Recent Operating System Class notes 08 Administrative Tools (Part one) April 14, 2004

Transcription

1 Recent Operating System Class notes 08 Administrative Tools (Part one) April 14, 2004 The administrative tools are a collection of system control and configuration utilities. The administrative tools include Computer Management, Event Viewer, Local Security Policy, Performance, etc. Computer Management The Computer Management is a highly used tool for configuring and managing a computer. The simplest method to launching the Computer Management is to right click My Computer and select Manage from the pop-up menu. The Computer Management tool is illustrated in figure one. Figure 1: Computer Management Utility The Computer Management utility provides access to the following: Managing local users and groups Managing shared devices and drives Checking system event logs Displaying remote users that are currently logged into the system Controlling and viewing system services Managing server applications and services 1

2 As shown in figure one, the Computer Management tools appear similar to Windows Explorer. Note that there are three main nodes in the left hand pane as follows: System Tools Storage Services and Applications System Tools The System Tools node contains five sub-nodes: 1. Event Viewer: Used to view events contained in applications, security, and system logs 2. Shared Folders: Used to manage shared folders and remote user accessing shared folders. 3. Local User and Groups: Used to manage local user accounts and groups. 4. Performance Logs and Alerts: Used to define logs and alerts related to system performance. 5. Device Manager: Used to troubleshoot device problems, configure devices and driver settings. Event Viewer The Event Viewer is used to view log files which record application problems, system problems, and security events. For example, an event log will be created if a user attempts to access protected files or remove a printer in which that user has no control. Many events are recorded in the log by default. Others are optional and can be set. The application log contains events logged by applications. For example, Microsoft Access might record a file error in the application log. The Security log contains events logged by the system, such as valid and invalid logon attempts, and events related to resource use such as creating, opening and deleting files. An administrator can set which events are recorded in the security log. The System log contains numerous entries related to the system events, such as boot-up, shut down, loading drivers, and errors with hardware conflicts. The administrator cannot set the events that are recorded. Shared Folders The three folders under System Tools/Shared Folders node are the following: 1. Shares: Allows you to manage the properties of each shared resource. For example, you can change share permissions for a resource (e.g. assign read only access). 2. Sessions: Allows you to view which users are connected to a share and optionally disconnect them. 3. Open Files: Allows you to see which files and resources are open on a share and optionally close files that are open. 2

3 Local Users and Groups Windows XP supports multiple users on one machine. You can manage these users via the user & group accounts here. You can set-up user accounts for individuals to have access to the computer. Each user has its own name and optional password. You can let users configure their own personalized desktop schemes, icons, preferences, and give users their own personal My Documents folder. You can control file permissions for each user or group. See class notes 4 for more details on local users and groups. To set-up a new local account, follow these steps: 1. Navigate to the Local User and Groups and right click the Users folder. 2. Enter the desired logon name and other information requested in the form. 3. Click the create option to finish. Performance Logs and Alerts Performance Logs and Alerts supports detailed monitoring of the utilization of operating system resources. Setting up a monitoring configuration is the first step in evaluating your system's performance. To monitor your Windows XP installation, you can choose to view data in a graph or collect the data in log files for use in other applications. However, to get started quickly, you can use the predefined log settings under Counter Logs. These settings, named System Overview, are configured to create a binary log that, after manual startup, updates every 15 seconds and logs continuously until it achieves a maximum size. Device Manager You are presented with a category list of the devices installed in the computer. The Device Manager can be used as an aid to solving hardware problems. When any device fails to function as expected it will be high lighted with a yellow triangle or a red stop sign. The yellow triangle indicates a warning or a possible problem. A red stop sign indicates a device conflict or other serious error. When a device s properties dialog box is opened, the general tab displays basic information about the device. Also, depending on the device, there are additional tabs and in most case there is a driver tab. The driver tab allows you to view current installed driver for the device and also allows you to update, roll back, or uninstall the driver. In addition to the general tab, there can be a resource tab. The resources tab specifies the system resources allocated for the device. These resources include: IRQ, I/O ranges, DMA, etc. For PnP devices, you can switch the settings from automatic to either a predefined configuration set or a full customized setting. Some PnP cards, the settings on the resources page are read-only. Storage The storage node contains three sub-nodes: 1. Removable storage: Used to check the physical location of removable storage devices (i.e. CD-ROM, ZIP, Tapes, optical disks, etc.), check existence of medial pools, and check properties of offline media. 2. Disk Defragmenter: Used to defrag the disk drives. 3. Disk Management: Used to create/delete/manage partitions and volumes, format, assign drive letters, etc. 3

4 Services and Applications You can view and manage the properties of any server service or application that is installed on the computer (e.g. file indexing service and Internet Information Server). System Files Protection There exists a possibility where the operating system may become suspiciously unstable after the installation of a new application or a driver or after a system crash. Typically, most technicians have been forced to instruct PC users to reinstall the Windows OS as the only solution. Windows XP has set-up options that prevent the often unintentional destabilize of the operating system due to applications or driver installations, or the introduction of viruses that intentionally alter or overwrite system files. The operating system includes system functions that help prevent damage from the installation of untested drivers or from modification of system executables such as dynamic link libraries (DLLs). These system functions are: Windows file protection service This service is a function of the operating system that continually monitors protected system files. System file signature verification tools A command line executable to check the signatures of essential system components. System file checker tool A command line executable to verify the system file versions. Windows File Protection Service Windows XP s file protection service is enabled by default. The file protection system runs in the background and protects all files installed by the Windows XP setup program, such as:.sys,.dll,.ocx,.ttf,.fon, and.exe files. If one of the protected files are replaced or altered, then a dialog box alerts you that a program is attempting to change a system file. Therefore, system files are restored automatically if they were overwritten by an application when you installed or ran that application. Windows XP introduced Fusion, which allows programs to install whatever system files (DLLs and others) they need, and redirect any files which would replace system files to the program s own folder. When such a program runs, Windows XP creates a memory protected virtual machine to run the program with its own DLLs. The result is that even if two or more programs are running at the same time, using different versions of DLL or other system files that would break the system in past versions of Windows, both programs will now run properly. No other programs can touch the area of memory allocated to each program. This prevents the kinds of crashing will documented to Windows 9x/ME users. 4

5 File Signature Verification Tool Perform the following steps to verify the digital signature of system files: 1. Click on Start and Run, and then enter sigverif to launch the tool 2. The program searches for any system files not signed. If you want to search for non-system files or append to an existing log of found items, click the advanced button and set up the log file s name, append option, and other related options. 3. You may also choose to save the results to a file. 4. Click start and the tool checks to see which system files are digitally signed and displays its findings. If the files are not digitally signed, then you will see a list of files that are not digitally signed. System File Checker This tool looks for protected system files and verifies their version number to ensure that it is synchronized with the operating system version number. The system file checker is a command line program and runs the next time you boot. You must be logged in as administrator to run this program. If the system file checker discovers that at protected file has been overwritten, it retrieves the correct version of the file form the <systemroot>\system32\dllcache folder and then replaces the incorrect file. The syntax for program execution is: sfc [/scanonce] [/scanboot] [/cancel] [/quiet] Table One: system file checker option descriptions Option Description scanonce Scans all protected system files once. scanboot Scans all protected system files every time the computer is restarted. cancel Cancels all pending scans of protected system files. quiet Replaces all incorrect file versions without prompting the user. The system file checker can be used to protect against microscopic bit loss on the hard disk or crafty hacking, you can use the /scanboot option to check each time you boot. For example, what if someone is trying to trash the \system32\dllcache folder? Run sfc /scanonce or sfc /scanboot command to repair the content of DLL cache if its readable. 5