mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Acrolinx enhancement effort
This commit is contained in:
Siddarth Mandalika
parent
cb6ed26a35
commit
8ee1d39704
@ -18,11 +18,11 @@ ms.collection: highpri
|
||||
|
||||
## Overview
|
||||
|
||||
This article includes general troubleshooting for 802.1X wireless and wired clients. While troubleshooting 802.1X and wireless, it's important to know how the flow of authentication works, and then figure out where it's breaking. It involves a lot of third-party devices and software. Most of the time, we have to identify where the problem is, and another vendor has to fix it. We don't make access points or switches, so it's not an end-to-end Microsoft solution.
|
||||
This article includes general troubleshooting for 802.1X wireless and wired clients. While troubleshooting 802.1X and wireless, it's important to know how the flow of authentication works, and then figure out where it's breaking. It involves many third-party devices and software. Most of the time, we have to identify where the problem is, and another vendor has to fix it. We don't make access points or switches, so it's not an end-to-end Microsoft solution.
|
||||
|
||||
## Scenarios
|
||||
|
||||
This troubleshooting technique applies to any scenario in which wireless or wired connections with 802.1X authentication is attempted and then fails to establish. The workflow covers Windows 7 through Windows 10 (and Windows 11) for clients, and Windows Server 2008 R2 through Windows Server 2012 R2 for NPS.
|
||||
This troubleshooting technique applies to any scenario in which wireless or wired connections with 802.1X authentication are attempted and then fail to establish. The workflow covers Windows 7 through Windows 10 (and Windows 11) for clients, and Windows Server 2008 R2 through Windows Server 2012 R2 for NPS.
|
||||
|
||||
## Known issues
|
||||
|
||||
@ -38,9 +38,9 @@ Viewing [NPS authentication status events](/previous-versions/windows/it-pro/win
|
||||
|
||||
NPS event log entries contain information about the connection attempt, including the name of the connection request policy that matched the connection attempt and the network policy that accepted or rejected the connection attempt. If you don't see both success and failure events, see the [NPS audit policy](#audit-policy) section later in this article.
|
||||
|
||||
Check the Windows Security event log on the NPS Server for NPS events that correspond to rejected ([event ID 6273](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc735399(v%3dws.10))) or accepted ([event ID 6272](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc735388(v%3dws.10))) connection attempts.
|
||||
Check the Windows Security event log on the NPS Server for NPS events that correspond to the rejected ([event ID 6273](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc735399(v%3dws.10))) or the accepted ([event ID 6272](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc735388(v%3dws.10))) connection attempts.
|
||||
|
||||
In the event message, scroll to the very bottom, and then check the [Reason Code](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197570(v%3dws.10)) field and the text that's associated with it.
|
||||
In the event message, scroll to the bottom, and then check the [Reason Code](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197570(v%3dws.10)) field and the text that's associated with it.
|
||||
|
||||
|
||||
*Example: event ID 6273 (Audit Failure)*<br><br>
|
||||
@ -48,7 +48,7 @@ In the event message, scroll to the very bottom, and then check the [Reason Code
|
||||
|
||||
*Example: event ID 6272 (Audit Success)*<br>
|
||||
|
||||
The WLAN AutoConfig operational log lists information and error events based on conditions detected by or reported to the WLAN AutoConfig service. The operational log contains information about the wireless network adapter, the properties of the wireless connection profile, the specified network authentication, and, in the event of connectivity problems, the reason for the failure. For wired network access, the Wired AutoConfig operational log is an equivalent one.
|
||||
The WLAN AutoConfig operational log lists information and error events based on conditions detected by or reported to the WLAN AutoConfig service. The operational log contains information about the wireless network adapter, the properties of the wireless connection profile, the specified network authentication, and, if connectivity problems occur, the reason for the failure. For wired network access, the Wired AutoConfig operational log is an equivalent one.
|
||||
|
||||
On the client side, go to **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\WLAN-AutoConfig/Operational** for wireless issues. For wired network access issues, go to **..\Wired-AutoConfig/Operational**. See the following example:
|
||||
|
||||
@ -114,7 +114,7 @@ auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enab
|
||||
|
||||
Even if audit policy appears to be fully enabled, it sometimes helps to disable and then re-enable this setting. You can also enable Network Policy Server logon/logoff auditing by using Group Policy. To get to the success/failure setting, select **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Advanced Audit Policy Configuration** > **Audit Policies** > **Logon/Logoff** > **Audit Network Policy Server**.
|
||||
|
||||
## Additional references
|
||||
## More references
|
||||
|
||||
[Troubleshooting Windows Vista 802.11 Wireless Connections](/previous-versions/windows/it-pro/windows-vista/cc766215(v=ws.10))<br>
|
||||
[Troubleshooting Windows Vista Secure 802.3 Wired Connections](/previous-versions/windows/it-pro/windows-vista/cc749352(v=ws.10))
|
||||
@ -44,11 +44,11 @@ Essential drivers required to start the Windows kernel are loaded and the kernel
|
||||
|
||||
**4. Windows NT OS Kernel**
|
||||
|
||||
The kernel loads into memory the system registry hive and additional drivers that are marked as BOOT_START.
|
||||
The kernel loads into memory the system registry hive and other drivers that are marked as BOOT_START.
|
||||
|
||||
The kernel passes control to the session manager process (Smss.exe) which initializes the system session, and loads and starts the devices and drivers that are not marked BOOT_START.
|
||||
The kernel passes control to the session manager process (Smss.exe) which initializes the system session, and loads and starts the devices and drivers that aren't marked BOOT_START.
|
||||
|
||||
Here is a summary of the boot sequence, what will be seen on the display, and typical boot problems at that point in the sequence. Before starting troubleshooting, you have to understand the outline of the boot process and display status to ensure that the issue is properly identified at the beginning of the engagement.
|
||||
Here's a summary of the boot sequence, what will be seen on the display, and typical boot problems at that point in the sequence. Before starting troubleshooting, you have to understand the outline of the boot process and display status to ensure that the issue is properly identified at the beginning of the engagement.
|
||||
|
||||
<br>
|
||||
[Click to enlarge](img-boot-sequence.md)<br>
|
||||
@ -74,15 +74,15 @@ To determine whether the system has passed the BIOS phase, follow these steps:
|
||||
|
||||
1. If there are any external peripherals connected to the computer, disconnect them.
|
||||
|
||||
2. Check whether the hard disk drive light on the physical computer is working. If it is not working, this indicates that the startup process is stuck at the BIOS phase.
|
||||
2. Check whether the hard disk drive light on the physical computer is working. If it's not working, this dysfunction indicates that the startup process is stuck at the BIOS phase.
|
||||
|
||||
3. Press the NumLock key to see whether the indicator light toggles on and off. If it does not, this indicates that the startup process is stuck at BIOS.
|
||||
3. Press the NumLock key to see whether the indicator light toggles on and off. If it doesn't toggle, this dysfunction indicates that the startup process is stuck at BIOS.
|
||||
|
||||
If the system is stuck at the BIOS phase, there may be a hardware problem.
|
||||
|
||||
## Boot loader phase
|
||||
|
||||
If the screen is completely black except for a blinking cursor, or if you receive one of the following error codes, this indicates that the boot process is stuck in the Boot Loader phase:
|
||||
If the screen is black except for a blinking cursor, or if you receive one of the following error codes, this status indicates that the boot process is stuck in the Boot Loader phase:
|
||||
|
||||
- Boot Configuration Data (BCD) missing or corrupted
|
||||
- Boot file or MBR corrupted
|
||||
@ -98,7 +98,7 @@ To troubleshoot this problem, use Windows installation media to start the comput
|
||||
|
||||
The Startup Repair tool automatically fixes many common problems. The tool also lets you quickly diagnose and repair more complex startup problems. When the computer detects a startup problem, the computer starts the Startup Repair tool. When the tool starts, it performs diagnostics. These diagnostics include analyzing startup log files to determine the cause of the problem. When the Startup Repair tool determines the cause, the tool tries to fix the problem automatically.
|
||||
|
||||
To do this, follow these steps.
|
||||
To do this task of invoking the Startup Repair tool, follow these steps.
|
||||
|
||||
> [!NOTE]
|
||||
> For additional methods to start WinRE, see [Windows Recovery Environment (Windows RE)](/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference#span-identrypointsintowinrespanspan-identrypointsintowinrespanspan-identrypointsintowinrespanentry-points-into-winre).
|
||||
@ -142,7 +142,7 @@ BOOTREC /FIXBOOT
|
||||
|
||||
If you receive BCD-related errors, follow these steps:
|
||||
|
||||
1. Scan for all the systems that are installed. To do this, run the following command:
|
||||
1. Scan for all the systems that are installed. To do this step, run the following command:
|
||||
|
||||
```console
|
||||
Bootrec /ScanOS
|
||||
@ -150,7 +150,7 @@ If you receive BCD-related errors, follow these steps:
|
||||
|
||||
2. Restart the computer to check whether the problem is fixed.
|
||||
|
||||
3. If the problem is not fixed, run the following commands:
|
||||
3. If the problem isn't fixed, run the following commands:
|
||||
|
||||
```console
|
||||
bcdedit /export c:\bcdbackup
|
||||
@ -166,7 +166,7 @@ If you receive BCD-related errors, follow these steps:
|
||||
|
||||
### Method 4: Replace Bootmgr
|
||||
|
||||
If methods 1, 2 and 3 do not fix the problem, replace the Bootmgr file from drive C to the System Reserved partition. To do this, follow these steps:
|
||||
If methods 1, 2 and 3 don't fix the problem, replace the Bootmgr file from drive C to the System Reserved partition. To do this replacement, follow these steps:
|
||||
|
||||
1. At a command prompt, change the directory to the System Reserved partition.
|
||||
|
||||
@ -196,7 +196,7 @@ If methods 1, 2 and 3 do not fix the problem, replace the Bootmgr file from driv
|
||||
|
||||
### Method 5: Restore System Hive
|
||||
|
||||
If Windows cannot load the system registry hive into memory, you must restore the system hive. To do this, use the Windows Recovery Environment or use Emergency Repair Disk (ERD) to copy the files from the C:\Windows\System32\config\RegBack to C:\Windows\System32\config.
|
||||
If Windows can't load the system registry hive into memory, you must restore the system hive. To do this step,, use the Windows Recovery Environment or use Emergency Repair Disk (ERD) to copy the files from the C:\Windows\System32\config\RegBack to C:\Windows\System32\config.
|
||||
|
||||
If the problem persists, you may want to restore the system state backup to an alternative location, and then retrieve the registry hives to be replaced.
|
||||
|
||||
@ -205,7 +205,7 @@ If the problem persists, you may want to restore the system state backup to an a
|
||||
|
||||
## Kernel Phase
|
||||
|
||||
If the system gets stuck during the kernel phase, you experience multiple symptoms or receive multiple error messages. These include, but are not limited to, the following:
|
||||
If the system gets stuck during the kernel phase, you experience multiple symptoms or receive multiple error messages. These error messages include, but aren't limited to, the following examples:
|
||||
|
||||
- A Stop error appears after the splash screen (Windows Logo screen).
|
||||
|
||||
@ -248,7 +248,7 @@ On the **Advanced Boot Options** screen, try to start the computer in **Safe Mod
|
||||
### Clean boot
|
||||
|
||||
To troubleshoot problems that affect services, do a clean boot by using System Configuration (msconfig).
|
||||
Select **Selective startup** to test the services one at a time to determine which one is causing the problem. If you cannot find the cause, try including system services. However, in most cases, the problematic service is third-party.
|
||||
Select **Selective startup** to test the services one at a time to determine which one is causing the problem. If you can't find the cause, try including system services. However, in most cases, the problematic service is third-party.
|
||||
|
||||
Disable any service that you find to be faulty, and try to start the computer again by selecting **Normal startup**.
|
||||
|
||||
@ -273,7 +273,7 @@ problems can be solved. Modify the registry at your own risk.
|
||||
|
||||
To troubleshoot this Stop error, follow these steps to filter the drivers:
|
||||
|
||||
1. Go to Windows Recovery Environment (WinRE) by putting an ISO disk of the system in the disk drive. The ISO should be of same version of Windows or a later version.
|
||||
1. Go to Windows Recovery Environment (WinRE) by putting an ISO disk of the system in the disk drive. The ISO should be of the same version of Windows or a later version.
|
||||
|
||||
2. Open the registry.
|
||||
|
||||
@ -289,7 +289,7 @@ To troubleshoot this Stop error, follow these steps to filter the drivers:
|
||||
|
||||
7. Restart the server in Normal mode.
|
||||
|
||||
For additional troubleshooting steps, see the following articles:
|
||||
For more troubleshooting steps, see the following articles:
|
||||
|
||||
- [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](./troubleshoot-inaccessible-boot-device.md)
|
||||
|
||||
@ -314,7 +314,7 @@ To fix problems that occur after you install Windows updates, check for pending
|
||||
|
||||
Try to start the computer.
|
||||
|
||||
If the computer does not start, follow these steps:
|
||||
If the computer doesn't start, follow these steps:
|
||||
|
||||
1. Open A Command Prompt window in WinRE, and start a text editor, such as Notepad.
|
||||
|
||||
@ -346,7 +346,7 @@ If the Stop error occurs late in the startup process, or if the Stop error is st
|
||||
|
||||
- [Generate a kernel or complete crash dump](./generate-kernel-or-complete-crash-dump.md)
|
||||
|
||||
For more information about page file problems in Windows 10 or Windows Server 2016, see the following:
|
||||
For more information about page file problems in Windows 10 or Windows Server 2016, see the following article:
|
||||
- [Introduction to page files](./introduction-page-file.md)
|
||||
|
||||
For more information about Stop errors, see the following Knowledge Base article:
|
||||
@ -357,7 +357,7 @@ If the dump file shows an error that is related to a driver (for example, window
|
||||
|
||||
- Check the functionality that is provided by the driver. If the driver is a third-party boot driver, make sure that you understand what it does.
|
||||
|
||||
- If the driver is not important and has no dependencies, load the system hive, and then disable the driver.
|
||||
- If the driver isn't important and has no dependencies, load the system hive, and then disable the driver.
|
||||
|
||||
- If the stop error indicates system file corruption, run the system file checker in offline mode.
|
||||
|
||||
@ -369,7 +369,7 @@ If the dump file shows an error that is related to a driver (for example, window
|
||||
|
||||
For more information, see [Using System File Checker (SFC) To Fix Issues](/archive/blogs/askcore/using-system-file-checker-sfc-to-fix-issues)
|
||||
|
||||
- If there is disk corruption, run the check disk command:
|
||||
- If there's disk corruption, run the check disk command:
|
||||
|
||||
```console
|
||||
chkdsk /f /r
|
||||
|
||||
@ -20,7 +20,7 @@ ms.topic: troubleshooting
|
||||
|
||||
## Overview
|
||||
|
||||
This is a general troubleshooting of establishing Wi-Fi connections from Windows clients.
|
||||
This overview describes the general troubleshooting of establishing Wi-Fi connections from Windows clients.
|
||||
Troubleshooting Wi-Fi connections requires understanding the basic flow of the Wi-Fi autoconnect state machine. Understanding this flow makes it easier to determine the starting point in a repro scenario in which a different behavior is found.
|
||||
This workflow involves knowledge and use of [TextAnalysisTool](https://github.com/TextAnalysisTool/Releases), an extensive text filtering tool that is useful with complex traces with numerous ETW providers such as wireless_dbg trace scenario.
|
||||
|
||||
@ -29,11 +29,11 @@ This workflow involves knowledge and use of [TextAnalysisTool](https://github.co
|
||||
This article applies to any scenario in which Wi-Fi connections fail to establish. The troubleshooter is developed with Windows 10 clients in focus, but also may be useful with traces as far back as Windows 7.
|
||||
|
||||
> [!NOTE]
|
||||
> This troubleshooter uses examples that demonstrate a general strategy for navigating and interpreting wireless component [Event Tracing for Windows](/windows/desktop/etw/event-tracing-portal) (ETW). It is not meant to be representative of every wireless problem scenario.
|
||||
> This troubleshooter uses examples that demonstrate a general strategy for navigating and interpreting wireless component [Event Tracing for Windows](/windows/desktop/etw/event-tracing-portal) (ETW). It's not meant to be representative of every wireless problem scenario.
|
||||
|
||||
Wireless ETW is incredibly verbose and calls out a lot of innocuous errors (rather flagged behaviors that have little or nothing to do with the problem scenario). Simply searching for or filtering on "err", "error", and "fail" will seldom lead you to the root cause of a problematic Wi-Fi scenario. Instead it will flood the screen with meaningless logs that will obfuscate the context of the actual problem.
|
||||
Wireless ETW is incredibly verbose and calls out many innocuous errors (rather flagged behaviors that have little or nothing to do with the problem scenario). Searching for or filtering on "err", "error", and "fail" will seldom lead you to the root cause of a problematic Wi-Fi scenario. Instead it will flood the screen with meaningless logs that will obfuscate the context of the actual problem.
|
||||
|
||||
It is important to understand the different Wi-Fi components involved, their expected behaviors, and how the problem scenario deviates from those expected behaviors.
|
||||
It's important to understand the different Wi-Fi components involved, their expected behaviors, and how the problem scenario deviates from those expected behaviors.
|
||||
The intention of this troubleshooter is to show how to find a starting point in the verbosity of wireless_dbg ETW and home in on the responsible components that are causing the connection problem.
|
||||
|
||||
### Known Issues and fixes
|
||||
@ -57,14 +57,14 @@ Make sure that you install the latest Windows updates, cumulative updates, and r
|
||||
|
||||
## Data Collection
|
||||
|
||||
1. Network Capture with ETW. Enter the following at an elevated command prompt:
|
||||
1. Network Capture with ETW. Enter the following command at an elevated command prompt:
|
||||
|
||||
```console
|
||||
netsh trace start wireless_dbg capture=yes overwrite=yes maxsize=4096 tracefile=c:\tmp\wireless.etl
|
||||
```
|
||||
2. Reproduce the issue.
|
||||
- If there is a failure to establish connection, try to manually connect.
|
||||
- If it is intermittent but easily reproducible, try to manually connect until it fails. Record the time of each connection attempt, and whether it was a success or failure.
|
||||
- If there's a failure to establish connection, try to manually connect.
|
||||
- If it's intermittent but easily reproducible, try to manually connect until it fails. Record the time of each connection attempt, and whether it was a success or failure.
|
||||
- If the issue is intermittent but rare, netsh trace stop command needs to be triggered automatically (or at least alerted to admin quickly) to ensure trace doesn’t overwrite the repro data.
|
||||
- If intermittent connection drops trigger stop command on a script (ping or test network constantly until fail, then netsh trace stop).
|
||||
3. Stop the trace by entering the following command:
|
||||
@ -78,11 +78,11 @@ Make sure that you install the latest Windows updates, cumulative updates, and r
|
||||
netsh trace convert c:\tmp\wireless.etl
|
||||
```
|
||||
|
||||
See the [example ETW capture](#example-etw-capture) at the bottom of this article for an example of the command output. After running these commands, you will have three files: wireless.cab, wireless.etl, and wireless.txt.
|
||||
See the [example ETW capture](#example-etw-capture) at the bottom of this article for an example of the command output. After running these commands, you'll have three files: wireless.cab, wireless.etl, and wireless.txt.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
The following is a high-level view of the main wifi components in Windows.
|
||||
The following view is a high-level one of the main wifi components in Windows.
|
||||
|
||||
|Wi-fi Components|Description|
|
||||
|--- |--- |
|
||||
@ -116,7 +116,7 @@ Filtering the ETW trace with the [TextAnalysisTool](https://github.com/TextAnaly
|
||||
|
||||
Use the **FSM transition** trace filter to see the connection state machine. You can see [an example](#textanalysistool-example) of this filter applied in the TAT at the bottom of this page.
|
||||
|
||||
The following is an example of a good connection setup:
|
||||
An example of a good connection setup is:
|
||||
|
||||
```console
|
||||
44676 [2]0F24.1020::2018-09-17 10:22:14.658 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Disconnected to State: Reset
|
||||
@ -127,7 +127,7 @@ The following is an example of a good connection setup:
|
||||
49465 [2]0F24.17E0::2018-09-17 10:22:14.990 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Authenticating to State: Connected
|
||||
```
|
||||
|
||||
The following is an example of a failed connection setup:
|
||||
An example of a failed connection setup is:
|
||||
|
||||
```console
|
||||
44676 [2]0F24.1020::2018-09-17 10:22:14.658 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Disconnected to State: Reset
|
||||
@ -138,9 +138,9 @@ The following is an example of a failed connection setup:
|
||||
49465 [2]0F24.17E0::2018-09-17 10:22:14.990 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Authenticating to State: Roaming
|
||||
```
|
||||
|
||||
By identifying the state at which the connection fails, one can focus more specifically in the trace on logs just prior to the last known good state.
|
||||
By identifying the state at which the connection fails, one can focus more specifically in the trace on logs prior to the last known good state.
|
||||
|
||||
Examining **[Microsoft-Windows-WLAN-AutoConfig]** logs just prior to the bad state change should show evidence of error. Often, however, the error is propagated up through other wireless components.
|
||||
Examining **[Microsoft-Windows-WLAN-AutoConfig]** logs prior to the bad state change should show evidence of error. Often, however, the error is propagated up through other wireless components.
|
||||
In many cases the next component of interest will be the MSM, which lies just below Wlansvc.
|
||||
|
||||
The important components of the MSM include:
|
||||
@ -149,10 +149,10 @@ The important components of the MSM include:
|
||||
|
||||
|
||||
|
||||
Each of these components has their own individual state machines which follow specific transitions.
|
||||
Each of these components has its own individual state machines that follow specific transitions.
|
||||
Enable the **FSM transition, SecMgr Transition,** and **AuthMgr Transition** filters in TextAnalysisTool for more detail.
|
||||
|
||||
Continuing with the example above, the combined filters look like this:
|
||||
Further to the preceding example, the combined filters look like the following command example:
|
||||
|
||||
```console
|
||||
[2] 0C34.2FF0::08/28/17-13:24:28.693 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State:
|
||||
@ -177,7 +177,7 @@ Authenticating to State: Roaming
|
||||
> [!NOTE]
|
||||
> In the next to last line the SecMgr transition is suddenly deactivating:<br>
|
||||
>\[2\] 0C34.2FF0::08/28/17-13:24:29.7512788 \[Microsoft-Windows-WLAN-AutoConfig\]Port\[13\] Peer 8A:15:14:B6:25:10 SecMgr Transition DEACTIVATE (11) --> INACTIVE (1)<br><br>
|
||||
>This transition is what eventually propagates to the main connection state machine and causes the Authenticating phase to devolve to Roaming state. As before, it makes sense to focus on tracing just prior to this SecMgr behavior to determine the reason for the deactivation.
|
||||
>This transition is what eventually propagates to the main connection state machine and causes the Authenticating phase to devolve to Roaming state. As before, it makes sense to focus on tracing prior to this SecMgr behavior to determine the reason for the deactivation.
|
||||
|
||||
Enabling the **Microsoft-Windows-WLAN-AutoConfig** filter will show more detail leading to the DEACTIVATE transition:
|
||||
|
||||
@ -203,7 +203,7 @@ The trail backwards reveals a **Port Down** notification:
|
||||
|
||||
Port events indicate changes closer to the wireless hardware. The trail can be followed by continuing to see the origin of this indication.
|
||||
|
||||
Below, the MSM is the native wifi stack. These are Windows native wifi drivers which talk to the wifi miniport drivers. It is responsible for converting Wi-Fi (802.11) packets to 802.3 (Ethernet) so that TCPIP and other protocols and can use it.
|
||||
Below, the MSM is the native wifi stack. These drivers are Windows native wifi drivers that talk to the wifi miniport drivers. It's responsible for converting Wi-Fi (802.11) packets to 802.3 (Ethernet) so that TCPIP and other protocols and can use it.
|
||||
|
||||
Enable trace filter for **[Microsoft-Windows-NWifi]:**
|
||||
|
||||
@ -230,7 +230,7 @@ In the trace above, we see the line:
|
||||
[0]0000.0000::08/28/17-13:24:29.127 [Microsoft-Windows-NWiFi]DisAssoc: 0x8A1514B62510 Reason: 0x4
|
||||
```
|
||||
|
||||
This is followed by **PHY_STATE_CHANGE** and **PORT_DOWN** events due to a disassociate coming from the Access Point (AP), as an indication to deny the connection. This could be due to invalid credentials, connection parameters, loss of signal/roaming, and various other reasons for aborting a connection. The action here would be to examine the reason for the disassociate sent from the indicated AP MAC (8A:15:14:B6:25:10). This would be done by examining internal logging/tracing from the AP.
|
||||
This line is followed by **PHY_STATE_CHANGE** and **PORT_DOWN** events due to a disassociate coming from the Access Point (AP), as an indication to deny the connection. This denail could be due to invalid credentials, connection parameters, loss of signal/roaming, and various other reasons for aborting a connection. The action here would be to examine the reason for the disassociate sent from the indicated AP MAC (8A:15:14:B6:25:10). This action would be done by examining internal logging/tracing from the AP.
|
||||
|
||||
### Resources
|
||||
|
||||
|
||||
@ -31,11 +31,11 @@ From its release, Windows 10 has supported remote connections to PCs joined to A
|
||||
|
||||
## Set up
|
||||
|
||||
- Both PCs (local and remote) must be running Windows 10, version 1607 or later. Remote connections to an Azure AD-joined PC running earlier versions of Windows 10 are not supported.
|
||||
- Your local PC (where you are connecting from) must be either Azure AD-joined or Hybrid Azure AD-joined if using Windows 10, version 1607 and above, or [Azure AD registered](/azure/active-directory/devices/concept-azure-ad-register) if using Windows 10, version 2004 and above. Remote connections to an Azure AD-joined PC from an unjoined device or a non-Windows 10 device are not supported.
|
||||
- The local PC and remote PC must be in the same Azure AD tenant. Azure AD B2B guests are not supported for Remote desktop.
|
||||
- Both PCs (local and remote) must be running Windows 10, version 1607 or later. Remote connections to an Azure AD-joined PC running earlier versions of Windows 10 aren't supported.
|
||||
- Your local PC (where you're connecting from) must be either Azure AD-joined or Hybrid Azure AD-joined if using Windows 10, version 1607 and above, or [Azure AD registered](/azure/active-directory/devices/concept-azure-ad-register) if using Windows 10, version 2004 and above. Remote connections to an Azure AD-joined PC from an unjoined device or a non-Windows 10 device aren't supported.
|
||||
- The local PC and remote PC must be in the same Azure AD tenant. Azure AD B2B guests aren't supported for Remote desktop.
|
||||
|
||||
Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard), a new feature in Windows 10, version 1607, is turned off on the client PC you are using to connect to the remote PC.
|
||||
Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard), a new feature in Windows 10, version 1607, is turned off on the client PC you're using to connect to the remote PC.
|
||||
|
||||
- On the PC you want to connect to:
|
||||
|
||||
@ -45,7 +45,7 @@ Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-gu
|
||||
|
||||
|
||||
|
||||
3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no additional configuration is needed. To allow additional users or groups to connect to the PC, you must allow remote connections for the specified users or groups. Users can be added either manually or through MDM policies:
|
||||
3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no other configuration is needed. To allow more users or groups to connect to the PC, you must allow remote connections for the specified users or groups. Users can be added either manually or through MDM policies:
|
||||
|
||||
- Adding users manually
|
||||
|
||||
@ -55,14 +55,14 @@ Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-gu
|
||||
```
|
||||
where *the-UPN-attribute-of-your-user* is the name of the user profile in C:\Users\, which is created based on the DisplayName attribute in Azure AD.
|
||||
|
||||
In order to execute this PowerShell command you be a member of the local Administrators group. Otherwise, you'll get an error like this example:
|
||||
In order to execute this PowerShell command, you must be a member of the local Administrators group. Otherwise, you'll get an error like this example:
|
||||
- for cloud only user: "There is no such global user or group : *name*"
|
||||
- for synced user: "There is no such global user or group : *name*" </br>
|
||||
|
||||
> [!NOTE]
|
||||
> For devices running Windows 10, version 1703 or earlier, the user must sign in to the remote device first before attempting remote connections.
|
||||
>
|
||||
> Starting in Windows 10, version 1709, you can add other Azure AD users to the **Administrators** group on a device in **Settings** and restrict remote credentials to **Administrators**. If there is a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices.
|
||||
> Starting in Windows 10, version 1709, you can add other Azure AD users to the **Administrators** group on a device in **Settings** and restrict remote credentials to **Administrators**. If there's a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices.
|
||||
|
||||
- Adding users using policy
|
||||
|
||||
|
||||
@ -42,7 +42,7 @@ Use the following steps to collect wireless and wired logs on Windows and Window
|
||||
netsh trace start scenario=lan globallevel=0xff capture=yes maxsize=1024 tracefile=C:\MSLOG\%COMPUTERNAME%_wired_cli.etl
|
||||
```
|
||||
|
||||
3. Run the following command to enable CAPI2 logging and increase the size :
|
||||
3. Run the following command to enable CAPI2 logging and increase the size:
|
||||
```
|
||||
wevtutil.exe sl Microsoft-Windows-CAPI2/Operational /e:true
|
||||
wevtutil sl Microsoft-Windows-CAPI2/Operational /ms:104857600
|
||||
@ -70,7 +70,7 @@ Use the following steps to collect wireless and wired logs on Windows and Window
|
||||
netsh trace start scenario=lan globallevel=0xff capture=yes maxsize=1024 tracefile=C:\MSLOG\%COMPUTERNAME%_wired_nps.etl
|
||||
```
|
||||
|
||||
6. Run the following command to enable CAPI2 logging and increase the size :
|
||||
6. Run the following command to enable CAPI2 logging and increase the size:
|
||||
```
|
||||
wevtutil.exe sl Microsoft-Windows-CAPI2/Operational /e:true
|
||||
wevtutil sl Microsoft-Windows-CAPI2/Operational /ms:104857600
|
||||
@ -241,7 +241,7 @@ Use the following steps to collect wireless and wired logs on Windows and Window
|
||||
wevtutil epl Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational c:\MSLOG\%COMPUTERNAME%_CertificateServicesClient-CredentialRoaming_Operational.evtx
|
||||
wevtutil epl Microsoft-Windows-CertPoleEng/Operational c:\MSLOG\%COMPUTERNAME%_CertPoleEng_Operational.evtx
|
||||
```
|
||||
- Run the following 3 commands on Windows Server 2012 and later:
|
||||
- Run the following commands on Windows Server 2012 and later:
|
||||
|
||||
```
|
||||
wevtutil epl Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational c:\MSLOG\%COMPUTERNAME%_CertificateServicesClient-Lifecycle-System_Operational.evtx
|
||||
@ -320,7 +320,7 @@ Use the following steps to collect wireless and wired logs on Windows and Window
|
||||
wevtutil epl Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational c:\MSLOG\%COMPUTERNAME%_CertificateServicesClient-CredentialRoaming_Operational.evtx
|
||||
wevtutil epl Microsoft-Windows-CertPoleEng/Operational c:\MSLOG\%COMPUTERNAME%_CertPoleEng_Operational.evtx
|
||||
```
|
||||
- Run the following 3 lines on Windows 2012 and up
|
||||
- Run the following lines on Windows 2012 and up
|
||||
|
||||
```
|
||||
wevtutil epl Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational c:\MSLOG\%COMPUTERNAME%_CertificateServicesClient-Lifecycle-System_Operational.evtx
|
||||
@ -371,9 +371,9 @@ Use the following steps to collect wireless and wired logs on Windows and Window
|
||||
reg export HKLM\SOFTWARE\Microsoft\Cryptography c:\MSLOG\%COMPUTERNAME%_Cryptography.txt
|
||||
```
|
||||
3. Copy the following files, if exist, to C:\MSLOG: %windir%\CAPolicy.inf
|
||||
4. Log on to a domain controller and create C:\MSLOG to store captured logs.
|
||||
4. Sign in to a domain controller and create C:\MSLOG to store captured logs.
|
||||
5. Launch Windows PowerShell as an administrator.
|
||||
6. Run the following PowerShell cmdlets. Replace the domain name in ";.. ,DC=test,DC=local"; with appropriate domain name. The example shows commands for ";test.local"; domain.
|
||||
6. Run the following PowerShell cmdlets. Replace the domain name in ";.. ,DC=test,DC=local"; with appropriate domain name. The example shows commands for "; test.local"; domain.
|
||||
|
||||
```powershell
|
||||
Import-Module ActiveDirectory
|
||||
|
||||
@ -15,7 +15,7 @@ ms.collection: highpri
|
||||
|
||||
# How to determine the appropriate page file size for 64-bit versions of Windows
|
||||
|
||||
Page file sizing depends on the system crash dump setting requirements and the peak usage or expected peak usage of the system commit charge. Both considerations are unique to each system, even for systems that are identical. This means that page file sizing is also unique to each system and cannot be generalized.
|
||||
Page file sizing depends on the system crash dump setting requirements and the peak usage or expected peak usage of the system commit charge. Both considerations are unique to each system, even for systems that are identical. This uniqueness means that page file sizing is also unique to each system and can't be generalized.
|
||||
|
||||
## Determine the appropriate page file size
|
||||
|
||||
@ -23,17 +23,17 @@ Use the following considerations for page file sizing for all versions of Window
|
||||
|
||||
### Crash dump setting
|
||||
|
||||
If you want a crash dump file to be created during a system crash, a page file or a dedicated dump file must exist and be large enough to back up the system crash dump setting. Otherwise, a system memory dump file is not created.
|
||||
If you want a crash dump file to be created during a system crash, a page file or a dedicated dump file must exist and be large enough to back up the system crash dump setting. Otherwise, a system memory dump file isn't created.
|
||||
|
||||
For more information, see [Support for system crash dumps](introduction-page-file.md#support-for-system-crash-dumps) section.
|
||||
|
||||
### Peak system commit charge
|
||||
|
||||
The system commit charge cannot exceed the system commit limit. This limit is the sum of physical memory (RAM) and all page files combined. If no page files exist, the system commit limit is slightly less than the physical memory that is installed. Peak system-committed memory usage can vary greatly between systems. Therefore, physical memory and page file sizing also vary.
|
||||
The system commit charge can't exceed the system commit limit. This limit is the sum of physical memory (RAM) and all page files combined. If no page files exist, the system commit limit is slightly less than the physical memory that is installed. Peak system-committed memory usage can vary greatly between systems. Therefore, physical memory and page file sizing also vary.
|
||||
|
||||
### Quantity of infrequently accessed pages
|
||||
|
||||
The purpose of a page file is to *back* (support) infrequently accessed modified pages so that they can be removed from physical memory. This provides more available space for more frequently accessed pages. The "\Memory\Modified Page List Bytes" performance counter measures, in part, the number of infrequently accessed modified pages that are destined for the hard disk. However, be aware that not all the memory on the modified page list is written out to disk. Typically, several hundred megabytes of memory remains resident on the modified list. Therefore, consider extending or adding a page file if all the following conditions are true:
|
||||
The purpose of a page file is to *back* (support) infrequently accessed modified pages so that they can be removed from physical memory. This removal provides more available space for more frequently accessed pages. The "\Memory\Modified Page List Bytes" performance counter measures, in part, the number of infrequently accessed modified pages that are destined for the hard disk. However, not all the memory on the modified page list is written out to disk. Typically, several hundred megabytes of memory remains resident on the modified list. Therefore, consider extending or adding a page file if all the following conditions are true:
|
||||
|
||||
- More available physical memory (\Memory\Available MBytes) is required.
|
||||
|
||||
@ -43,7 +43,7 @@ The purpose of a page file is to *back* (support) infrequently accessed modified
|
||||
|
||||
## Support for system crash dumps
|
||||
|
||||
A system crash (also known as a “bug check” or a "Stop error") occurs when the system cannot run correctly. The dump file that is produced from this event is called a system crash dump. A page file or dedicated dump file is used to write a crash dump file (Memory.dmp) to disk. Therefore, a page file or a dedicated dump file must be large enough to support the kind of crash dump selected. Otherwise, the system cannot create the crash dump file.
|
||||
A system crash (also known as a “bug check” or a "Stop error") occurs when the system can't run correctly. The dump file that is produced from this event is called a system crash dump. A page file or dedicated dump file is used to write a crash dump file (Memory.dmp) to disk. Therefore, a page file or a dedicated dump file must be large enough to support the kind of crash dump selected. Otherwise, the system can't create the crash dump file.
|
||||
|
||||
>[!Note]
|
||||
>During startup, system-managed page files are sized respective to the system crash dump settings. This assumes that enough free disk space exists.
|
||||
@ -57,29 +57,29 @@ A system crash (also known as a “bug check” or a "Stop error") occurs when t
|
||||
|
||||
\* 1 MB of header data and device drivers can total 256 MB of secondary crash dump data.
|
||||
|
||||
The **Automatic memory dump** setting is enabled by default. This is a setting instead of a kind of crash dump. This setting automatically selects the best page file size, depending on the frequency of system crashes.
|
||||
The **Automatic memory dump** setting is enabled by default. This setting is an alternative to a kind of crash dump. This setting automatically selects the best page file size, depending on the frequency of system crashes.
|
||||
|
||||
The Automatic memory dump feature initially selects a small paging file size. It would accommodate the kernel memory most of the time. If the system crashes again within four weeks, the Automatic memory dump feature sets the page file size as either the RAM size or 32 GB, whichever is smaller.
|
||||
|
||||
Kernel memory crash dumps require enough page file space or dedicated dump file space to accommodate the kernel mode side of virtual memory usage. If the system crashes again within four weeks of the previous crash, a Complete memory dump is selected at restart. This requires a page file or dedicated dump file of at least the size of physical memory (RAM) plus 1 MB for header information plus 256 MB for potential driver data to support all the potential data that is dumped from memory. Again, the system-managed page file will be increased to back this kind of crash dump. If the system is configured to have a page file or a dedicated dump file of a specific size, make sure that the size is sufficient to back the crash dump setting that is listed in the table earlier in this section together with and the peak system commit charge.
|
||||
Kernel memory crash dumps require enough page file space or dedicated dump file space to accommodate the kernel mode side of virtual memory usage. If the system crashes again within four weeks of the previous crash, a Complete memory dump is selected at restart. This dump requires a page file or dedicated dump file of at least the size of physical memory (RAM) plus 1 MB for header information plus 256 MB for potential driver data to support all the potential data that is dumped from memory. Again, the system-managed page file will be increased to back this kind of crash dump. If the system is configured to have a page file or a dedicated dump file of a specific size, make sure that the size is sufficient to back the crash dump setting that is listed in the table earlier in this section together with and the peak system commit charge.
|
||||
|
||||
### Dedicated dump files
|
||||
|
||||
Computers that are running Microsoft Windows or Microsoft Windows Server usually must have a page file to support a system crash dump. System administrators now have the option to create a dedicated dump file instead.
|
||||
Computers that are running Microsoft Windows or Microsoft Windows Server usually must have a page file to support a system crash dump. System administrators can now create a dedicated dump file instead.
|
||||
|
||||
A dedicated dump file is a page file that is not used for paging. Instead, it is “dedicated” to back a system crash dump file (Memory.dmp) when a system crash occurs. Dedicated dump files can be put on any disk volume that can support a page file. We recommend that you use a dedicated dump file if you want a system crash dump but you do not want a page file. To learn how to create it, see [Overview of memory dump file options for Windows](/troubleshoot/windows-server/performance/memory-dump-file-options).
|
||||
A dedicated dump file is a page file that isn't used for paging. Instead, it is “dedicated” to back a system crash dump file (Memory.dmp) when a system crash occurs. Dedicated dump files can be put on any disk volume that can support a page file. We recommend that you use a dedicated dump file if you want a system crash dump but you don't want a page file. To learn how to create it, see [Overview of memory dump file options for Windows](/troubleshoot/windows-server/performance/memory-dump-file-options).
|
||||
|
||||
## System-managed page files
|
||||
|
||||
By default, page files are system-managed. This means that the page files increase and decrease based on many factors, such as the amount of physical memory installed, the process of accommodating the system commit charge, and the process of accommodating a system crash dump.
|
||||
By default, page files are system-managed. This system management means that the page files increase and decrease based on many factors, such as the amount of physical memory installed, the process of accommodating the system commit charge, and the process of accommodating a system crash dump.
|
||||
|
||||
For example, when the system commit charge is more than 90 percent of the system commit limit, the page file is increased to back it. This continues to occur until the page file reaches three times the size of physical memory or 4 GB, whichever is larger. This all assumes that the logical disk that is hosting the page file is large enough to accommodate the growth.
|
||||
For example, when the system commit charge is more than 90 percent of the system commit limit, the page file is increased to back it. This surge continues to occur until the page file reaches three times the size of physical memory or 4 GB, whichever is larger. Therefore, it's assumes that the logical disk that is hosting the page file is large enough to accommodate the growth.
|
||||
|
||||
The following table lists the minimum and maximum page file sizes of system-managed page files in Windows 10 and Windows 11.
|
||||
|
||||
|Minimum page file size |Maximum page file size|
|
||||
|---------------|------------------|
|
||||
|Varies based on page file usage history, amount of RAM (RAM ÷ 8, max 32 GB) and crash dump settings. |3 × RAM or 4 GB, whichever is larger. This is then limited to the volume size ÷ 8. However, it can grow to within 1 GB of free space on the volume if required for crash dump settings.|
|
||||
|Varies based on page file usage history, amount of RAM (RAM ÷ 8, max 32 GB) and crash dump settings. |3 × RAM or 4 GB, whichever is larger. This size is then limited to the volume size ÷ 8. However, it can grow to within 1 GB of free space on the volume if necessary for crash dump settings.|
|
||||
|
||||
## Performance counters
|
||||
|
||||
@ -87,7 +87,7 @@ Several performance counters are related to page files. This section describes t
|
||||
|
||||
### \Memory\Page/sec and other hard page fault counters
|
||||
|
||||
The following performance counters measure hard page faults (which include, but are not limited to, page file reads):
|
||||
The following performance counters measure hard page faults (which include, but aren't limited to, page file reads):
|
||||
|
||||
- \Memory\Page/sec
|
||||
|
||||
@ -103,7 +103,7 @@ The following performance counters measure page file writes:
|
||||
|
||||
Hard page faults are faults that must be resolved by retrieving the data from disk. Such data can include portions of DLLs, .exe files, memory-mapped files, and page files. These faults might or might not be related to a page file or to a low-memory condition. Hard page faults are a standard function of the operating system. They occur when the following items are read:
|
||||
|
||||
- Parts of image files (.dll and .exe files) as they are used
|
||||
- Parts of image files (.dll and .exe files) as they're used
|
||||
|
||||
- Memory-mapped files
|
||||
|
||||
@ -111,11 +111,11 @@ Hard page faults are faults that must be resolved by retrieving the data from di
|
||||
|
||||
High values for these counters (excessive paging) indicate disk access of generally 4 KB per page fault on x86 and x64 versions of Windows and Windows Server. This disk access might or might not be related to page file activity but may contribute to poor disk performance that can cause system-wide delays if the related disks are overwhelmed.
|
||||
|
||||
Therefore, we recommend that you monitor the disk performance of the logical disks that host a page file in correlation with these counters. Be aware that a system that has a sustained 100 hard page faults per second experiences 400 KB per second disk transfers. Most 7,200 RPM disk drives can handle about 5 MB per second at an IO size of 16 KB or 800 KB per second at an IO size of 4 KB. No performance counter directly measures which logical disk the hard page faults are resolved for.
|
||||
Therefore, we recommend that you monitor the disk performance of the logical disks that host a page file in correlation with these counters. A system that has a sustained 100 hard page faults per second experiences 400 KB per second disk transfers. Most 7,200-RPM disk drives can handle about 5 MB per second at an IO size of 16 KB or 800 KB per second at an IO size of 4 KB. No performance counter directly measures which logical disk the hard page faults are resolved for.
|
||||
|
||||
### \Paging File(*)\% Usage
|
||||
|
||||
The \Paging File(*)\% Usage performance counter measures the percentage of usage of each page file. 100 percent usage of a page file does not indicate a performance problem as long as the system commit limit is not reached by the system commit charge, and if a significant amount of memory is not waiting to be written to a page file.
|
||||
The \Paging File(*)\% Usage performance counter measures the percentage of usage of each page file. 100 percent usage of a page file doesn't indicate a performance problem as long as the system commit limit isn't reached by the system commit charge, and if a significant amount of memory isn't waiting to be written to a page file.
|
||||
|
||||
>[!Note]
|
||||
>The size of the Modified Page List (\Memory\Modified Page List Bytes) is the total of modified data that is waiting to be written to disk.
|
||||
@ -127,4 +127,4 @@ If the Modified Page List (a list of physical memory pages that are the least fr
|
||||
|
||||
## Multiple page files and disk considerations
|
||||
|
||||
If a system is configured to have more than one page files, the page file that responds first is the one that is used. This means that page files that are on faster disks are used more frequently. Also, whether you put a page file on a “fast” or “slow” disk is important only if the page file is frequently accessed and if the disk that is hosting the respective page file is overwhelmed. Be aware that actual page file usage depends greatly on the amount of modified memory that the system is managing. This means that files that already exist on disk (such as .txt, .doc, .dll, and .exe) are not written to a page file. Only modified data that does not already exist on disk (for example, unsaved text in Notepad) is memory that could potentially be backed by a page file. After the unsaved data is saved to disk as a file, it is backed by the disk and not by a page file.
|
||||
If a system is configured to have more than one page files, the page file that responds first is the one that is used. This customized configuration means that page files that are on faster disks are used more frequently. Also, whether you put a page file on a “fast” or “slow” disk is important only if the page file is frequently accessed and if the disk that is hosting the respective page file is overwhelmed. Actual page file usage depends greatly on the amount of modified memory that the system is managing. This dependency means that files that already exist on disk (such as .txt, .doc, .dll, and .exe) aren't written to a page file. Only modified data that doesn't already exist on disk (for example, unsaved text in Notepad) is memory that could potentially be backed by a page file. After the unsaved data is saved to disk as a file, it's backed by the disk and not by a page file.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user