Musical Alerts; Clean Spool Files; DHCP Bug Fix

Why Do Windows Systems Play "Fur Elise" or "It's a Small, Small World"?
Here's an entertaining document that explains why you might randomly hear "Fur Elise" or "It's a Small, Small World" on Windows 2000, Windows NT 4.0, or Windows 9x systems equipped with Award/Unicore BIOS. Although random strains of music appear suspiciously like a virus infection, the music is actually a programmed feature of Award/Unicore motherboards dated 1997 or later. Microsoft article Q261186 explains that when a system plays either selection, it's alerting you to two potential hardware problems: either the CPU fan is failing or has failed, or power supply voltages have drifted out of tolerance. The article recommends you perform a full hardware test to identify and correct the problem component, so start by checking the CPU fan and power supply.

Windows NT Truncates new BIOS Four-Digit Year
Microsoft article Q265387 indicates that the NT function CmpGetBiosDates reads the date from the BIOS at system startup and stores the date in the Registry key HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate. NT 4.0 assumes the BIOS date is formatted as MM/DD/YY, but new BIOS chips report the date in the format MM/DD/CCYY. When WinMSD reads the date from the Registry, it truncates the year to the first two digits. So, for example, WinMSD interprets April 4, 2000, as 04/04/20 instead of 04/04/2000. The article doesn't identify the culprit as an NT function or WinMSD, but this problem exists on all NT systems running Service Pack 4 (SP4) or later with new BIOS. You can call Microsoft Support for a bug fix that updates two files: Ntkrnlmp.exe and Ntoskrnl.exe; the files have a release date of June 14.

Cleaning Up Temporary Spool Files
Most of us don't regularly inspect files in the NT 4.0 spool file directory, but a recent Microsoft article indicates that we probably should. By default, print jobs and their associated files are stored in the directory winnt\system32\spool. Under normal circumstances, the print spooler deletes all these files; however, the spooler might leave files with an extension of .spl, .tmp, and .shd after printing all pending jobs. SPL files are print files, and TMP files are created for LPR print jobs. SHD files, called "shadow files," contain information about the print job's originator, which printer the job was sent to, and the job's order in the print queue. You can safely delete these files after all jobs are printed, either manually or by running a script. For more information, see Microsoft article Q264662

Disabling Server Access During Scheduled Maintenance
Here's a handy tip for disabling access to NT 4.0 systems while you perform maintenance or upgrade tasks. Unless you have modified the default settings, the Everyone group has the right "Access this computer from the network." This permission lets users connect whenever a server is available on the network. To disable non-Administrator access, start User Manager for Domains, select User Rights on the Policies menu, select "Access this computer from the network" from the drop-down menu of rights and remove the Everyone group. When you are ready to put the server into production, reverse the procedure and grant this right to the Everyone group. This technique is faster than setting up restricted logon hours for user accounts. Microsoft article Q264809 documents this technique.

DHCP Bug Fix
When you stop and restart the DHCP service, tcpsvcs.exe can hang with a Dr. Watson error message. Although scanty on details, Microsoft article Q264492 indicates that stopping and restarting DHCP causes heap corruption in some cases. If you experience this problem, call Microsoft Support for a new version of dhcpssvc.dll dated June 2. The article indicates that this problem applies to all NT 4.0 systems.

Removing an In-Use USB Device Disables the Device
Universal serial bus (USB) audio and video stream devices might not work if you remove and reconnect them while they are in use. The USB hub driver in Windows 2000 releases bandwidth only on IRP_MN_REMOVE_DEVICE IRP, not on IRP_MN_SURPRISE_REMOVAL, which means the hub driver doesn't notify you of the removal until after the application using the device exits. When you reconnect the USB device, the device won't function because the system doesn't release enough bandwidth. To work around this problem, exit the application using the device or restart the system. No bug fix is available for the USB hub driver. Microsoft article Q264946 indicates that this problem exists on both Win2K and Win98 systems.

Protected Storage Service Startup Failure
Although I've never seen this bug personally, I think it could be a real problem to diagnose so here's the scoop. When you reboot after installing third-party software on NT 4.0 and Win9x systems, you might see an error message indicating that the Protected Storage Service failed to start. NT 4.0 Workstation records this error with Event Id 127 in the System Event Log. At startup, this service calls an API function in the imagehlp.dll. If the third-party software overwrites this DLL with an older version, the API function isn't available, which causes the service failure. If imagehlp.dll has a date earlier than 1997, you need to replace it with the equivalent DLL from Internet Explorer (IE) 4.01. Microsoft article Q266055 documents this problem and the corrective action you need to take for each platform (NT 4.0 and Win9x).

TAGS: Security
Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.