Identifying a Service or Driver That Doesn't Start

Some services are configured to start automatically on Windows NT. The specific services depend on your computer configuration, and which network services and protocols you are using.

You can use the Services option on Control Panel to view which services should have started automatically and see which ones did start. For example, the next screen shot was taken when the Workstation service was disabled.

You can see that TCP/IP NetBIOS Helper is configured to start automatically, but it did not start. The section "Troubleshooting Example," presented earlier in this chapter, describes why it did not start.

Sometimes, if a file that is needed to load or run Windows NT becomes corrupt or is deleted, the system displays a message about a problem with the file. You might also get information logged in the event log. You can use the message or the information in the event log to find the problem.

Not all executables or dynamic link libraries report missing or corrupt files, and the symptoms can be unpredictable with a file missing. What do you do if there is no indication of an error, but you think some component did not start correctly?

You can check to see if all the Windows NT system files exist and appear to be uncorrupted. Symptoms of file corruption include a file being an unusual size (for example, zero bytes or larger than its original size), or having a date or time that does not match the Windows NT installation date or dates on service packs that you have installed. You can compare files in your %systemroot%\System32 folder and subfolders with files in these folders on another computer that has the same Windows NT version and service packs installed.

If you think that you might be having a problem with a Windows NT system file, you can run Windows NT Setup and repair the problem by using the Verify Windows NT system files option.

If you can log on to your computer, you can use the Drivers utility on the Windows NT Server Resource Kit CD to display information about all the drivers that were loaded. If you have previously printed the output from the Drivers utility (by redirecting the output to a printer or a file), you can compare the previous output with one that you produce when you think you might be having problems with drivers not loading. Another method of determining if there are drivers missing from the list is to run the Drivers utility on a similar computer and compare the results.

The following table is a description of the output from the Drivers utility. The most important field is ModuleName, which is the name of the component.

Column

Definition

ModuleName

The driver's file name.

Code

The non-paged code in the image.

Data

The initialized static data in the image.

Bss

The uninitialized static data in the image. This is data that is initialized to 0.

Paged

The size of the data that is paged.

Init

Data not needed after initialization.

LinkDate

The date that the driver was linked.


To get a hardcopy of the output from the Drivers utility enter drivers >filename at the command prompt, and then print the file. The next example shows some of the output from a Drivers report.


ModuleName Code Data Bss Paged Init LinkDate ------------------------------------------------------------------------ ntoskrnl.exe 265472 39040 0 432128 76800 Mon Apr 15 16:28:07 1996 hal.dll 19904 2272 0 8992 10784 Wed Apr 10 10:24:22 1996 Atdisk.sys 12352 64 0 0 10368 Wed Apr 10 10:30:24 1996 Disk.sys 2304 0 0 7648 1504 Wed Apr 10 10:31:18 1996 CLASS2.SYS 6112 0 0 1472 1024 Thu Apr 11 09:21:58 1996 Ftdisk.sys 22880 32 0 1504 2048 Fri Apr 12 12:00:30 1996 Diskperf.sys 2048 0 0 0 768 Wed Apr 10 10:30:17 1996