LogBlog

Warning: This is a highly technical article.  If you are not an IT Expert, don’t try this at home :).

Thanks to Dennis J Krohn (DDK Communications) for working with Microsoft on this and emailling me and Susan Bradley who pointed me to http://sbsc.techcareteam.com/archives/325 and has been working with Microsoft to track this issue and find the culprit (application or service that makes this happen); we now have a quick fix for the KSOD we have been seeing in Windows Vista.

KSOD Defined: Where after a reboot the Windows Vista PC boots up to a black screen with a white mouse cursor and nothing else ever loads (no logon screen, etc).  Safe mode does the same thing.  Last Known Good configuration and System Restore do not fix it except in rare cases where performing a System Restore to 1 month ago or earlier does (thanks Mike Katz for figuring that out).

So about an hour after Dennis and Susan emailed me the resolution last night, my main workstation KSOD’d.  It has already done this once before and Microsoft did not have a resolution — so my resolution last time was to reinstall Windows to a new directory and manually reinstall and reconfigure all my applications and settings.  THIS time, very fortunately, I got to try these steps out and they worked like a charm.  My workstation was back up and running in less than 5 minutes.

Here is how to recover from the KSOD (blacK Screen Of Death):

There apparently this a problem related to the Remote Procedure Call service (RPC) running under LocalSystem account instead of NT Authority\NetworkService account.

1. On the affected machine, boot using the Vista Media and Select “Next” and then in the bottom left you will see “Repair your Computer”; select Next and then Select Command Prompt.

2. At the command prompt, launch regedit.exe and load the SYSTEM hive, follow the below steps.

a. Select HKEY_LOCAL_MACHINE

b. On the File menu, select Load Hive.

c. Browse to %WINDIR%\System32\Config Folder and select “SYSTEM”

d. Select Open.

e. In the Load Hive dialog box, type in “MySYSTEM” box for the registry hive that you want to edit.

3. After the hive is loaded, modify the following key value per the instructions below: You will need to know what ControlSet the machine is currently running on, this can be determined by going to HKEY_LOCAL_MACHINE\MySYSTEM\Select and find the “Current” value in the Right hand side. (Example: Current value is 1 then the ControlSet will be ControlSet001)

Key: HKEY_LOCAL_MACHINE\MySYSTEM\ControlSet00X\Services\RpcSs (X is the Number from the Current Key from above)

Value Name: ObjectName

Old Value: LocalSystem

New Value: NT AUTHORITY\NetworkService

4. Unload the SYSTEM hive by selecting the key “MySYSTEM” and then select File -> Unload Hive… menu item.

5. Exit regedit.exe

6. Reboot the system normally

-Ira

We are deploying Windows Server 2008 RemoteApp in an effort to improve user experience for people who have been using a Terminal Server. RemoteApp gives you direct access to applications on a Terminal Server without having to remote into the desktop first.

To setup RemoteApp in Windows Server 2008 do the following.

Add the role “terminal server” on the 2008 server manager – press the add button and check mark ts - reboot.

Next install your app. First run “change user /install”, then run setup for the app, then run “change user /execute”.

Now bring up TS RemoteApp Manager from administrative tools.

Press the Add RemoteApp Program button and run the wizard. Put a check mark next to the app.

Right click the RemoteApp and choose create .rdp file.

Now from the client workstation, save the .rdp file on your desktop. This example uses a Vista workstation.

Double click the .rdp file and put in your network credentials.

Voila! You’re running an app on the Terminal Server but it appears just like you’re running it on the workstation.

Traditionally, to speed up Microsoft Windows Operating Systems we add more RAM (assuming the processor is fast enough). Though with laptops, we are seeing a different challenge where RAM is not necessarily the bottleneck slowing it down. The challenge we are running into lately with Laptops is that hard drives in Laptops often spin a lot slower than those in desktop PC’s. If possible, the best thing you can do is upgrade to a 7200RPM or Solid State hard drive.  Upgrading to a faster hard drive is not always an option, so fortunately there are 3 things we can do with Windows Vista to reduce how much it is relying on the hard disk, and speed it up significantly:

1. Use “ReadyBoost” to significantly increase the responsiveness of the system by reading commonly-used system files from flash memory (which is much faster than a hard disk). You can pick up a 2 pack of high-speed 2GB SD cards (typically used to store pictures in digital cameras) for about $30 at Costco. SD cards are easy to leave in the SD card reader slot on your laptop at all times. When prompted by Windows, choose “Speed up my system”:
   

   AutoPlay Options

   

   ReadyBoost options

2. Disable “Windows Search“. Although it’s a great and useful feature, it can slow down your laptop — so leave it enabled on your Desktop PC and remote in when you want to use it. To disable Windows Search, right-click “Computer” in the Start Menu and choose “Manage”. Navigate to “Services” on the left pane. Double-click on “Windows Search” in the list of services.
   

   Windows Search Service Options

   Change the Startup Type to “Disabled.”

3. Turn off the Sidebar. The Windows Vista Sidebar is a really cool feature that lets you put weather, an analog clock, and other fun gadgets on your desktop. It does take up resources, though, just like any other running program so if you want to squeeze some extra performance out of Vista you should disable the sidebar.
   

   Windows Vista SideBar (on the Right)

   To disable the Sidebar:
   Right click on a blank area of the sidebar and choose Properties.
   Uncheck the ‘Start sidebar when windows starts’ option. Hit OK.
   Right click on a blank area of the taskbar and choose ‘close sidebar.’

-Ira