk.

In other cases, the user action is strongly implied, as in the following example:

The dynamic link library <filename> could not be found in the specific path <path>

This example implies that you should make sure that the DLL is in the path before you restart the application.

In yet other cases, you can only restart the application. If one of the following messages reappears, contact the supplier of the application.

Message box title		Message text
Access Denied		A process has requested access to an object, but has not been granted those access rights.
Already Committed		The specified address range is already committed.
Application Error		The exception name (number) occurred in the application at location address.
Application Error		The application failed to initialize properly (number).  Click on OK to terminate the application.
Application Exit by CTRL+C		The application terminated as a result of a CTRL+C.
Bad CRC		A cyclic redundancy check (CRC) checksum error occurred.
Bad File		The attributes of the specified mapping file for a section of memory cannot be read.
Bad Image		The application or DLL filename is not a valid Windows NT image. Please check this against your installation diskette.
Buffer Too Small		The buffer is too small to contain the entry. No information has been written to the buffer.
Cancel Timeout		The driver name failed to complete a canceled I/O request in the allotted time.
Cannot Continue		Windows NT cannot continue from this exception.
Conflicting Address Range		The specified address range conflicts with the address space.
Corrupt Disk		The file system structure on the disk is corrupt and unusable. Please run the Chkdsk utility on the volume name.
Corrupt File		The file or directory filename is corrupt and unreadable. Please run the Chkdsk utility.
Data Error		An error in reading or writing data occurred.
Data Late		A data late error occurred.
Data Not Accepted		The TDI client could not handle the data received during an indication.
Data Overrun		A data overrun error occurred.
Device Timeout		The specified I/O operation on name was not completed before the time-out period expired.
DLL Initialization Failed		Initialization of the dynamic link library filename failed. The process is terminating abnormally.
Drive Not Ready		The drive is not ready for use; its door may be open. Please check drive drive letter and make sure that a disk is inserted and that the drive door is closed.
Entry Point Not Found		The procedure entry point name could not be located in the dynamic link library filename.
EXCEPTION		A real-mode application issued a floating-point instruction and floating-point hardware is not present.
EXCEPTION		Array bounds exceeded.
EXCEPTION		Floating-point denormal operand.
EXCEPTION		Floating-point division by zero.
EXCEPTION		Floating-point inexact result.
EXCEPTION		Floating-point invalid operation.
EXCEPTION		Floating-point overflow.
EXCEPTION		Floating-point stack check.
EXCEPTION		Floating-point underflow.
EXCEPTION		Integer division by zero.
EXCEPTION		Integer overflow.
EXCEPTION		Privileged instruction.
EXCEPTION		Possible deadlock condition.
Fatal System Error		The name system process terminated unexpectedly with a status of address. The system has been shutdown.
File Not Found		The file filename does not exist.
Floppy Disk Error		While accessing a floppy disk, the track address from the sector ID field was found to be different than the track address maintained by the controller.
Floppy Disk Error		While accessing a floppy disk, an ID address mark was not found.
Floppy Disk Error		The floppy disk controller reported an error that is not recognized by the floppy disk driver.
Floppy Disk Error		While accessing a floppy-disk, the controller returned inconsistent results via its registers.
Hard Disk Error		While accessing the hard disk, a recalibrate operation failed, even after retries.
Hard Disk Error		While accessing the hard disk, a disk operation failed even after retries.
Hard Disk Error		While accessing the hard disk, a disk controller reset was needed, but even that failed.
Illegal Instruction		An attempt was made to execute an illegal instruction.
Incorrect Network Resource Type		The specified device type (LPT, for example) conflicts with the actual device type on the remote resource.
Incorrect Password to LAN Manager Server		You specified an incorrect password to a LAN Manager 2.x or MS-NET server.
Incorrect System Call Level		An invalid level was passed into the specified system call.
Incorrect Volume		The target file of a rename request is located on a different device than the source of the rename request.
Invalid Lock Sequence		An attempt was made to execute an invalid lock sequence.
Invalid Mapping		An attempt was made to create a view for a section which is bigger than the section.
Invalid Parameter		The specified information class is not a valid information class for the specified object.
Missing System File		The required system file filename is bad or missing.
Network Name Not Found		The specified share name cannot be found on the remote server.
Network Request Timeout		The session with a remote server has been disconnected because the time-out interval for a request has expired.
No Disk		There is no disk in the drive. Please insert a disk into drive drive letter.
No Paging File Specified		No paging file was specified in the system configuration.
Not Enough Quota		Not enough virtual memory or paging file quota is available to complete the specified operation.
Not Implemented		The requested operation is not implemented.
Operation Failed		The requested operation was unsuccessful.
Ordinal Not Found		The ordinal number could not be located in the dynamic link library filename.
Out of Virtual Memory		Your system is running low on virtual memory. Please close some applications. You can then start the System option in the Control Panel and choose the Virtual Memory button to create an additional paging file or to increase the size of your current paging file.
Path Not Found		The path path does not exist.
Privilege Failed		The I/O permissions for the process could not be changed.
Registry File Failure		The registry cannot load the hive (file): name or its log or alternate. It is corrupt, absent, or not writable.
Section Too Large		The specified section is too big to map the file.
Sector Not Found		The specified sector does not exist.
Still Busy		The specified I/O request packet (IRP) cannot be disposed of because the I/O operation is not complete.
The Registry Is Corrupt		The structure of one of the files that contains Registry data is corrupt, or the image of the file in memory is corrupt, or the file could not be recovered because the alternate copy or log was absent or corrupt.
Unable to Create Paging File		The creation of the paging file filename failed (number). The requested size was number.
Unable To Locate DLL		The dynamic link library filename could not be found in the specified path path.
Unable to retrieve browser server list		The list of servers for this workgroup is not currently available.
Unexpected Failure in DebugActiveProcess		An unexpected failure occurred while processing a DebugActiveProcess API request.   You may choose OK to terminate the process, or Cancel to ignore the error.
Unknown Disk Format		The disk in drive drive letter is not formatted properly. Please check the disk, and reformat if necessary.
Write Protect Error		The disk cannot be written to because it is write protected. Please remove the write protection from the volume name in drive drive letter.
Wrong Type		There is a mismatch between the type of object required by the requested operation and the type of object that is specified in the request.
Wrong Volume		The wrong volume is in the drive. Please insert volume name into drive drive letter.


Windows NT Debugger
Windows NT Executive Messages	12 of 15

Windows NT Debugger

The Windows NT debugger (WinDbg) is a 32-bit application that, along with a collection of DLLs, is used for debugging the Kernel, device drivers, and applications. This section, however, will only discuss how to use WinDbg for Kernel debugging. The same application can be used on all hardware platforms, although there is a different build of it for each platform. It is provided on the Windows NT CD-ROM under the \SUPPORT\DEBUG directory.

It can be used for either remote or local Kernel debugging and can also be used in conjunction with the Recovery option located under the System option in Control Panel. Both remote and local Kernel debugging require that WinDbg run on another Windows NT host computer that is connected to your Windows NT target computer. The two computers send debugging (troubleshooting) information back and forth through communications ports that must be running at the same baud rate on each computer.

With local Kernel debugging, the host computer is located within a few feet of the target computer, and the two computers communicate through a null-modem serial cable. With remote Kernel debugging, the host computer can be any distance from the target computer, since communication takes place through modems.

Using the Recovery option allows you to configure the target computer to write debugging information to a log file when a STOP error occurs. This file preserves the state of the computer at the time of the STOP error, and the log file can be used later by WinDbg to troubleshoot the problem. By using this option, you can run WinDbg on any computer after loading the log file, including the computer on which the STOP error occurred.

When you get a Windows NT Executive STOP or STATUS message on a Windows NT Workstation computer, you should restart the computer after recording the important information in the message. (On a Windows NT Server computer, the computer restarts by default after writing an event to the system log, alerting administrators, and dumping system memory to the log file called MEMORY.DMP. Therefore, to preserve log files, you should copy them to a new filename each time a STOP error occurs.) You may then want to continue running Windows NT until the message is redisplayed.

When that happens, you need to decide whether to debug the STOP error locally or remotely and then configure your system appropriately. If a trained technician is available, you could also ask him or her to do one of the preparatory procedures given in this section to set up your computer to run WinDbg remotely. Or you could call your technical support group and request assistance with the debugging.


Configuring a System for Debugging
Windows NT Executive Messages	13 of 15

Windows NT Debugger

Configuring a System for Debugging

Ordinarily, you will run Windows NT Workstation or Windows NT Server with the debug mode turned off, which is the default when Windows NT Setup installs the system. In that mode, an Executive STOP or STATUS message will not enable the debugger. To switch Windows NT into debug mode, you have to edit the Windows NT startup file, BOOT.INI, and include one of the two debug-mode switches: /crashdebug or /debug. If you include the /crashdebug switch in the BOOT.INI file, the debugger is loaded when you start but remains inactive unless a Kernel error occurs. This mode is useful if you are experiencing random, unpredictable Kernel errors. When you include the /debug switch, the debugger is loaded when you start and can be activated at any time by a debugger connected to the computer. This is the standard mode used when debugging problems that are regularly reproducible.

You can also change the default communications port and baud rate by editing the BOOT.INI file. Since the code that enables remote Kernel debugging resides in the hardware abstraction layer (HAL), the defaults for the communications port and baud rate may vary from one computer to another. On x86-based computers, if you have more than one communications port, the default debug port is set to COM2. However, if you have a serial mouse attached to COM2, the default debug port is set to COM1. If you do not set the baud rate, the default baud rate is 9600 if a modem is attached. If necessary, you can verify later what baud rate has been set. On RISC-based computers, the default debug port is set to COM1.

When you are finished debugging the computer, you should turn the debug mode off again. To do this, repeat the process of editing the BOOT.INI file or the OSLOADOPTIONS environmental variable, and delete any values you set to enable debugging. On a RISC-based computer, this may mean the OSLOADOPTIONS variable has no values, which is acceptable.

To specify settings, you can use the following procedure, which will prepare your computer for either remote or local Kernel debugging.

To prepare an x86-based target computer for remote or local debugging

1.	For remote debugging, connect a modem to the communications port, turn the power on, and set the modem to auto-answer. This could also be done on a second computer and then the modem could be moved to the target computer after a Kernel error occurs.

For local debugging, connect the null-modem serial cable to any available communications port.

2.	Restart the computer under MS-DOS or Windows NT.

If you can restart under Windows NT, double-click the Command Prompt icon in the Main group to access the command line.

3.	To turn off the system, hidden, and read-only attributes of the BOOT.INI file, type:

attrib -s -h -r boot.ini

The BOOT.INI file is usually located in the root directory of the partition from which the Windows NT NTLDR program was loaded, which is ordinarily C:\.

4.	To use MS-DOS Editor to change the BOOT.INI file, type:

edit boot.ini

The BOOT.INI file appears within the MS-DOS Editor window and normally looks something like the following example:

[boot loader]

timeout=30

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows NT" Version 3.5"

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows NT" Version 3.5 [VGA mode]" /BASEVIDEO

C:\="MS-DOS"

Each entry in the [operating systems] section should correspond to the options listed in the boot menu during a normal system startup.

5.	Select the startup option that you normally use and add either the /debug or /crashdebug switch at the end of the line.

An alternative to using the /debug switch is to add switches at the end of the line that explicitly set the communications port and baud rate your computer will use to send debugging information.

6.	To specify the communications port, add the switch /debugport=comx, where x is the communications port that you want to use.

7.	To specify the baud rate, add the switch /baudrate=<baudrate>.

Valid speeds for the baud rate range from 75 to 115,200 baud. The hardware will determine the speed chosen. 9600 baud is the normal rate for remote debugging over a modem. Local debugging over a serial cable can run as fast as 57,600 baud or higher if both computers can support the speed.

The following is an example of a startup-option line specifying the communications port and baud rate:

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows NT" Version 3.5" /debugport=com1 /baudrate=9600

8.	Save the file and quit MS-DOS Editor.

9.	Restart the computer to run under Windows NT.

You may now contact your technical support group or a trained technician and have them call the modem to establish a remote debugging session.

Preparing a RISC-based computer for remote or local Kernel debugging also involves editing one line in a startup file, but you access that file in a different manner.

To prepare a RISC-based target computer for remote or local debugging

1.	For remote debugging, connect a modem to the communications port, turn the power on, and set the modem to auto-answer. This could also be done on a second computer and then the modem could be moved to the target computer after a Kernel error occurs.

For local debugging, connect the null-modem serial cable to any available communications port.

2.	Restart the computer.

The ARC System screen appears, displaying the main menu from which you can select an action.

3.	On a MIPS RISC-based system, choose Run Setup to display the Setup menu and then choose Manage Startup to display a menu of the boot options.

On a Digital Alpha AXP RISC-based system, choose Supplementary Menu, Set Up the System, and Manage Boot Selection Menu to display a menu of the boot options.

4.	Choose Change a Boot Selection to display a list of the operating systems that are installed on this computer.

5.	Choose the Windows NT operating system. If you have more than one version of Windows NT installed, select the one that you want to debug.

A two-part screen appears for changing the current settings of the environment variables used to start the RISC-based computer. The environment variable that controls whether or not the RISC-based computer starts up in debug mode is the OSLOADOPTIONS variable.

6.	To edit the value for the OSLOADOPTIONS variable, use the arrow keys to select it from the list of variables.

Once selected, it appears in the Name box at the top of the screen.

7.	Press ENTER to display the Value box.

8.	Type debug or crashdebug in the Value box and press enter to save it and turn the debug mode on.

You may also add a value that explicitly sets the communications port, as in the following example:

OSLOADOPTIONS  debug  debugport=com2

If you do not specify the debug port, the default debug port is set to COM1. Since RISC-based computers allow only a default baud rate of 19200, you do not need to specify the baud rate.

9.	Press Esc to stop editing.

10.	On a MIPS RISC-based system, choose Return To Main Menu and then Exit to return to the ARC System screen.

On a Digital Alpha AXP RISC-based system, choose Supplementary Menu, save your changes, and then choose Boot Menu to return to the ARC System screen.

If this is the first time that you have debugged a Digital Alpha AXP RISC-based system, after connecting the local host computer, you now need to do the following:

Shut down both computers

Restart the host (debugger) computer

Run WinDbg in Kernel-debug mode

Restart the target (Digital Alpha AXP RISC-based) computer while WinDbg is running on the host computer to set up configuration information on the target computer and prepare it for either local or remote debugging.

11.	Restart the computer to run under Windows NT.

You may now contact your technical support group or a trained technician and have them call the modem to establish a remote debugging session.


Using WinDbg for Local Kernel Debugging
Windows NT Executive Messages	14 of 15

Windows NT Debugger

Using WinDbg for Local Kernel Debugging

The WinDbg host computer can also be local to the target Windows NT computer. WinDbg runs on the Windows NT host computer and communicates through an industry-standard null-modem serial cable with the target Windows NT computer. For local Kernel debugging, the target computer has to be prepared in the same way as it is for remote Kernel debugging.

Setting Up a System for Local Kernel Debugging

To debug Windows NT Executive messages using a local debugging system, you need to prepare the host and target computers and then connect the two computers with an industry-standard null-modem serial cable. Be sure to start the host computer before restarting the target computer.

A standard, commercially available null-modem serial cable has the following configuration:

Transmit Data connected to Receive Data

Receive Data connected to Transmit Data

Ground connected to Ground

For 9-pin and 25-pin D-subminiature connectors, the cable connects as follows:

Pin 2 to pin 3

Pin 3 to pin 2

Pin 7 to pin 7

The WinDbg logic does not depend on any control pins (such as Data Terminal Ready, Data Set Ready, Request To Send, or Clear To Send). However, in the connectors on both ends of the cable, you may have to put a jumper from Data Terminal Ready to Data Set Ready and from Request To Send to Clear To Send.

On a db9 connector, this would be a jumper from pin 4 to pin 6 and a jumper from pin 7 to pin 8.

On a db25 connector, this would be a jumper from pin 20 to pin 6 and from pin 4 to pin 5.

Preparing the target computer for local Kernel debugging is the same as for remote Kernel debugging. The only difference is that instead of connecting a modem to one of the target computer's communications ports, you connect a null-modem serial cable. See "Configuring a System for Debugging," earlier in this chapter, for detailed procedures.

Which port you use (COM1 or COM2) depends on what you did to prepare your target and host computers. The default connection is from COM1 of the host computer to COM2 of the target computer. However, you may change that by editing the boot configuration on the target computer or by changing the command line parameters used when you start WinDbg.

The Windows NT Setup program does not install WinDbg as part of the Windows NT installation process. However, you can easily copy the WinDbg program directly onto the hard disk of the host computer. It is distributed on the Windows NT CD-ROM in an uncompressed format under the \SUPPORT\DEBUG directory.

Note

If you do not have a CD-ROM drive, the WinDbg program is also available from Microsoft Support Network. You can request that they send you the software on a floppy disk, or ask for instructions on how to download it from CompuServe.

To copy and start WinDbg on the host computer

1.	Connect the null-modem serial cable to the communications port defined in the BOOT.INI file of the host computer.

Notice that the communications port can be different for the host and target computers.

2.	Create a subdirectory called \SYMBOLS on the host computer's hard disk under the directory in which you have installed Windows NT.

3.	Copy the debugging symbols from the \SUPPORT\DEBUG\<platform>\SYMBOLS directory on the CD-ROM to the \SYMBOLS directory on the host computer. Platform refers to the hardware platform of the host computer.

4.	Copy all the files from the \SUPPORT\DEBUG\<platform> directory on the CD-ROM to the \SYSTEM32 directory on the host computer. This can be done with the xcopy or copy command. Make sure that the following files are copied to the host computer:

EECXXALP.DLL		IMAGEHLP.DLL		TLLOC.DLL
EECXXMIP.DLL		KDEXTALP.DLL		TLPIPE.DLL
EECXXX86.DLL		KDEXTMIP.DLL		TLSER.DLL
EMALP.DLL		KDEXTX86.DLL		WINDBG.EXE
EMMIP.DLL		SHCV.DLL		WINDBG.HLP
EMX86.DLL		SYMCVT.DLL		WINDBGRM.EXE
5.	To start WinDbg in Kernel-debug mode from either the command line or the File Run dialog box in Program Manager, type:

<path> windbg -k <target platform> <com port> <speed> -y <symbol path> -v

where:

Path is the path to the WINDBG.EXE file.

-k invokes the Kernel-debug mode.

Target platform refers to the hardware platform of the target computer and corresponds to the name of the directory from which you obtained the WinDbg files, such as I386, MIPS, or ALPHA.

Com port is the port to which you have connected the null-modem serial cable.

Speed is the  baud rate.

-y indicates that the next parameter is the symbol path.

Symbol path is the path to the \SYMBOLS directory created in step 2.

The following is an example of such a command:

c:\ windbg -k i386 com1 19200 -y c:\windows\symbols

6.	To create a log of the debugging session, from the Options menu, choose Debug.

7.	In the Logfile section of the Debugger Options dialog box, you can:

Select the Open Automatically check box to have WinDbg open a log file whenever it starts. If you want to specify a path and name for the log file, type one in the Name text box.

Select the Append check box to append new data to an existing log file. Otherwise, the file will be overwritten.

For more information on WinDbg settings, see the online Help file.

Running a Local Debugging Session

Once you have prepared the two computers and connected them, you can start a debugging session. There can be many objectives for a debugging session; this chapter discusses the objective of collecting information (in the debug-session log file on the host computer) about the events leading up to a particular Windows NT Executive message on the target computer.

Note

Once you are in the Kernel-debug mode of WinDbg, you can display a list of commands by typing help or ? at the KD command prompt on the host computer. The Kernel-debug character-mode command-line interface has a vocabulary of about four dozen commands, plus it supports advanced debugging features such as watches and breakpoints. For more information on the commands and advanced features, see the online Help file.

Quitting a Local Debugging Session

Quitting WinDbg on the host computer at the end of a local debugging session will also save the debug-session log file.

To quit WinDbg and save the log file on the host computer

1.	From the Run menu, choose Stop Debugging.

2.	From the File menu, choose Exit.

3.	Restart the target computer.


Using WinDbg with the Recovery Option
Windows NT Executive Messages	15 of 15

Windows NT Debugger

Using WinDbg with the Recovery Option

If you do not want to or are unable to do local or remote debugging, you can use the Recovery option located under the System option in Control Panel. Whenever a Windows NT Executive STOP error occurs, Windows NT can save the state of the computer system to a log file on the boot partition. This file contains all the information needed by WinDbg to troubleshoot the STOP error as if you were connected to a live computer experiencing the problem. In addition, all the WinDbg commands that work during a local or remote debugging session also work in this mode.

This enables you to examine the error at any time and immediately restart the computer that failed instead of keeping it down during the debug session. The only drawback to this method is that, to contain all the necessary information for a debug session, you must have sufficient space on your hard disk for the resulting log file, which will be as large as your RAM memory. Therefore, whenever a STOP error occurs, a computer with 32 MB of RAM will produce a 32-MB log file.

To configure Windows NT to save STOP information to a log file

1.	In Control Panel, choose the System option.

2.	In the System dialog box, choose the Recovery button.

3.	In the Recovery dialog box, select the Write Debugging Information To check box, and either accept the default path and filename (C:\systemroot\MEMORY.DMP) or type your own in the text box.

To have this log file overwrite any file of the same name, select the Overwrite Any Existing File check box. If you clear this check box, Windows NT will not write a log file if there is already a file by that name.

To debug a log file using WinDbg

1.	Create a subdirectory called \SYMBOLS on the host computer's hard disk under the directory in which you have installed Windows NT.

2.	Copy the debugging symbols, corresponding to the target computer that produced the log file, from the \SUPPORT\DEBUG\<platform>\SYMBOLS directory on the CD-ROM to the \SYMBOLS directory on the host computer.

Platform refers to the hardware platform of the host computer.

3.	Copy all the files from the \SUPPORT\DEBUG\<platform> directory on the CD-ROM to the \SYSTEM32 directory on the host computer.

This can be done with the xcopy or copy command.

4.	To start WinDbg in Kernel-debug mode from either the command line or the File Run dialog box in Program Manager, type:

<path> windbg -z <filename> -y <symbol path>

Where:

Path is the path to the WINDBG.EXE file.

-z invokes the Kernel-debug mode using the MEMORY.DMP file.

Filename is the path and name of the log file that you want to debug.

-y indicates that the next parameter is the symbol path.

Symbol path is the path to the \SYMBOLS directory.

The following is an example of such a command:

c:\ windbg -z c:\windows\memory.dmp -y c:\windows\symbols

5.	To create a log of the debugging session, from the Options menu, choose Debug.

6.	In the Logfile section of the Debugger Options dialog box, you can:

Select the Open Automatically check box to have WinDbg open a log file whenever it starts. If you want to specify a path and name for the log file, type one in the Name text box.

Select the Append check box to append new data to an existing log file. Otherwise, the file will be overwritten.

For more information on WinDbg settings, see the online Help file.


Network Reference Tables
Chapter 3	1 of 3

Network Reference Tables

There should always be more than one way to look up information. Normally, references provide information that is organized in alphabetical order. However, the network messages also have a unique identification number that can be used for sorting these messages.

This chapter provides two numerically organized lists of the network messages: network message ID numbers and down-level network message ID numbers.


Network Message ID Numbers
Network Reference Tables	2 of 3

Network Message ID Numbers

Network messages have an error code or message identification number associated with them and can be seen by typing net helpmsg message number at the command prompt. They can also be divided into two groups: Windows NT Workstation/Windows NT Server Network Messages and Down-level Network Messages.

In Chapter 4, "Message Reference," the network messages are presented alphabetically and interspersed with the other system messages. In the following table, they have been arranged numerically. Missing or skipped numbers could be related to simple messages, such as "Password expires," that were not included in the printed version, or they may be in the Down-level Network Message ID Numbers table, which is provided in the second section of this chapter.

ID	Message text

2102	The workstation driver is not installed.

2104	An internal error occurred. The network cannot access a shared memory segment.

2105	A network resource shortage occurred.

2106	This operation is not supported on workstations.

2114	The Server service is not started.

2115	The queue is empty.

2116	The device or directory does not exist.

2118	The name has already been shared.

2119	The server is currently out of the requested resource.

2121	Requested addition of items exceeds the maximum allowed.

2123	The API return buffer is too small.

2136	A general network error occurred.

2137	The Workstation service is in an inconsistent state. Restart the computer before restarting the Workstation service.

2138	The Workstation service has not been started.

2140	An internal Windows NT error occurred.

2141	The server is not configured for transactions.

2142	The requested API is not supported on the remote server.

2144	The computer name already exists on the network. Change it and restart the computer.

2146	The specified component could not be found in the configuration information.

2147	The specified parameter could not be found in the configuration information.

2150	The printer does not exist.

2151	The print job does not exist.

2180	The service does not respond to control actions.

2182	The requested service has already been started.

2184	The service has not been started.

2185	The service name is invalid.

2186	The service is not responding to the control function.

2187	The service control is busy.

2189	The service could not be controlled in its present state.

2191	The requested pause or stop is not valid for this service.

2194	A thread for the new service could not be created.

2202	The user name or group name parameter is invalid.

2203	The password parameter is invalid.

2211	The server is configured without a valid user path.

2219	The security database could not be found.

2220	The group name could not be found.

2221	The user name could not be found.

2222	The resource name could not be found.

2223	The group already exists.

2224	The user account already exists.

2226	This operation is only allowed on the primary domain controller of the domain.

2227	The security database has not been started.

2229	A disk I/O failure occurred.

2233	Unable to add to the user accounts database session cache segment.

2234	This operation is not allowed on this special group.

2236	The user already belongs to this group.

2237	The user does not belong to this group.

2239	This user account has expired.

2240	The user is not allowed to log on from this workstation.

2241	The user is not allowed to log on at this time.

2242	The password of this user has expired.

2245	The password is shorter than required.

2246	The password of this user is too recent to change.

2247	The security database is corrupted.

2249	This replicant database is outdated; synchronization is required.

2250	The network connection could not be found.

2251	This asg_type is invalid.

2270	The computer name could not be added as a message alias. The name may already exist on the network.

2273	This message alias could not be found on the network.

2276	This message alias already exists locally.

2277	The maximum number of added message aliases has been exceeded.

2278	The computer name could not be deleted.

2280	An error occurred in the domain message processor.

2281	The message was sent, but the recipient has paused the Messenger service.

2282	The message was sent but not received.

2283	The message alias is currently in use. Try again later.

2285	The name is not on the local computer.

2289	The broadcast message was truncated.

2294	This is an invalid device name.

2297	A duplicate message alias exists on the network.

2298	This message alias will be deleted later.

2299	The message alias was not successfully deleted from all networks.

2310	This shared resource does not exist.

2311	This device is not shared.

2312	A session does not exist with that computer name.

2351	This computer name is invalid.

2357	Could not determine the type of input.

2362	The buffer for types is not big enough.

2378	This log file has changed between reads.

2401	There are open files on the connection.

2403	This share name or password is invalid.

2404	The device is being accessed by an active process.

2432	An invalid or nonexistent alert name was raised.

2453	Could not find the domain controller for this domain.

2457	This server's clock is not synchronized with the domain controller's clock.

2470	Try down-level (remote admin protocol) version of API instead.

2481	The UPS service is not configured correctly.

2482	The UPS service could not access the specified Comm Port.

2483	The UPS indicated a line fail or low battery situation. Service not started.

2484	The UPS service failed to perform a system shutdown.

2550	The browser service was configured with MaintainServerList=No.

3020	A power failure was detected at name. The server has been paused.

3021	Power has been restored at name. The server is no longer paused.

3022	The UPS service is starting shutdown at name due to low battery.

3023	There is a problem with a configuration of user specified shutdown command file. The UPS service started anyway.

3030	The server cannot export directory name, to client name. It is exported from another server.

3031	The replication server could not update directory name from the source on name due to error code.

3032	Master name did not send an update notice for directory name at the expected time.

3034	The domain controller for domain name failed.

3035	Failed to authenticate with name, a Windows NT Server for domain name.

3038	Replicator could not access name on name due to system error code.

3039	Replicator limit for files in a directory has been exceeded.

3040	Replicator limit for tree depth has been exceeded.

3041	The replicator cannot update directory name. It has tree integrity and is the current directory for some process.

3042	Network error code occurred.

3045	System error code occurred.

3047	IMPORT path path cannot be found.

3049	Replicated data has changed in directory name.

3051	The Registry or the information you just typed includes an illegal value for text.

3054	A request for resource could not be satisfied.

3056	A system error has occurred.

3057	An internal consistency error has occurred.

3060	The service did not respond to control and was stopped with the DosKillProc function.

3061	An error occurred when attempting to run the service program.

3062	The sub-service failed to start.

3064	There is a problem with the file.

3095	This Windows NT computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.

3096	The Windows NT primary domain controller for this domain could not be located.

3100	The operation failed because a network software error occurred.

3106	An unexpected network control block (NCB) was received. The NCB is the data.

3112	An illegal server message block (SMB) was received. The SMB is the data.

3113	Initialization failed because the requested service name could not be started.

3140	The service has stopped due to repeated consecutive occurrences of a network control block (NCB) error. The last bad NCB follows in raw data.

3152	An illegal server message block (SMB) was received. The SMB is the data.

3170	The Alerter service had a problem creating the list of alert recipients. The error code is code.

3172	There was an error sending name the alert message - text. The error code is code.

3173	There was an error in creating or reading the alerter mailslot. The error code is code.

3206	The replicator cannot update directory name. It has tree integrity and is the current directory for some process.

3207	The server cannot export directory name to client name. It is exported from another server.

3208	The replication server could not update directory name from the source on name due to error code.

3209	Master name did not send an update notice for directory name at the expected time.

3210	Failed to authenticate with name, a Windows NT Server for domain name.

3212	Network error code occurred.

3215	Unrecognized message received in mailslot.

3216	System error code occurred.

3218	IMPORT path path cannot be found.

3222	Replicator could not access filename on name due to code system error.

3223	The primary domain controller for domain name has apparently failed.

3224	An error occurred while changing this computer's password.

3226	An error occurred while synchronizing with primary domain controller name.

3230	A power failure was detected at the server.

3231	The UPS service performed server shutdown.

3232	The UPS service did not complete execution of the user specified shutdown command file.

3236	The UPS service failed to execute a user specified shutdown command file filename. The error code is the data.

3257	The system returned an unexpected error code. The error code is the data.

3408	The program cannot be used with this operating system.

3501	You used an invalid option.

3502	System error code has occurred.

3503	The command contains an invalid number of arguments.

3504	The command completed with one or more errors.

3505	You used an option with an invalid value.

3506	The option name is unknown.

3507	Option name is ambiguous.

3510	A command was used with conflicting switches.

3511	Could not find subprogram name.

3513	More data is available than can be returned by Windows NT.

3515	This command can be used only on a Windows NT Server system.

3521	The name service is not started.

3523	The name service could not be started.

3527	The name service is stopping.

3528	The name service could not be stopped.

3533	The service is starting or stopping. Please try again later.

3534	The service did not report an error.

3538	The name service failed to resume.

3539	The name service failed to pause.

3540	The name service continue is pending. text

3541	The name service pause is pending. text

3544	The name service has been started by another process and is pending. text

3547	A service-specific error occurred: code.

3679	An error occurred while reading your profile.

3689	The Workstation service is already running. Windows NT will ignore command options for the workstation.

3691	There are open files and/or incomplete directory searches pending on the connection to name.

3710	An error occurred while opening the Help file.

3711	The Help file is empty.

3712	The Help file is corrupted.

3713	Could not find a primary domain controller for domain name.

3716	The device type is unknown.

3719	A matching share could not be found so nothing was deleted.

3721	The password is invalid for name.

3722	An error occurred while sending a message to name.

3723	The password or user name is invalid for name.

3725	An error occurred when the share was deleted.

3726	The user name is invalid.

3727	The password is invalid.

3728	The passwords do not match.

3729	Your persistent connections were not all restored.

3730	This is not a valid computer name or domain name.

3732	Default permissions cannot be set for that resource.

3734	A valid password was not entered.

3735	A valid name was not entered.

3736	The resource named cannot be shared.

3737	The permissions string contains invalid permissions.

3738	You can only perform this operation on printers and communication devices.

3742	Name is an invalid user or group name.

3743	The server is not configured for remote administration.

3753	User user name is not a member of group name.

3754	User user name is already a member of group name.

3755	There is no such user: user name.

3756	This is an invalid response.

3757	No valid response was provided.

3760	Date is not a recognized day of the week.

3761	The time range specified ends before it starts.

3762	Number is not a recognized hour.

3763	Number is not a valid specification for minutes.

3764	Time supplied is not exactly on the hour.

3765	12 and 24 hour time formats may not be mixed.

3766	Text is not a valid 12-hour suffix.

3767	An illegal date format has been supplied.

3768	An illegal day range has been supplied.

3769	An illegal time range has been supplied.

3770	Arguments to NET USER are invalid. Check the minimum password length and/or arguments supplied.

3771	The value for ENABLESCRIPT must be YES.

3773	An illegal country code has been supplied.

3774	The user was successfully created but could not be added to the USERS local group.

3775	The user context supplied is invalid.

3776	The dynamic-link library name could not be loaded, or an error occurred while trying to use it.

3777	Sending files is no longer supported.

3778	You may not specify paths for ADMIN$ and IPC$ shares.

3779	User or group name is already a member of local group name.

3780	There is no such user or group: name.

3781	There is no such computer: computer name.

3782	The computer computer name already exists.

3790	The system could not find message: text.

3802	This schedule date is invalid.

3805	The Server service has not been started.

3806	The AT job ID does not exist.

3809	The command line cannot exceed 259 characters.

3813	The AT schedule file was deleted.

3815	The AT command has timed-out. Please try again later.

3816	The minimum password age for user accounts cannot be greater than the maximum password age.

3817	You have specified a value that is incompatible with servers with down-level software. Please specify a lower value.

3870	Computer name is not a valid computer name.

3871	Code is not a valid Windows NT message number.

3912	Could not locate a time-server.

3913	Could not find the primary domain controller for domain name.

3915	The user's home directory could not be determined.

3916	The user's home directory has not been specified.

3917	The name specified for the user's home directory name is not a universal naming convention (UNC) name.

3932	Name is not a valid domain or workgroup name.

3951	You specified too many values for the name option.

3952	You entered an invalid value for the name option.

3953	The syntax is incorrect.

3960	You specified an invalid file number.

3961	You specified an invalid print job number.

3963	The user or group account specified cannot be found.

4738	The share name entered is not accessible from an MS-DOS workstation. Are you sure you want to use this share name? name:

5022	Printing errors occurred.

5305	A network control block (NCB) command timed-out. The session may have terminated abnormally. The NCB is the data.

5309	No resource was available in the network adapter. The network control block (NCB) request was refused. The NCB is the data.

5317	The local session table is full. The network control block (NCB) request was refused. The NCB is the data.

5334	There are too many network control block (NCB) commands outstanding. The NCB request was refused. The NCB is the data.

5508	The security database full synchronization has been initiated by the server name.

5509	Windows NT could not be started as configured. A previous working configuration was used instead.

5510	The exception 0xnumber occurred in the application application at location 0xnumber.

5511	The server name claims to be a primary domain controller for the name domain. However, the security identifier on the server name in that domain and on the primary domain controller name don't match. One of the servers should be removed from the domain.

5512	The server name and name both claim to be the primary domain controller for the name domain. One of the servers should be demoted or removed from the domain.

5513	The computer computer name connected to server name using the trust relationship to the name domain. However, the computer doesn't properly know the security identifier (SID) for the domain. Reestablish the trust relationship.

5601	The password for this computer is not found in the local security database.

5602	An internal error occurred while accessing the computer's local or network security database.

5700	The Netlogon service could not initialize the replication data structures successfully. The service is terminated.

5701	The Netlogon service failed to update the domain trust list.

5702	The Netlogon service could not add the RPC interface. The service is terminated.

5703	The Netlogon service could not read a mailslot message from name.

5704	The Netlogon service failed to register the service with the service controller. The service is terminated.

5705	The change log cache maintained by the Netlogon service for database changes is corrupted. The Netlogon service is resetting the change log.

5706	The Netlogon service could not create server share name.

5707	The down-level logon request for the user user name from name failed.

5708	The down-level logoff request for the user user name from name failed.

5709	The Windows NT network logon request for the user name from computer name (via name) failed.

5710	The Windows NT network logoff request for the user name from computer name failed.

5711	The partial synchronization request from the server name completed successfully. Number change(s) has (have) been returned to the caller.

5712	The partial synchronization request from the server name failed.

5715	The partial synchronization replication of the name database from the primary domain controller name completed successfully. Number change(s) is (are) applied to the database.

5716	The partial synchronization replication of the name database from the primary domain controller name failed.

5717	The full synchronization replication of the name database from the primary domain controller name completed successfully.

5718	The full synchronization of the name database from the primary domain controller name failed.

5719	No Windows NT Server for the domain name is available.

5720	The session setup to the Windows NT Server name for the domain name failed because the computer computer name does not have a local security database account.

5721	The session setup to the Windows NT Server name for the domain name failed because the Windows NT Server does not have an account for the computer computer name.

5722	The session setup from the computer computer name failed to authenticate. The name of the account referenced in the security database is user name.

5723	The session setup from the computer computer name failed because there is no trust account in the security database for this computer. The name of the account referenced in the security database is user name.

5724	Could not register control handler with service controller name.

5725	Could not set service status with service controller name.


Down-level Network Message ID Numbers
Network Reference Tables	3 of 3

Down-level Network Message ID Numbers

This table contains the messages that can be returned to a Windows NT Workstation or Windows NT Server system from an earlier operating system (such as Windows for Workgroups or LAN Manager), which is called, for convenience, a down-level system.

In Chapter 4, "Message Reference," the network messages are presented alphabetically and interspersed with the other system messages. In the following table, they have been arranged numerically. Missing or skipped numbers could be related to simple messages, such as "Password expires," that were not included in the printed version, or they may be in the Windows NT Workstation/Windows NT Server Network Message ID Numbers table, which is provided in the preceding section of this chapter.

ID	Message text

2103	The server could not be located.

2107	The device is not connected.

2117	The operation is invalid on a redirected resource.

2122	The Peer service supports only two simultaneous users.

2127	A remote API error occurred.

2131	An error occurred when opening or reading the configuration file.

2139	The requested information is not available.

2143	The event name is invalid.

2149	A line in the configuration file is too long.

2152	The printer destination cannot be found.

2153	The printer destination already exists.

2154	The printer queue already exists.

2155	No more printers can be added.

2156	No more print jobs can be added.

2157	No more printer destinations can be added.

2158	This printer destination is idle and cannot accept control operations.

2159	This printer destination request contains an invalid control function.

2160	The print processor is not responding.

2161	The spooler is not running.

2162	This operation cannot be performed on the print destination in its current state.

2163	This operation cannot be performed on the printer queue in its current state.

2164	This operation cannot be performed on the print job in its current state.

2165	A spooler memory allocation failure occurred.

2166	The device driver does not exist.

2167	The data type is not supported by the print processor.

2168	The print processor is not installed.

2181	The service table is full.

2183	The service does not respond to control actions.

2188	The configuration file contains an invalid service program name.

2190	The service ended abnormally.

2192	The service control dispatcher could not find the service name in the dispatch table.

2193	The service control dispatcher pipe read failed.

2200	This workstation is already logged on to the local-area network.

2201	The workstation is not logged on to the local-area network.

2204	The logon processor did not add the message alias.

2205	The logon processor did not add the message alias.

2206	The logoff processor did not delete the message alias.

2207	The logoff processor did not delete the message alias.

2209	Network logons are paused.

2210	A centralized logon-server conflict occurred.

2212	An error occurred while loading or running the logon script.

2214	The logon server was not specified. Your computer will be logged on as STANDALONE.

2215	The logon server could not be found.

2216	There is already a logon domain for this computer.

2217	The logon server could not validate the logon.

2225	The resource permission list already exists.

2228	There are too many names in the user accounts database.

2230	The limit of 64 entries per resource was exceeded.

2231	Deleting a user with a session is not allowed.

2232	The parent directory could not be located.

2235	This user is not cached in the user accounts database session cache.

2238	This user account is undefined.

2243	The password of this user cannot change.

2244	This password cannot be used now.

2248	No updates are necessary to this replicant network/local security database.

2252	This device is currently being shared.

2271	The Messenger service is already started.

2272	The Messenger service failed to start.

2275	This message alias has been added but is still forwarded.

2279	Messages cannot be forwarded back to the same workstation.

2284	The Messenger service has not been started.

2286	The forwarded message alias could not be found on the network.

2287	The message alias table on the remote station is full.

2288	Messages for this alias are not currently being forwarded.

2295	A write fault occurred.

2300	This operation is not supported on computers with multiple networks.

2314	There is not an open file with that identification number.

2315	A failure occurred when executing a remote administration command.

2316	A failure occurred when opening a remote temporary file.

2318	This device cannot be shared as both a spooled and a non-spooled resource.

2319	The information in the list of servers may be incorrect.

2320	The computer is not active in this domain.

2331	The operation is invalid for this device.

2332	This device cannot be shared.

2333	This device was not open.

2334	This device name list is invalid.

2335	The queue priority is invalid.

2337	There are no shared communication devices.

2338	The queue you specified does not exist.

2340	This list of devices is invalid.

2341	The requested device is invalid.

2342	This device is already in use by the spooler.

2343	This device is already in use as a communication device.

2354	The string and prefix specified are too long.

2356	This path component is invalid.

2370	Profile files cannot exceed 64K.

2371	The start offset is out of range.

2372	The system cannot delete current connections to network resources.

2373	The system was unable to parse the command line in this file.

2374	An error occurred while loading the profile file.

2375	Errors occurred while saving the profile file. The profile was partially saved.

2377	Log file filename is full.

2380	The source path cannot be a directory.

2381	The source path is illegal.

2382	The destination path is illegal.

2383	The source and destination paths are on different servers.

2385	The Run server you requested is paused.

2389	An error occurred when communicating with a Run server.

2391	An error occurred when starting a background process.

2392	The shared resource you are connected to could not be found.

2400	The LAN adapter number is invalid.

2402	Active connections still exist.

2405	The drive letter is in use locally.

2430	The specified client is already registered for the specified event.

2431	The alert table is full.

2433	The alert recipient is invalid.

2434	A user's session with this server has been deleted because the user's logon hours are no longer valid.

2440	The log file does not contain the requested record number.

2450	The user accounts database is not configured correctly.

2451	This operation is not permitted when the Netlogon service is running.

2452	This operation is not allowed on the last administrative account.

2454	Could not set logon information for this user.

2455	The Netlogon service has not been started.

2456	Unable to add to the user accounts database.

2458	A password mismatch has been detected.

2460	The server identification does not specify a valid server.

2461	The session identification does not specify a valid session.

2462	The connection identification does not specify a valid connection.

2463	There is no space for another entry in the table of available servers.

2464	The server has reached the maximum number of sessions it supports.

2465	The server has reached the maximum number of connections it supports.

2466	The server cannot open more files because it has reached its maximum number.

2467	There are no alternate servers registered on this server.

2480	The UPS driver could not be accessed by the UPS service.

3000	Drive name is nearly full. Number bytes are available. Please warn users and delete unneeded files.

3001	Number errors were logged in the last number minutes. Please review the server's error log.

3002	Number network errors occurred in the last number minutes. Please review the server's error log. The server and/or network hardware may need service.

3003	There were number bad password attempts in the last number minutes. Please review the server's audit trail.

3004	There were number access-denied errors in the last number minutes. Please review the server's audit trail.

3006	The error log is full. No errors will be logged until the file is cleared or the limit is raised.

3007	The error log is 80% full.

3008	The audit log is full. No audit entries will be logged until the file is cleared or the limit is raised.

3009	The audit log is 80% full.

3010	An error occurred closing file filename. Please check the file to make sure it is not corrupted.

3011	The administrator has closed filename.

3012	There were number access-denied errors in the last number minutes.

3025	A defective sector on drive drive letter has been replaced (hotfixed). No data was lost. You should run CHKDSK soon to restore full performance and replenish the volume's spare sector pool. The hotfix occurred while processing a remote request.

3026	A disk error occurred on the HPFS volume in drive drive letter. The error occurred while processing a remote request.

3027	The user accounts database (NET.ACC) is corrupted. The local security system is replacing the corrupted NET.ACC with the backup made on date at time. Any updates made to the database after this time are lost.

3028	The user accounts database (NET.ACC) is missing. The local security system is restoring the backup database made on date at time. Any updates made to the database after this time are lost.

3029	Local security could not be started because the user accounts database (NET.ACC) was missing or corrupted, and no usable backup database was present. THE SYSTEM IS NOT SECURE.

3033	User user name has exceeded the account limitation text on server name.

3036	The replicator attempted to log on at computer name as user name and failed.

3046	Cannot log on. User is currently logged on and argument TRYUSER is set to NO.

3048	EXPORT path path cannot be found.

3050	Replicator failed to update signal file in directory name due to code system error.

3052	The required parameter was not provided on the command line or in the configuration file.

3053	LAN Manager does not recognize name as a valid option.

3055	A problem exists with the system configuration.

3058	The configuration file or the command line has an ambiguous option.

3059	The configuration file or the command line has a duplicate parameter.

3063	There is a conflict in the value or use of these options: name.

3075	Bad or missing LAN Manager root directory.

3076	The network software is not installed.

3077	The server is not started.

3078	The server cannot access the user accounts database (NET.ACC).

3079	Incompatible files are installed in the LANMAN tree.

3080	The LANMAN\LOGS directory is invalid.

3081	The domain specified could not be used.

3082	The computer name is being used as a message alias on another computer.

3083	The announcement of the server name failed.

3084	The user accounts database is not configured correctly.

3085	The server is not running with user-level security.

3087	The workstation is not configured properly.

3088	View your error log for details.

3089	Unable to write to this file.

3090	ADDPAK file is corrupted. Delete LANMAN\NETPROG\ADDPAK.SER and reapply all ADDPAKs.

3091	The LM386 server cannot be started because CACHE.EXE is not running.

3092	There is no account for this computer in the security database.

3093	This computer is not a member of the group SERVERS.

3094	The group SERVERS is not present in the local security database.

3098	The service failed to authenticate with the primary domain controller.

3099	There is a problem with the security database creation date or serial number.

3101	The system ran out of a resource controlled by the name option.

3102	The service failed to obtain a long-term lock on the segment for network control blocks (NCBs). The error code is the data.

3103	The service failed to release the long-term lock on the segment for network control blocks (NCBs). The error code is the data.

3104	There was an error stopping service name. The error code from NetServiceControl is the data.

3105	Initialization failed because of a system execution failure on path path. The system error code is the data.

3107	The network is not started.

3108	A DosDevIoctl or DosFsCtl to NETWKSTA.SYS failed. The data shown is in this format: DWORD approx CS:IP of call to ioctl or fsctl; WORD error code; WORD ioctl or fsctl number

3109	Unable to create or open system semaphore name. The error code is the data.

3110	Initialization failed because of an open/create error on the file filename. The system error code is the data.

3111	An unexpected NetBIOS error occurred. The error code is the data.

3114	Some entries in the error log were lost because of a buffer overflow.

3120	Initialization parameters controlling resource usage other than net buffers are sized so that too much memory is needed.

3121	The server cannot increase the size of a memory segment.

3122	Initialization failed because account file filename is either incorrect or not present.

3123	Initialization failed because network name was not started.

3124	The server failed to start. Either all three chdev parameters must be zero or all three must be nonzero.

3125	A remote API request was halted due to the following invalid description string: text.

3126	The network name ran out of network control blocks (NCBs). You may need to increase NCBs for this network. The following information includes the number of NCBs submitted by the server when this error occurred: text.

3127	The server cannot create the name mailslot needed to send the ReleaseMemory alert message. The error received is: code.

3128	The server failed to register for the ReleaseMemory alert, with recipient computer name. The error code from NetAlertStart is the data.

3129	The server cannot update the AT schedule file. The file is corrupted.

3130	The server encountered an error when calling NetIMakeLMFileName. The error code is the data.

3131	Initialization failed because of a system execution failure on path path. There is not enough memory to start the process. The system error code is the data.

3132	Longterm lock of the server buffers failed. Check the swap disk's free space and restart the system to start the server.

3141	The Message server has stopped due to a lock on the Message server shared data segment.

3150	A file system error occurred while opening or writing to the system message log file filename. Message logging has been switched off due to the error. The error code is the data.

3160	The workstation information segment is bigger than 64K. The size follows, in DWORD format: text.

3161	The workstation was unable to get the name-number of the computer.

3162	The workstation could not initialize the Async NetBIOS Thread. The error code is the data.

3163	The workstation could not open the initial shared segment. The error code is the data.

3164	The workstation host table is full.

3165	A bad mailslot server message block (SMB) was received. The SMB is the data.

3166	The workstation encountered an error while trying to start the user accounts database. The error code is the data.

3167	The workstation encountered an error while responding to an SSI revalidation request. The function code and the error codes are the data.

3171	There was an error expanding name as a group name. Try splitting the group into two or more smaller groups.

3174	The server could not read the AT schedule file.

3175	The server found an invalid AT schedule record.

3176	The server could not find an AT schedule file so it created one.

3177	The server could not access the name network with NetBiosOpen.

3178	The AT command processor could not run application.

3180	WARNING: Because of a lazy-write error, drive drive letter now contains some corrupted data. The cache is stopped.

3181	A defective sector on drive drive letter has been replaced (hotfixed). No data was lost. You should run CHKDSK soon to restore full performance and replenish the volume's spare sector pool. The hotfix occurred while processing a remote request.

3182	A disk error occurred on the HPFS volume in drive drive letter. The error occurred while processing a remote request.

3183	The user accounts database (NET.ACC) is corrupted. The local security system is replacing the corrupted NET.ACC with the backup made at date. Any updates made to the database after this time are lost.

3184	The user accounts database (NET.ACC) is missing. The local security system is restoring the backup database made at date. Any updates made to the database after this time are lost.

3185	Local security could not be started because the user accounts database (NET.ACC) was missing or corrupted, and no usable backup database was present. THE SYSTEM IS NOT SECURE.

3186	Local security could not be started because an error occurred during initialization. The error code returned is code. THE SYSTEM IS NOT SECURE.

3190	A NetWksta internal error has occurred: code.

3191	The redirector is out of a resource: name.

3192	A server message block (SMB) error occurred on the connection to name. The SMB header is the data.

3193	A virtual circuit error occurred on the session to name. The network control block (NCB) command and return code is the data.

3194	Hanging up a stuck session to name.

3195	A network control block (NCB) error occurred code. The NCB is the data.

3196	A write operation to filename failed. Data may have been lost.

3197	Reset of driver name failed to complete the network control block (NCB). The NCB is the data.

3198	The amount of resource name requested was more than the maximum. The maximum amount was allocated.

3204	The server could not create a thread. The THREADS parameter in the CONFIG.SYS file should be increased.

3205	The server could not close filename. The file is probably corrupted.

3211	The replicator attempted to log on at computer name as user name and failed.

3213	Replicator limit for files in a directory has been exceeded.

3214	Replicator limit for tree depth has been exceeded.

3217	Cannot log on. User is currently logged on and argument TRYUSER is set to NO.

3219	EXPORT path path cannot be found.

3220	Replicator failed to update the signal file in directory name due to code system error.

3221	Disk Fault Tolerance Error code.

3225	An error occurred while updating the logon or logoff information for user name.

3233	The UPS driver could not be opened. The error code is the data.

3250	Initialization failed because of an invalid or missing parameter in the configuration file filename.

3251	Initialization failed because of an invalid line in the configuration file filename. The invalid line is the data.

3252	Initialization failed because of an error in the configuration file filename.

3253	The file filename has been changed after initialization. The boot-block loading was temporarily terminated.

3254	The files do not fit to the boot-block configuration file filename. Change the BASE and ORG definitions or the order of the files.

3255	Initialization failed because the dynamic-link library name returned an incorrect version number.

3256	There was an unrecoverable error in the dynamic-link library of the service.

3258	The fault-tolerance error log file, LANROOT\LOGS\FT.LOG, is more than 64K.

3259	The fault-tolerance error log file, LANROOT\LOGS \FT.LOG, had the update in progress bit set upon opening, which means that the system crashed while working on the error log.

3304	A network error occurred.

3400	There is not enough memory to start the Workstation service.

3401	An error occurred when reading the NETWORKS entry in the LANMAN.INI file.

3402	This is an invalid argument: name.

3403	The text NETWORKS entry in the LANMAN.INI file has a syntax error and will be ignored.

3404	There are too many NETWORKS entries in the LANMAN.INI file.

3406	An error occurred when opening network device driver name = name.

3407	Device driver name sent a bad BiosLinkage response.

3409	The redirector is already installed.

3411	There was an error installing NETWKSTA.SYS. Press ENTER to continue.

3412	Resolver linkage problem.

3512	The software requires a newer version of the operating system.

3526	The workstation has open files.

3535	An error occurred controlling the device.

3675	The session from computer name has open files.

3677	New connections will not be remembered.

3678	An error occurred while saving your profile. The state of your remembered connections has not changed.

3680	An error occurred while restoring the connection to name.

3694	The shared queue cannot be deleted while a print job is being spooled to the queue.

3714	This operation is privileged on systems with earlier versions of the software.

3717	The log file has been corrupted.

3718	Program filenames must end with .EXE.

3720	A bad value is in the units-per-week field of the user record.

3758	The destination list provided does not match the destination list of the printer queue.

3759	Your password cannot be changed until date.

3803	The LANMAN root directory is unavailable.

3804	The SCHED.LOG file could not be opened.

3807	The AT schedule file is corrupted.

3808	The delete failed due to a problem with the AT schedule file.

3810	The AT schedule file could not be updated because the disk is full.

3812	The AT schedule file is invalid. Please delete the file and create a new one.

5170	The workstation must be started with the Net Start command.

5281	Drive letter has a remembered connection to name. Do you want to overwrite the remembered connection? path

5301	Illegal network control block (NCB) buffer length on SEND DATAGRAM, SEND BROADCAST, ADAPTER STATUS, or SESSION STATUS. The NCB is the data.

5302	The data descriptor array specified in the network control block (NCB) is invalid. The NCB is the data.

5303	The command specified in the network control block (NCB) is illegal. The NCB is the data.

5304	The message correlator specified in the network control block (NCB) is invalid. The NCB is the data.

5306	An incomplete network control block (NCB) message was received. The NCB is the data.

5307	The buffer address specified in the network control block (NCB) is illegal. The NCB is the data.

5308	The session number specified in the network control block (NCB) is not active. The NCB is the data.

5310	The session specified in the network control block (NCB) was closed. The NCB is the data.

5311	The network control block (NCB) command was canceled. The NCB is the data.

5312	The message segment specified in the network control block (NCB) is illogical. The NCB is the data.

5313	The name already exists in the local adapter name table. The network control block (NCB) request was refused. The NCB is the data.

5314	The network adapter name table is full. The network control block (NCB) request was refused. The NCB is the data.

5315	The network name has active sessions and is now de-registered. The network control block (NCB) command completed. The NCB is the data.

5316	A previously issued Receive Lookahead command is active for this session. The network control block (NCB) command was rejected. The NCB is the data.

5318	A network control block (NCB) session open was rejected. No LISTEN is outstanding on the remote computer. The NCB is the data.

5319	The name number specified in the network control block (NCB) is illegal. The NCB is the data.

5320	The call name specified in the network control block (NCB) cannot be found or did not answer. The NCB is the data.

5321	The name specified in the network control block (NCB) was not found. Cannot put '*' or 00h in the NCB name. The NCB is the data.

5322	The name specified in the network control block (NCB) is in use on a remote adapter. The NCB is the data.

5323	The name specified in the network control block (NCB) has been deleted. The NCB is the data.

5324	The session specified in the network control block (NCB) ended abnormally. The NCB is the data.

5325	The network protocol has detected two or more identical names on the network. The network control block (NCB) is the data.

5326	An unexpected protocol packet was received. There may be an incompatible remote device. The network control block (NCB) is the data.

5333	The NetBIOS interface is busy. The network control block (NCB) request was refused. The NCB is the data.

5335	The adapter number specified in the network control block (NCB) is illegal. The NCB is the data.

5336	The network control block (NCB) command completed while a cancel was occurring. The NCB is the data.

5337	The name specified in the network control block (NCB) is reserved. The NCB is the data.

5338	The network control block (NCB) command is not valid to cancel. The NCB is the data.

5351	There are multiple network control block (NCB) requests for the same session. The NCB request was refused. The NCB is the data.

5352	There has been a network adapter error. The only NetBIOS command that may be issued is an NCB RESET. The network control block (NCB) is the data.

5354	The maximum number of applications was exceeded. The network control block (NCB) request was refused. The NCB is the data.

5356	The requested resources are not available. The network control block (NCB) request was refused. The NCB is the data.

5364	A system error has occurred. The network control block (NCB) request was refused. The NCB is the data.

5365	A ROM checksum failure has occurred. The network control block (NCB) request was refused. The NCB is the data.

5366	A RAM test failure has occurred. The network control block (NCB) request was refused. The NCB is the data.

5367	A digital loopback failure has occurred. The network control block (NCB) request was refused. The NCB is the data.

5368	An analog loopback failure has occurred. The network control block (NCB) request was refused. The NCB is the data.

5369	An interface failure has occurred. The network control block (NCB) request was refused. The NCB is the data.

5370	An unrecognized network control block (NCB) return code was received. The NCB is the data.

5380	A network adapter malfunction has occurred. The network control block (NCB) request was refused. The NCB is the data.

5381	The network control block (NCB) command is still pending. The NCB is the data.

5500	The update log on name is over 80% capacity. The primary domain controller name is not retrieving the updates.

5501	The update log on name is full, and no further updates can be added until the primary domain controller name retrieves the updates.

5502	The time difference with the primary domain controller name exceeds the maximum allowed skew of number seconds.

5503	The account of user user name has been locked out on name due to number bad password attempts.

5504	The filename log file cannot be opened.

5505	The filename log file is corrupted and will be cleared.

5506	The Application log file could not be opened. Filename will be used as the default log file.

5507	The filename log file is full.

5600	Could not share the User or Script path.

5713	The full synchronization request from the server name completed successfully. Number object(s) has (have) been returned to the caller.

5714	The full synchronization request from the server name failed.