Chapter 8: Troubleshooting
If you have problems installing the Toolkit or using any of its tools, the following tips and troubleshooting instructions can help.
On This Page
Install and Uninstall
Script-Blocking Security Software
Windows Disk Protection
Install and Uninstall
The following are suggested solutions for possible problems that you might encounter when you install and uninstall the Toolkit.
Windows requires that I validate my copy of Windows when I try to open a tool in the Toolkit.
The Shared Computer Toolkit requires a validated copy of Windows XP. Windows checks for validation before it allows access to any of the tools in the Toolkit. After validation, you will no longer see this message.
I tried to validate Windows by going to the Windows Genuine Advantage Web site, but was unsuccessful.
You can learn more about genuine Microsoft software and find information about the validation process (including troubleshooting information) on the About Genuine Microsoft Software Web site.
I cannot validate my copy of Windows because I do not have Internet access on the shared computer.
WGA requires Internet access to validate your copy of Windows—there is no workaround. Internet access is only required temporarily for validation—you can remove it again after validation has completed.
The installer fails because UPHClean is not installed or running, but it is installed.
The installer checks that the User Profile Hive Cleanup (UPHClean) service is both installed and running. Use the Services tool from the Administrative Tools folder to ensure that the UPHClean service is actually running. If it cannot be started, uninstall and reinstall UPHClean using the Windows Installer (MSI) package.
I installed the Toolkit, but I do not see shortcuts for any of the tools on the Start menu—only shortcuts for the Accessibility tool and the Online Resources for Using Public Computers page.
The Start menu icons for the Toolkit are only installed for Toolkit administrator—the administrative account under that you used to install the Toolkit. You must log on as the user who installed the Toolkit to use the tools.
After I uninstalled the toolkit, Windows displays Script Not Found errors for some users.
Many functions of the Toolkit, such as session timers, require that the Toolkit be installed. To avoid this problem, remove restrictions and turn off Windows Disk Protection before you uninstall the Toolkit. To resolve this problem, reinstall the Toolkit, remove restrictions and turn off Windows Disk Protection, and then uninstall the Toolkit. See Chapter 1, “Installation,” for more information.
After I uninstalled the Toolkit, Windows Disk Protection no longer protects my disk from changes.
Many functions of the Toolkit, including Windows Disk Protection, require that the Toolkit be installed.
After I uninstalled the Toolkit, AutoRestart no longer works.
Many functions of the Toolkit, including AutoRestart, require that the Toolkit be installed.
Script-Blocking Security Software
The following are suggested solutions for possible problems that you might encounter if you run script-blocking software.
My security software displays an error during installation of the Toolkit that states that it has blocked a suspicious or malicious script.
Some security programs report the execution of Toolkit scripts. If you see these warnings during installation and your security software supports it, you should allow the script to run.
I cannot permanently allow or authorize scripts to run with my antispyware or security software.
Toolkit scripts must be permanently authorized to run, or the Toolkit will not work. Turn off the script blocking functionality of your antivirus or security software.
Script-blocking software displays pop-up messages that state that a malicious script has been detected when I run many of the tools in the Toolkit.
Because many of the tools in the Toolkit are scripted, script-blocking software detects when the tools are used and warns about the possibility of malicious scripts. The Toolkit scripts are not malicious. There are two ways to handle this problem:
Disable script-blocking in your security software while you use the tools in the Toolkit.
If your script-blocking software supports it, tell the software to authorize the script and not to ask about the script again. If you do this, you should only see the pop-up messages appear the first time you use each script.
If possible, authorize these scripts in advance. Browse to the Shared Computer Toolkit installation folder and run each script individually one time to authorize it in your antispyware program. A list of these scripts is included in Chapter 3, “Set Up Local User Profiles.”
My antispyware program asks for approval before allowing “GetStarted.hta” to be added to Windows startup.
In order for Getting Started to run on startup, you must allow your antispyware program to add GetStarted.hta to your Run key in the registry.
The following are suggested solutions to possible problems that you might encounter when you configure user accounts and profiles.
Windows automatically logs on as a particular user, even though I have not configured it to do so.
If there is only one account listed on the Welcome screen and that account is configured with a blank password, Windows automatically logs on as that account. This is a feature of Windows, not of the Toolkit.
Log off the account to log on as another account not listed in the Welcome screen. To prevent Restart at Logoff from occurring, press down and hold the SHIFT key while you click Log Off and then OK to log off the restricted account.
To prevent the Welcome screen from logging on automatically, assign a password to the account or create another account. For more information, see The "Welcome" Logon Screen Does Not Appear and How to automatically log on to a user account in Windows XP knowledge base articles.
Alternatively, you can deselect Use the Welcome screen to simplify the log on process for users and Prevent account names from being saved in the CTRL-ALT-DEL logon dialog in Getting Started, Step 2.
The Welcome screen appears and I cannot press CTRL+ALT+DEL twice to log on as the Toolkit administrator.
This happens when you are logged on as a Toolkit administrator in an idle mode for too long, and the Toolkit administrator has been removed from the Welcome screen.
See the Welcome Screen Appears After Your Computer Has Been Idle knowledge base article for more information.
A user does not appear in the User Accounts tool.
This happens when the account has been disabled using the Accounts.wsf command-line tool. Enable the account and it will appear in the User Accounts tool.
See the A User Account Does Not Appear in the User Accounts Tool knowledge base article for more information.
All or some of the user pictures on the Welcome screen are the same.
See the How To Add or Change a User's Picture in Windows XP knowledge base article for more information.
Users of the shared computer report that every time they run a program, they have to accept a licensing agreement—even if they have already done so in a previous session.
There are two possible causes for this problem. The profile is locked or Windows Disk Protection clears the changes made by the user when the computer restarts.
To prevent this, run programs the first time for each user account before you lock profiles or turn on Windows Disk Protection.
To solve this problem if it occurs, restart the computer, select Save changes with next restart in Windows Disk Protection, clear the Lock this profile check box, log on as the user, run the program, and then restart the computer.
Users report the following error: “This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.”
This error message occurs because User Restrictions is configured to block access to the C: drive and the user’s profile is stored on the C: drive. The error appears when Windows Explorer attempts to access special folders (such as My Documents and My Music) that are located on that drive. To resolve this problem, remove the Windows Explorer shortcut from the Start menu and replace it with a shortcut to My Computer.
The Create Profile button does not display in the Profile Manager tool.
The user profile already exists. Delete the user profile if you want to create a new one.
The Delete Profile button does not display in the Profile Manager tool.
The user profile does not exist and must be created first.
Icons that do not exist in the Start menu folder of a user’s profile display on the user’s Start menu.
Windows XP builds a user’s Start menu by combining icons in the Start menu folders of the All Users profile and the individual user’s profile. The icons on the user’s Start menu likely exist in the All Users Start menu folder.
I installed a new program and, during installation, I selected the option to make the program available to all users. The shortcut appears on some user’s Start menus, but not on others.
Installation programs typically install shortcuts to the Start menu folder for the All Users profile. The accounts on which the shortcuts do not appear are likely restricted by the Prevent programs from the All Users folder from appearing on the Start menu check box in User Restrictions.
When I create a new user profile, the profile disappears after I restart the computer.
Windows Disk Protection clears changes made to the hard disk when the computer restarts. You must use Windows Disk Protection and select the Save changes with next restart option.
The shared computer has some programs that cannot be run by a limited user account because they require an administrative account.
Although not a recommended scenario, it is possible to restrict an administrative account so that users can run such programs. For more information, see the “Restrict a Shared Administrative Account” section in Chapter 9, “Advanced Scenarios.”
The following are suggested solutions for possible problems that you might encounter when you use the User Restrictions tool.
I used the User Restrictions tool to change settings, but after I restart the computer, those changes are not there.
Windows Disk Protection clears changes made to the hard disk when the computer restarts. You must either use Windows Disk Protection to select the Save changes with next restart option or create the user profile on a persistent partition.
After setting user restrictions, I cannot see the Accessibility tool and some program icons on the Start menu.
Icons that are placed in the All Users Start menu folder are blocked from a restricted user’s Start menu when you select the Prevent programs from the All Users folder from appearing on the Start menu setting. You can copy these icons into the user’s Start menu folder to make them available to the user.
After setting user restrictions, I cannot run some shortcuts.
If the Only allow software in the Program Files and Windows folders to run software restriction setting is selected, users will not be allowed to run shortcuts to programs that do not exist in either the Program Files folder or the Windows folder. Move the program to one of these folders to allow it to run.
Users report that they are not able to change settings in Windows even though Windows Disk Protection is off.
You have likely used the User Restrictions tool to lock the user profile.
I set the restriction to prevent Microsoft Office programs from running, but users can still run Microsoft Office programs.
Most likely, Microsoft Office is not installed in the default location. This restriction works by preventing programs in C:\Program Files\Microsoft Office folder from running. If Microsoft Office is installed in another folder, the restriction will not work.
Some games (such as Microsoft Halo® or Activision Call of Duty) and other programs that use copy protection do not work properly when software restrictions are in place.
Software Restrictions can prevent some copy-protected games from running. To use those games, clear the Software Restrictions check box. Keep in mind that turning off software restrictions significantly weakens the security of a shared computer.
Users do not see the Web page I set within Active Desktop for a restricted account.
The recommended restrictions prevent Active Desktop from working. This is intentional.
To display a Web page containing information for all users to see upon logon, add Internet Explorer to the user’s Startup folder and have it point to the Web page.
With my antispyware installed, I cannot change the Internet Explorer home page for a locked user profile without having the user receive a message from antispyware regarding the changed home page.
This warning occurs with some security software when the User Restrictions tool changes the Internet Explorer home page.
To prevent this error, change the home page within Internet Explorer before you lock the profile.
Windows Disk Protection
The following are suggested solutions to possible problems that you might encounter when you use Windows Disk Protection.
I cannot turn on Windows Disk Protection.
Make sure that the computer is prepared to use Windows Disk Protection. For more information, see Chapter 2, “Prepare the Disk for Windows Disk Protection.”
I am using a dynamic disk for my Windows volume. Windows Disk Protection reports the error, “This computer does not currently support Windows Disk Protection...”
Windows Disk Protection is designed to support basic disks only. Computers that use dynamic disks for the Windows volume cannot use Windows Disk Protection. You will have to reinstall Windows using a basic disk for the Windows partition.
Windows displays a message that states “Enhanced Write Filter is committing changes to disk.”
This message is expected and appears when you use Windows Disk Protection to Save changes with next restart.
Windows displays a warning message on startup that it has finished installing new devices. This continues to happen through successive restarts.
This problem can occur when Windows makes changes to the system after you turn on Windows Disk Protection. You should open Windows Disk Protection, select Save changes with next restart, and then restart the computer.
Windows does not start and a black screen appears instead.
This problem can occur if a third-party disk partitioning utility causes corruption in the Master boot record, Partition tables, Boot sector, or NTLDR file. See the Computer stops responding with a black screen when you start Windows XP knowledge base article for more information.
When I log on to the shared computer, Windows displays a message that a critical update requires that I accept a licensing agreement. Even when I accept it, I see the same message the next time I restart the computer and log on.
Windows Disk Protection clears changes made to the hard disk when the computer restarts, including the installation of the update. The scheduled update feature of Windows Disk Protection cannot automatically accept a licensing agreement. You should restart the computer, log on as an administrator, configure Windows Disk Protection to Save changes with next restart, install the update, and then restart Windows.
When I run Windows Disk Protection, Windows prompts me to restart the computer.
Windows Disk Protection requires that the computer be restarted once after installation before you can turn on the tool. This is by design.
I changed or resized the partitions or added a new hard drive to the computer. Now Windows Disk Protection is not working.
Windows Disk Protection keeps track of the physical location of the disk and Windows partition. If this changes, Windows Disk Protection will no longer work. Turn off Windows Disk Protection, delete the protection partition, and turn on Windows Disk Protection again.
Windows Disk Protection seems to protect the files in the Windows directory just fine, but doesn’t protect my system partition. The boot partition and system partition are separate partitions on the shared computer.
Most computers running Windows XP use a single disk partition to hold the system and boot partitions for the computer. In this circumstance, Windows Disk Protection protects the system and boot partitions. If the system and boot partitions are on separate disk partitions, Windows Disk Protection protects only the boot partition, which holds the %Windir% directory.
When I turn on Windows Disk Protection, I receive a warning message that hibernation will not work with Windows Disk Protection.
Windows Disk Protection allows files to be written or modified in the Windows partition, making them appear to be modified. When your system hibernates, the Hiberfil.sys file that stores the contents of the system RAM during hibernation is not written to the Windows partition. When you restart the computer, the system will not detect a hibernation file and will start as usual.
I receive a Delayed-write failure when Windows Disk Protection is on.
These write failures are caused by your protection partition filling up. This can happen when you burn a CD or DVD because a complete image of the CD or DVD is made on your computer prior to writing it to disk.
If your customers will need to burn CDs or DVDs or perform other disk-intensive activities, turn Windows Disk Protection off, delete the protection partition, increase the amount unallocated disk space, and then turn Windows Disk Protection back on. You need to ensure that there is sufficient disk space for their disk activities.
If you need to burn a CD or DVD, you can also simply turn off Windows Disk Protection, burn the disk, and then turn Windows Disk Protection back on.
Another time you might receive a Delayed write failure is if you are using the Retain changes indefinitely option. If the problem prevents you from logging on or accessing Windows Disk Protection, press F8 before Windows startup to access the Advanced Startup Options screen. Select the Enhanced Write Filter Restore Mode (restores one level) option to tell Windows Disk Protection to clear the retained disk changes.
I added a user profile for a new user, but after restarting the computer, the profile is missing.
In its default configuration, Windows Disk Protection discards all changes made to the system disk each time the computer restarts. To retain the user profile, configure Windows Disk Protection to Save changes with next restart. This setting will write the user profile to the disk, making it available after the restart.
I installed a new software program on my computer. When I restarted the computer, my icons were still there, but the new program was missing.
If a user profile is stored on a persistent partition it will retain icons from installed programs, even if the programs have been deleted by the Clear Changes with each restart option in Windows Disk Protection. To prevent this, select the Save changes with next restart option before you restart the computer.
I used a disk partitioning tool to make space for the protection partition, but now my system will not start.
Unfortunately, Microsoft is not able to provide support for third-party disk partitioning tools. Please contact the vendor of your partitioning tool for assistance with this issue.
When I attempt to run Getting Started or Windows Disk Protection, I get a message saying WDP.CMD is blocked by my script blocking software.
If script-blocking software blocks WDP.CMD, the Toolkit displays a warning message asking you to allow it to run. Authorize or allow WDP.CMD to run in your script-blocking program to ensure that accurate information is provided by Windows Disk Protection.
When I attempt to manage partitions using Norton PartitionMagic, the program returns an error.
Do not attempt to change any partitions when Windows Disk Protection is on. Turn off Windows Disk Protection, restart the computer, delete the protection partition (called a Healthy Unknown partition) using Disk Management in Windows, and then use PartitionMagic to change your partitions. If you plan to use Windows Disk Protection again, make sure you keep enough unallocated space on the disk for the creation of a protection partition.
I receive an error message in the System event log stating that configuration of the page file for a crash dump has failed (Event 49).
This is expected behavior and does not affect the normal use of the computer. The system reports this error because it cannot commit changes to a page file on the Windows partition and cannot start its memory dump routines. If you want to fix this problem, move your page file to a persistent disk. For more information, see the "Improve the Performance of Windows Disk Protection" section in Chapter 6, "Windows Disk Protection."
The Disk Protection Is On popup does not start.
This popup will only start if Windows Disk Protection is on and Getting Started is not configured to open automatically. Clear the Show Getting Started at Startup check box in Getting Started, and ensure that Windows Disk Protection is on.
The following are suggested solutions to other errors or concerns that you might encounter when using the Shared Computer Toolkit.
Automatic scrolling is sometimes very slow in the window for the Getting Started tool.
It is likely that there is a problem with the video driver for the graphics adapter on the shared computer. Ensure that you are using the latest driver available for your device.
When I try to run any tool in the Toolkit, I receive an error message from Microsoft HTML Application Host regarding LegitCheckControl.DLL.
LegitCheckControl.DLL has become corrupt and cannot validate that your copy of Windows is genuine, so it will not let any tools run. To fix this, delete LegitCheckControl.DLL from the Windows\System32 folder. Delete the Windows Genuine Advantage Validation tool from the Windows\Downloaded Program Files folder. Run the tool again and perform the required Windows validation steps to reactivate the Toolkit.
One of the graphical tools in the Toolkit will not start.
This can happen if a tool is forced to close while processing. Use Task Manager to end the process called mshta.exe.
The Getting Started tool displays an error that suggests that software restrictions on this computer do not apply to administrative accounts.
This warning appears only on computers on which software restriction policies have previously been configured so as not to apply to administrators. The PolicyScope key defines whether software restrictions apply to everyone (administrators included) or just users. If this key has previously been set to “just users,” the Toolkit installation does not apply software restrictions to administrators. This helps to ensure that past software restrictions are not inadvertently applied to administrative accounts.
For more information, see Using Software Restriction Policies to Protect Against Unauthorized Software.