Identifying a Service or Driver That Doesn't Start

Some services are configured to start automatically on Windows NT. The specific services depend on your computer configuration, and which network services and protocols you are using.

You can use the Services option on Control Panel to view which services should have started automatically and see which ones did start. For example, the next screen shot was taken when the Workstation service was disabled.

You can see that TCP/IP NetBIOS Helper is configured to start automatically, but it did not start. The section "Troubleshooting Example," presented earlier in this chapter, describes why it did not start.

Sometimes, if a file that is needed to load or run Windows NT becomes corrupt or is deleted, the system displays a message about a problem with the file. You might also get information logged in the event log. You can use the message or the information in the event log to find the problem.

But not all executables or dynamic link libraries report missing or corrupt files, and the symptoms can be unpredictable with a file missing. What do you do if there is no indication of an error, but you think some component did not start correctly?

You can check to see if all the Windows NT system files exist and appear to be uncorrupted. Symptoms of file corruption include a file being an unusual size (for example, zero bytes or larger than its original size), or having a date or time that does not match the Windows NT installation date or dates on service packs that you have installed. You can compare files in your %systemroot%\System32 folder and subfolders with files in these folders on another computer that has the same Windows NT version and service packs installed.

If you think that you might be having a problem with a Windows NT system file, you can run Windows NT Setup and repair the problem by using the Verify Windows NT system files option.

If you can log onto your computer, you can use the Drivers utility on the Windows NT Workstation Resource Kit CD to display information about the device drivers that were loaded. If you have previously printed the output from the Drivers utility (by redirecting the output to a printer or a file), you can compare the previous output with one that you produce when you think you might be having problems with drivers not loading. Another method of determining if there are drivers missing from the list is to run the Drivers utility on a similar computer and compare the results.

This is a description of the output from the Drivers utility. The most important field is ModuleName, which is the name of the component.

Column

Definition

ModuleName

The driver's file name.

Code

The non-paged code in the image.

Data

The initialized static data in the image.

Bss

The uninitialized static data in the image. This is data that is initialized to 0.

Paged

The size of the data that is paged.

Init

Data not needed after initialization.

LinkDate

The date that the driver was linked.


To get a hardcopy of the output from the Drivers utility enter drivers >filename at the command prompt, and then print the file. The next example shows some of the output from a Drivers report.


ModuleName    Code     Data  Bss   Paged   Init          LinkDate
------------------------------------------------------------------------
ntoskrnl.exe  265472  39040    0  432128  76800 Mon Apr 15 16:28:07 1996
     hal.dll   19904   2272    0    8992  10784 Wed Apr 10 10:24:22 1996
  Atdisk.sys   12352     64    0       0  10368 Wed Apr 10 10:30:24 1996
    Disk.sys    2304      0    0    7648   1504 Wed Apr 10 10:31:18 1996
  CLASS2.SYS    6112      0    0    1472   1024 Thu Apr 11 09:21:58 1996
  Ftdisk.sys   22880     32    0    1504   2048 Fri Apr 12 12:00:30 1996
Diskperf.sys    2048      0    0       0    768 Wed Apr 10 10:30:17 1996