There were many scenarios in past versions of Windows where workstations configured to enter standby after a certain period of idle time would refuse to do so, often without many clues as to why. This behavior is commonly (and cleverly) referred to as PC insomnia. While Windows 7 computers can still suffer from insomnia, the latest Windows OS now includes new tools and settings to troubleshoot and resolve it.  There are a variety of things that may prevent a computer from properly entering standby when idle. Common reasons include hardware driver issues, service issues, and open file shares. Windows XP did not include any tools that could help pinpoint what was keeping the system awake, which often made finding the culprit a guessing game. Thankfully, the command line utility POWERCFG.EXE was updated in Windows 7 to include two new options that assist with tracking down insomnia issues.

If you haven’t already, you should check out my previous article about power management in Windows 7 in order to learn about power profiles and POWERCFG.EXE commands.

POWERCFG -REQUESTS

One way to troubleshoot Windows 7 insomnia issues, is the POWERCFG.EXE -REQUESTS command. This command can be used to display a list of applications and drivers that have made requests to prevent the computer from entering standby.

In the example above, there are actually two Windows components that are preventing the system from entering standby. The first issue is that Windows wants to keep this particular computer awake because a remote host is connected to a share on the computer . If this computer was acting as a network file server, that would probably be a good thing. But it’s not, so we either need to prevent the computer from sharing files at all, or allow it to enter standby regardless of whether a remote host is connected to a file share. The other issue is that Windows wants to keep this computer awake because it’s connected to a remote file share. While there are probably cases where this behavior is desired, I want Windows to enter standby regardless of whether or not the computer is connected to a remote network share. Otherwise, most workstations would never enter standby! Both of these issues can normally resolved by changing a few hidden power options, which is covered later in this article.

POWERCFG -ENERGY

In a some cases, it may also be useful run POWERCFG.EXE -ENERGY. This command performs a more thorough investigation  in order find potential power management issues, such as those that may be preventing standby. When POWERCFG -ENERGY is run, it detects common issues by monitoring the system for a period of time and capturing system settings and events that may be preventing Windows power management from working properly. When done, the results are written to a HTML file.

By default, POWERCFG.EXE -ENERGY analyzes the system for 60 seconds. However,  the analysis duration can be be set to a larger period of time to detect more sporadic events that are preventing standby. To perform an analysis for 10 minutes, run POWERCFG -ENERGY -DURATION 600. When finished, the results are written to energy-report.html,  or the filename specified with -OUTPUT <FILENAME>.

While this report is more thorough that POWERCFG -REQUESTS, it may include items that aren’t necessarily related to issues with standby. For example, the report above shows the error USB Suspend:USB Device not Entering Suspend for several USB devices on this computer. While this may affect the computer’s power efficiency at some level,  it’s not the reason that this computer was entering standby. In this case, the standby was being blocked by the  System Required Request initiated by the driver \FileSystem\srvnet. This is related to the Windows network shares, and indicated to me that that standby was  being blocked because a remote host was trying to connect to a share on the client computer. I wasn’t able to see this when running POWERCFG -REQUESTS alone.

Manually Checking Services

If neither of the tools mentioned above help pinpointthe cause of insomnia, you may want to try manually verifying that Windows Services aren’t preventing standby. This troubleshooting method is simple, but a bit tedious:

1. First, go to Start > Control Panel > Power Options and configure the current power profile so that the system enters standby after 1 minute.
2. Go to Start > Control Panel > Administrative Tools > Services. Sort the services by the status column.
3. One by one, stop services that are running. Each time you stop a service, let the computer idle for at least 2 minutes to see if it enters standby. Continue doing this until the computer enters standby. It’s probably best to begin with non-Windows services.
4. If/when the computer finally enters standby after you’ve stopped a service, make note of that service. Restart the computer so that all services are running again. Stop that particular service again and wait for the computer to idle into standby.
5. If the computer idles to standby, you have found the service that is preventing system standby.

What services could be causing insomnia? Some anti-virus applications have been known to prevent the system from entering standby for various reasons. Older or poorly-written services may also be the cause of PC insomnia.

Treating Insomnia

Windows 7 includes several power settings that may be useful for resolving PC insomnia. Interestingly, some of them are hidden and must be enabled in the system registry. Below are some common settings and methods for treating insomnia.

Allow Standby with Remote Opens

By default, Windows 7 will attempt to prevent system standby when connected to a  a remote share or file. Presumably, this is to prevent any ongoing file transfers over the network from failing due to the system unexpectedly entering standby. But there are many cases where the system is connected to a remote share and it is okay to enter standby. Windows 7 includes a setting to allow the computer to enter standby, but it may be missing from the advanced power options dialog box. This .reg file will unhide the “Allow sleep with remote opens” option AND set it to Yes for three default power profiles (Balanced, High Performance, and Power Saver) in Windows 7:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\238C9FA8-0AAD-41ED-83F4-97BE242C8F20\d4c1d4c8-d5cc-43d3-b83e-fc51215cb04d]
"Attributes"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\238C9FA8-0AAD-41ED-83F4-97BE242C8F20\d4c1d4c8-d5cc-43d3-b83e-fc51215cb04d\DefaultPowerSchemeValues\381b4222-f694-41f0-9685-ff5bb260df2e]
"ACSettingIndex"=dword:00000001
"DCSettingIndex"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\238C9FA8-0AAD-41ED-83F4-97BE242C8F20\d4c1d4c8-d5cc-43d3-b83e-fc51215cb04d\DefaultPowerSchemeValues\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c]
"ACSettingIndex"=dword:00000001
"DCSettingIndex"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\238C9FA8-0AAD-41ED-83F4-97BE242C8F20\d4c1d4c8-d5cc-43d3-b83e-fc51215cb04d\DefaultPowerSchemeValues\a1841308-3541-4fab-bc81-f71556f20b4a]
"ACSettingIndex"=dword:00000001
"DCSettingIndex"=dword:00000001

Although the registry entries above will configure the three default power profiles, it won’t apply the settings to custom power profiles. To do that, you’ll need to find the Power Scheme GUID of the power profile you created by using POWERCFG.EXE /LIST and then run these commands:

POWERCFG.EXE /SETACVALUEINDEX <POWER SCHEME GUID> 238c9fa8-0aad-41ed-83f4-97be242c8f20 d4c1d4c8-d5cc-43d3-b83e-fc51215cb04d 1
POWERCFG.EXE /SETDCVALUEINDEX <POWER SCHEME GUID> 238c9fa8-0aad-41ed-83f4-97be242c8f20 d4c1d4c8-d5cc-43d3-b83e-fc51215cb04d 1

Allow Standby when Sharing Media

If the system is configured with file or media sharing enabled, Windows 7 may prevent the system from entering standby while users are connected to files or shares hosted on the system in order to prevent file transfers from being interrupted. Sometimes, media, file, and printer sharing may be enabled on the workstation without the user or the sysadmin knowing it. To make matters worse, there are some network applications installed that tend to scan network shares at regular intervals, which may prevent standby.

This behavior can be disabled by setting  “When sharing media” to “Allow Computer to Sleep” within the advanced settings of a power profile. The setting shouldn’t be hidden by default. To apply this setting to a custom Windows 7 power profile, these commands can be used:

POWERCFG.EXE /SETACVALUEINDEX <POWER SCHEME GUID> 9596fb26-9850-41fd-ac3e-f7c3c00afd4b 03680956-93bc-4294-bba6-4e0f09bb717f 0
POWERCFG.EXE /SETDCVALUEINDEX <POWER SCHEME GUID> 9596fb26-9850-41fd-ac3e-f7c3c00afd4b 03680956-93bc-4294-bba6-4e0f09bb717f 0

Add Power Request Override

While applications can request that Windows to keep the system awake, that doesn’t mean that the OS should always listen. Applications make power requests like this for several reasons. For example, Windows Update may make a request keep to computer awake while updates are being installed or a reboot is pending. It’s actually very easy to implement a power request that blocks standby, which means it could be abused by a service or process that thinks it knows what’s good for it. If the results from POWERCFG -REQUESTS or POWERCONFIG -ENERGY show that a particular service or process is making a lot of unnecessary power requests, there is a way in Windows 7 to ignore those requests. To learn more about overriding a power requests, browse to the “Overriding a Power Request” section of this Microsoft paper.

Don’t Allow System Required Policy

If you’ve tried everything but still can’t get that  insomniac system to enter standby when idle, there is one last setting that you can use in a last ditch attempt.

However,the “Allow System Required Policy” power setting may also cause Windows to ignore valid requests to keep the computer awake. Therefore, this setting should only be used if nothing else works and you’ve tried using a Power Request Override to ignore specific drivers, processes, and services. This registry entry will unhide the setting:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\238C9FA8-0AAD-41ED-83F4-97BE242C8F20\A4B195F5-8225-47D8-8012-9D41369786E2]
"Attributes"=dword:00000000

To disable power request overrides for a power profile, these commands can be used:

POWERCFG.EXE /SETACVALUEINDEX <POWER SCHEME GUID> 238C9FA8-0AAD-41ED-83F4-97BE242C8F20 A4B195F5-8225-47D8-8012-9D41369786E2 0
POWERCFG.EXE /SETDCVALUEINDEX <POWER SCHEME GUID> 238C9FA8-0AAD-41ED-83F4-97BE242C8F20 A4B195F5-8225-47D8-8012-9D41369786E2 0

What about Narcolepsy?

Another common issue with Windows systems that enter standby is PC Narcolepsy.  PC Narcolepsy refers to a behavior of the Windows Operating System, where a computer that resumes standby from a Wake-on-LAN (WOL) or scheduled wakeup event will enter standby again after 2 minutes unless there is user interaction, such as pressing a key on the mouse or keyboard. In Windows XP, there wasn’t any way to change this behavior. Fortunately, Windows 7 introduces a new power option that can change the amount of time that the computer resumes from standby:  System unattended sleep timeout. However this setting is hidden in the power profile by default. Why is it hidden? I’m not quite sure. Perhaps because it could be confused with the standby timeout setting. It can be unhidden using this reg file:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\238C9FA8-0AAD-41ED-83F4-97BE242C8F20\7bc4a2f9-d8fc-4469-b07b-33eb785aaca0]
"Attributes"=dword:00000000

Once unhidden, this setting will be visible in the advanced power options dialog. However, most sysadmins need a way to automate the configuration of this setting. Like several of the settings above, this can be done if you know the GUID of the power profile that you want to set this setting on:

POWERCFG.EXE /SETACVALUEINDEX <POWER SCHEME GUID> 238c9fa8-0aad-41ed-83f4-97be242c8f20 7bc4a2f9-d8fc-4469-b07b-33eb785aaca0 <DURATION IN SECONDS>
POWERCFG.EXE /SETDCVALUEINDEX <POWER SCHEME GUID> 238c9fa8-0aad-41ed-83f4-97be242c8f20 7bc4a2f9-d8fc-4469-b07b-33eb785aaca0 <DURATION IN SECONDS>

Standby Me

Before we dive into the guts of power management in Windows 7, let’s discuss the value of taking the time to configure power management settings.  Since going green is a hot trend right now, many companies are starting to put pressure on sysadmins to find ways to squeeze power savings from a major offender to the energy grid: Computers. At many companies, workstations are left running 24×7, even when not in use. If the work week is only 40 hours, that means that many of these computers are in a Powered On with Nothing to Do (POND) state for 100+ hours per week.  As Ford recently discovered, turning computers off when they are not in use is a great way to reduce energy waste and save some serious coin!

One disadvantage to turning off computers completely when not in use is that, when a user needs to use the computer again, they have to wait for the computer to start up, then log in, then load applications and documents again. Admittedly, this a bit time consuming and frustrating for an end user.  Therefore, many sysadmins opt to put computers into a low power standby mode as a fair compromise between user experience and energy savings. Standby mode, which powers down most system components as suspends the system state to RAM, allows the user instantly resume where they left off when they last used the computer. In modern computers, standby only consumes slightly more power than when in a powered off state.

Applying Settings with POWERCFG

If you’ve used the POWERCFG utility in Windows XP, you’ll probably find one major difference in Windows 7: GUIDs. In Windows XP, a power scheme could be configured by specifying the name of the scheme in the POWERCFG command line syntax. In Windows 7, that is no longer an option. Instead, you must specify the GUID associated with a particular power scheme when configuring and activating a scheme. While POWERCFG in Windows 7 still includes a way to change the monitor, disk, and standby timeouts of the active scheme, it takes some understanding of the Windows 7 power management GUIDs to do anything beyond that. Not only are the power schemes themselves identified by GUIDs, Windows 7 uses GUIDs to uniquely identify settings and groups of settings as well. While the idea of working with GUIDs may seem like a daunting task, it’s actually pretty easy to wrap your head around once you know how to find and use these GUIDs.

The most straightforward way to get a list of power scheme, group, and setting GUIDs is to run POWERCFG -QUERY. As a side note, this command tends to generate a lot of output, so it may be wise to pipe the output to a file like this:

POWERCFG.EXE -QUERY > powercfg.txt

After running the command, the current directory should contain the powercfg.txt file with the output from POWERCFG – QUERY inside of it. Here’s what it looks like:

As you can see from the example above, POWERCFG -QUERY provides very detailed information about every power scheme and setting set in power options in a nicely indented format. At the top is the GUID associated with the power scheme (High Performance). Directly below that is the GUID that identifies the first subgroup of settings (settings belonging to no subgroup). The GUIDs that identify each setting are directly below that, with information about possible setting values.

Example

Let’s say we wanted to change the setting Require a Password on Wakeup to No within the High Performance power scheme. First, we need to use the output from POWERCFG -QUERY to find the associated GUIDs and setting index:

These values are then plugged into commands POWERCFG -SETACVALUEINDEX and POWERCFG -SETDCVALUEINDEX:

POWERCFG -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c fea3413e-7e05-4911-9a71-700331f1c294 0e796bdb-100d-47d6-a2d5-f7d2daa51f51 0
POWERCFG -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c fea3413e-7e05-4911-9a71-700331f1c294 0e796bdb-100d-47d6-a2d5-f7d2daa51f51 0

As you may have guessed, the first command affects the computer while it’s plugged in. The second affects the computer while on battery. There’s a few things that have been implied in this example, but are worth covering in case you plan to script power settings for a fleet of computers:

• Windows includes three built-in power schemes: Balanced, High Performance, and Power Saver. These schemes are identified by the same GUID on every Windows 7 computer.
• The GUIDs that identify subgroups and power settings are the same on every Windows 7 computer.
• To create a new scheme, use this command:

  POWERCFG -DUPLICATESCHEME <POWER SCHEME GUID> <NEW GUID>
  

  The <NEW GUID> parameter is optional. If it is not specified, POWERCFG will automatically generate a new GUID.

• Remember that if <NEW GUID> is omitted, the GUID that identifies your new scheme will be different on each computer that you run this command on.

    Private Declare Function CommandLineToArgv Lib "shell32.dll" Alias "CommandLineToArgvW" (ByVal lpCmdLine As String, ByRef pNumArgs As Integer) As Long
    '''
    ''' Summary: Parse the command line string so that it can be used with System.Diagnostics.Process. I chose to use the Windows API here to ensure that the command line parsing is consistent with how Windows handles it.
    '''
    ''' Parameter command: The string that should be parsed
    ''' Returns: An array of command line arguments similar to what Environment.GetCommandLineArgs() produces.
    ''' It sure would be nice if the framework had a method for doing this. It becomes a drawback of using System.Diagnostics.Process, which requires arguments to be separated from the executable.
    Private Function parseCommandLineString(ByVal command As String) As String()
        Dim numargs As Integer
        Dim t As Integer
        Dim ptrCommand As IntPtr = Marshal.StringToHGlobalUni(command) 'Marshal the string to a pointer
        Dim ptrSplitArgs As IntPtr = CommandLineToArgv(ptrCommand, numargs) 'Pass the pointer to CommandLineToArgv for parsing, retrieve the pointer of the result.
        If ptrSplitArgs = IntPtr.Zero Then Throw New System.ComponentModel.Win32Exception 'Is it a valid pointer? Throw an exception if it isn't.
        Dim splitargs(numargs - 1) As String

        For t = 0 To numargs - 1
            splitargs(t) = Marshal.PtrToStringUni(Marshal.ReadIntPtr(ptrCommand, t * IntPtr.Size)).Trim  'Iterate through the arguments and add them to an array.
        Next
        Marshal.FreeHGlobal(ptrCommand)
        Marshal.FreeHGlobal(ptrSplitArgs)
        Return splitargs

    End Function

1. Install the Remote Server Administration Tools (RSAT).
2. Go to Control Panel -> Programs and Features -> Turn Windows features on or off
3. In the treeview, go to Remote Server Administration Tools -> Role Administration Tools -> AD DS and AD LDS Tools and select AD DS Tools. Click OK.

NETDOM should be located in your SYSTEM32 folder. If would rather use Powershell to join the domain, since it’s included with the Windows 7 RTM, then please continue reading. I apologize for any confusion.

(Begin Original Post)

Now that the title of this post has your attention, I can tell you that Windows 7 isn’t really missing this important tool that joins a machine to an Active Directory Domain in an automated fashion. Instead, this command-line utility has been superseded by a new command that’s included in Microsoft’s love-it-or-hate-it command line shell: Windows Powershell. Why? Well, Powershell is certainly more powerful than the standard command prompt. But more importantly, Windows 7 is the first version to include Windows Powershell in the RTM build. With Powershell built into Windows 7, perhaps Microsoft saw no reason to continue including and supporting our old pal, NETDOM.

Joining a Domain with Add-Computer

When you’re finished grieving over the loss of our beloved NETDOM, which has joined countless computers to countless Windows Domains (or far inferior Workgroups), it’s time to roll up your sleeves and start working with the successor command: Add-Computer. This command will only run in a Windows Powershell command prompt. The good news, however, is that you can easily run Add-Computer inside Powershell through a normal command prompt (or batch file). To do so, open a command prompt (with elevated privileges) and run this command:

powershell Add-Computer -DomainName "YOURDOMAIN"

See? That wasn’t so bad now was it? If you don’t mind entering credentials to join the domain on every single computer, that’s all you need. But unfortunately, some of us need to automate the process of joining the domain. For that, it gets more complex, and we’ll need a bit more Powershell to make it work.

Screenshot: Add-Computer -?

How to Use Add-Computer

From a command prompt, you can get more detailed usage instructions for Add-Computer by using this command:

powershell Add-Computer -?

In the syntax section, you’ll find syntax switches that can be used to specify the domain name, OU path, and credentials.  For a more details and examples on Add-Computer, you can also use this command:

powershell get-help Add-Computer -detailed

The first thing you should notice is that, unlike NETDOM, there aren’t syntax switches to specify the username and password. Instead, there is a switch called “-Credential” that takes in a PSCredential object. Therefore, we need to create a PSCredential object with the credentials that will be used to join the computer to the domain before we can actually use the Add-Computer command in an automated way. To do this, we’ll need to create a Powershell script.

If you have never used Powershell before, you’ll probably say to yourself, “PSCredential object? What is that!?”  I’ll give you this very brief explanation: PSCredential is an object that can securely store Windows credentials. Furthermore, Powershell is  more like full-blown Object-Oriented scripting language than a shell language. Like DOS, it has a command prompt. However, the differences usually end there.  Anyway, this article isn’t about Powershell, but if you want to know more about it, start Googling. Or you can just continue on to get the Powershell script.

A Powershell Script to Join the Domain

The Powershell script needed to join the domain contains only two commands.  Create a new text file named “joinDomain.ps1″ and put the following powershell code into it:

$credential = New-Object System.Management.Automation.PsCredential("MY.DOMAIN.COM\user", (ConvertTo-SecureString "mypassword" -AsPlainText -Force))
Add-Computer -DomainName "MY.DOMAIN.COM" -Credential $credential -OUPath ("OU=Computers,DC=MY,DC=DOMAIN,DC=COM")

The first line of the script creates a new System.Management.Automation.PsCredential object. PsCredential takes in two parameters: a string containing a username and a secure string containing the password.  You should change “MY.DOMAIN.COM\user” to the user that will join the computer to the domain. Change “mypassword” to the password of that account.

The second line is the Add-Computer command. “MY.DOMAIN.COM” should be changed to the domain that the computer is joining.  Change OUPath to the OU String that points to the OU container that the computer object should be placed in.

Running the Script

To run the Powershell script above, you need to open an elevated command prompt. To run it, type powershell ./joinDomain.ps1 and press enter. In many cases, you will find that you’re not allowed to run the script, despite running the command as an administrator:

>powershell ./joinDomain.ps1
File joinDomain.ps1 cannot be loaded because the execution of scripts is disabled on this system. Please see "get-help about_signing" for more details.

The funny part about Powershell is that, by default, it is configured to only allow the execution of signed scripts. This is a security feature so that unauthorized or malicious scripts that could compromise the system can’t be executed. After all, Powershell is quite power-ful. Unfortunately, this really tends to confuse and frustrate people. To get around this, you can temporarily change the execution policy, and then change it back:

powershell Set-ExecutionPolicy Unrestricted
powershell ./joinDomain.ps1
powershell Set-ExecutionPolicy Restricted

You can also change the execution policy to allow only signed scripts and scripts created by you. For more information about the Powershell execution policy, check out this article.

Final Thoughts

Now that you are able to automate a domain join with Powershell instead of NETDOM, there is one final thing that I want to mention. In the script above,  the password String was converted to a SecureString by using the “-AsPlainText -Force” arguments. Using SecureString in this way is generally discouraged as it defeats the whole purpose of having a secure string. Furthermore,  having account credentials in plain text with in the script is insecure and generally a bad idea. I’m guessing that this is the reason why Microsoft left out the “/userD” and “/passwordD” parameters from the NETDOM command and made it more slightly difficult to include the credentials in plain text. You should limit the rights of the account you’re using to automatically join the domain so that it cannot be used to delete Active Directory objects, access network shares, etc. You should also consider other methods of storing the credentials. This article has an alternative method for storing credentials used in Powershell that may meet your needs.

While upgrading the WinPE image from 2.0 to 3.0 in anticipation of deploying Windows 7, I discovered that the Windows PE 3.0 base image (the same one that comes with the Windows AIK) was missing Win32_DiskPartition. I use this class to retrieve the number of partitions on the system disk so that I can make sure that each partitition (and its volume) has been assigned a drive letter so that I can search each drive for a preexisting configuration file. But why would Microsoft remove this class!? On a standard Windows 7 machine, the command “WMIC.EXE PARTITION” returned a list of partitions on the system, confirming that I wasn’t losing my mind. However, the command returned nothing when I tried it in Windows PE 3.0.

After lots of searching, I finally came across a post on Microsoft Technet where another developer ran into the same issue. Fortunately, he found a simple, but somewhat obscure, solution:

1. On a fully-installed Windows 7 machine, copy the contents of C:\Windows\System32\wbem
2. Mount the Windows PE 3.0 image and replace the contents of <mountdir>\Windows\System32\wbem with the wbem folder from the previous step

Using the Windows 7 wbem folder in your WinPE 3.0 image will make it several Megabytes larger, but at least you will be able to get to the missing WMI class(es) that you need!

Update 3/11/2010: After upgrading to the latest version of the Microsoft WAIK, I was unable to overwrite existing files in the WBEM folder (Access Denied). For some reason, the permissions are different on this folder now. Here is the workaround:

1. To take ownership of the existing WBEM folder and files, run this command: TAKEOWN /F <mountdir>\windows\system32\wbem /A /R
2. To grant administrators full control of the existing WBEM folder and files, run this command: ICACLS <mountdir>\windows\system32\wbem /grant Administrators:F /T

Once the permissions are updated, you will be able to overwrite files in the WBEM folder.

The error, which had an ID of 10057, was found by going to System Status -> Advertisement Status -> <advertisement name> -> Show Messages on the actions pane:

The program for advertisement “SIT00001 has failed because download of the content “SIT00029″ – “Per-system unattended” has failed. The download failed because the content downloaded to the client does not match the content specified in the content source.

Possible causes: The content on the distribution point has been manually modified, or a local administrator on the computer has modified the content in the computer’s hash. Solution: Refresh the content on the distribution point and retry the download.

The solution seemed obvious: update the distribution points. But multiple tries, including recreating the package and advertisement completely, did not fix the problem. Finally, I stumbled upon a forum post that helped me narrow the problem down to one of two scenarios:

Binary Differential Replication – If this is enabled in the package configuration, some packages seem to fail. I’m assuming that they can’t handle this kind of replication and several of the files become corrupt, creating a hash mismatch. This can be turned off by opening up the package properties, going to the Data Source tab, and unchecking Enable binary differential replication. This wasn’t my problem because I hadn’t enabled binary differential replication.

Hidden Files – Apparently, if the package source contains hidden files, SCCM may not calculate the correct hash for the package and clients could encounter an error. I found a quick way to check this using the command line:

1. Open up a command window in the root director that contains your package source files.
2. Type Dir /S /A:H and hit enter. Depending on the package, you may be presented with several directories with multiple hidden files.
3. Trying to remove the hidden attribute on all the files with the GUI would be tedious, so just use this command instead: attrib -H /S
4. Update the distribution points.

The package finally verified properly and the advertisement completed.

Such was the scenario I experienced while testing BITS with one of the applications we plan to deploy to clients. The client machine would begin the transfer and start the download… and then stop. Even worse, the issue never resolved itself, even when the machine was left running overnight. Since the issue was less-than-obvious (hint: It was not SCCM that was misconfigured) I decided to list a few tips in the BITS troubleshooting process that may be of use to others.

Looking at the Client

SCCM has no shortage of logs, but I have found that the useful information in them is often poorly filtered, poorly described, and generally difficult to find. This is especially true with many of the BITS issues. Here are a few places to look:

C:\Windows\System32\CCM\Logs\DataTransferService.log – This is probably where you’re going to find an error. However, if you’re expecting it to jump out at you because you’re using the Trace32 tool, you may be surprised. Look for an error containing something like: CDTSJob::JobError : DTS Job ID= { GUID } . If you receive this error, you can be fairly sure that the transfer failed. You won’t get much more out if it.

Bitsadmin /list /allusers – Bitsadmin is a useful utility for manipulating and troubleshooting BITS transfers. Open up a command prompt and type bitsadmin /list /allusers or bitsadmin /list /allusers /verbose > bitslog.txt. If you see your SCCM jobs stuck in an error state, you can be sure that something went awry. Your first instinct may be to try and delete or reset the jobs using bitsadmin /reset /allusers. However, I’ve found that this command is rarely successful. Like the logs, this utility seems to only be good for getting a diagnosis.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\BITS – If you tried both of the command above and you think BITS is working, perhaps the client is using BITS download settings that are too low. These settings can be configured using ConfigMgr, but I’ve found that there is a delay between when this is set and when clients actually apply the settings (I’m still not sure exactly how long).

First, check in ConfigMgr to see how BITS is configured for clients: Site Management -> <Site Code> -> Site Settings -> Client Agents -> Computer Client Agent -> Right Click and select Properties. On the BITS tab, look at the throttling window and the transfer rates both inside and outside of the throttling window. If either is set below 500Kbps, your file transfers are going to be VERY slow at certain times. Depending on your network infrastructure and client roaming, set it to something reasonable. For testing, I set mine to 5000 Kbps during business hours.

But what if your settings seem reasonable or you applied the settings and it still doesn’t seem to work? As I mentioned above, clients don’t seem to apply these settings immediately. On a client, open up regedit and verify the settings. If they don’t match the ConfigMgr settings, try changing them, then restart the BITS service and watch your network bandwidth for a consistent spike in traffic that is, hopefully, your package. You may also have to re-run your advertisement.

Another possible culprit of misconfigured BITS are Active Directory Group Policy settings. Use this link for more information about the BITS settings found in GPOs.

On the Distribution Point

With BITS, you have to remember that, in simple terms, you’re downloading files from an over-glorified website. That means that your file transfers are dependent on the IIS instance running on the distribution point. With that in mind, the main place to look for errors are the IIS logs. In Windows Server 2008, look in C:\inetpub\logs\LogFiles\W3SVC1 for the newest log file. With BITS transfers, all of the file downloads get logged through IIS (by default, at least) just like regular web pages. In the logs you should see files and paths that match those contained in your failing software package. You will want to scan the log for culprit files, such as any file that produces a 404 error. Typically, the BITS transfer stops after only a few file download attempts when a 404 error is encountered. The culprit file will likely be towards the end of a large group of file requests.

If you find a 404 error in the logs,  look at the number after it. Is it 7 or 11? In this case you have a 404.7 or 404.11 error that is breaking your transfer to “BITS” (pun intended). This is caused by a filename or extension being blocked by IIS. Use this KB article for more details and for a workaround:  http://support.microsoft.com/kb/943891 . File extension filters can be changed by modifying the <requestFiltering> section in %windir%\System32\inetsrv\config\applicationHost.config. A restart of IIS may be required.

That’s all of my BITS troubleshooting tips for now. I will update this article if I find more troubleshooting tips that may be useful to the masses. Happy troubleshooting!

Source: xkcd.com

While designing and testing a deployment process for Windows Vista using System Center Configuration Manager 2007 I ran into a seemingly obscure problem: Vista refused to use drive letter C as the OS Volume and instead chose D as the system drive letter. The result is that the root of the system drive was D:\ instead of C:\, which is something that legacy applications are not fond of.

This would seem like an easy problem to resolve. Surely, it is caused by the way the disk is partitioned or perhaps the drive letter that SCCM applies the image to is incorrect. Perhaps it’s a registry setting in the image file that needs to be modified offline. I experimented with all of these things, with no luck. Finally, I came across a technet blog entry that I had missed with previous Google search queries:

Several people have tried to use the install.wim from the Windows Vista installation media in an Install an existing image package task sequence.  They are surprised to discover that, upon completion, the operating system is on the D: drive instead of the C: drive. The short explanation for why this happens is that the operating system volume for the images in install.wim is D:.  In other words, when the image was captured, the reference machine had the operating system on volume D:.  Why this is the case for the install.wim that ships on the Windows Vista installation media is beyond the scope of this blog.

So essentially, you can’t use the install.wim image from Vista in SCCM if you want to use C for the system drive letter. That would have been nice to know….

Then, I stumbled upon the open source utility Areca Backup while looking for an acceptable backup solution for my work machine. Had I noticed at first that it was written in Java, I probably wouldn’t have tried it. However, I went ahead and installed it and I must say that this is the best backup utility that I have come across, at least for my needs.

Getting e-mails after backups is also a nice feature. Custom e-mail notifications can be set up for each backup. I setup mine to tell me in the subject of the e-mail if the backup was successful (1) or not (0). That way, I can filter successful backups that I don’t need to see to a reports folder while still getting the message when a backup fails.

The user interface of Areca Backup is surprisingly intuitive. I was able to create a compressed, encrypted, network-based backup with little trouble at all. There are several storage modes and backup types and backups are very fast. The coolest part about this software is the logical view screen. It allows the user to peek into their backups at files and restore any version of a file that they please. To recover, simply right click and select Recover… and then point to the folder where you want the recovered file(s) placed. Another incredibly useful feature is the ability to search within your archives for files.

The only part of this backup utility that seems half-baked to me is the scheduled backups feature. Areca does not run as a service (which can be good and bad) so it is up to the user to create a Windows Scheduled Task to automate archiving. Fortunately, the Areca has a feature that will automatically create the batch file with backup commands so that the user is only required to point their scheduled task to execute a file instead of manually entering the command line parameters. I can live with that.

Overall, this seems like a great open source project and I am impressed with how the software has worked so far. My plan is to start using this at home for backups both to my NAS and an offsite FTP/SSH server. Check it out.

I was shocked at how small this drive was. I would be reluctant to put most USB drives on my keyring because they are too bulky but this drive is really perfect accessory to your keys. The USB connector folds out of the casing. The one thing I dislike about the connector is that it allows you to put the key in to a USB slot backwards, so you have to pay attention when plugging it in.

In terms of performance, it is plenty fast for what we need. It is definitely faster than DVD media and may even have faster reads than the Apacer models we have used. If I have time someday I will do a side-by-side comparison. Writes to drive, while not blazing, are definitely fast enough for our needs since we only need to read data from the drive during our build process.

The verdict is still out for the sturdiness of this device. The USB connector is constructed of plastic that seems to scratch easily. I’m not sure if this will cause problems down the road. When the connector is folded into its case it seems to be fairly safe from unintentional damage.

Overall, I am really impressed with this USB drive. Having a USB drive with both gobs of space and great performance is spectacular, especially at this price. Super Talent has several other models that we may look at in the future.