Microsoft Product Support Reporting Tool - Alliance Edition =========================================================== Version: v5.0.1.0 Build Date: 8/26/2004 PURPOSE ======= The MPS Reporting Tool is utilized to gather detailed system status and configuration information. The data collected will assist the Microsoft Support Professional with fault isolation. NOTE: You may install and use an unlimited number of copies of MPSRPT_Alliance_X86.EXE solely for the purpose of gathering system information necessary for Microsoft Product Support Services to provide you with technical support services requested by you. All other purposes are not supported by Microsoft. Please refer to the EULA for more detailed information regarding your usage rights. INSTALLATION ============ The MPS Reporting Tool is self-installing and will run on Windows NT 4.0, Windows 2000, and both 32-bit and 64-bit versions of Windows XP and Windows 2003. Every time you run MPSRPT_Alliance_X86.EXE it will install itself, overwriting the previous installation, then call MPSRpt.cmd to gather the reports. Use the /Q option to install the Tool without running the report. MPSRPT_Alliance_X86.EXE /Q This if functionally the same as running the following command: MPSRPT_Alliance_X86.EXE /C:"cmd /c Setup.cmd /I" The reporting tool DOES NOT make any registry changes or modifications to the operating system. Since no changes are made to the system, it is possible to just copy the contents of the MPSReports folder tree located in %SYSTEMROOT% to the %SYSTEMROOT% folder of another system. ALTERNATE INSTALLATION PATH =========================== It is now possible to instruct MPS Reports to be installed to an alternate location (eg. other than %SYSTEMROOT%). This is especially useful if your system drive is low on available disk space. The /P option has been added to the Setup.cmd script to allow you to specify an alternate location. This folder must exist. The MPS Reporting tool will not create it. The folder specified becomes new new root folder for the MPSReports folder tree. All of the data collected will also be logged to this location. The following example illustrates how to use the /P option: MPSRPT_Alliance_X86.EXE /C:"cmd /c Setup.cmd /P D:\data" This results in the the MPSReports folder being created as a subfolder of D:\data. This alternate installation path is recorded in the MPSRPT.CMD script. Therefore, it is possible to run the MPSRPT.CMD script from the alternate location and expect that all data will be logged to that same alternate location. Please see the section for PACKAGE CONTENTS and DIRECTORY STRUCTURE for details on what is copied to the system and what directories are made. USAGE ===== The Tool has two reporting modes: LITE (default) and FULL. Either mode can be run with the /Q Quiet-option. The Quiet-option reduces the amount of user interaction with the Tool. LITE Mode --------- Executing MPSRPT_Alliance_X86.EXE with no command-line options runs the Tool in LITE reporting mode. Examples: MPSRPT_Alliance_X86.EXE MPSRPT_Alliance_X86.EXE /C:"cmd /c Setup.cmd /Q" FULL Mode --------- FULL mode can take an extended period of time to gathering information and should only be run when directed by a Microsoft Support Professional. Examples: MPSRPT_Alliance_X86.EXE /C:"cmd /c Setup.cmd /F" MPSRPT_Alliance_X86.EXE /C:"cmd /c Setup.cmd /F /Q" The above examples show how to install the tool and run the reports with the options FULL reporting and Quiet mode. The default behavior (using no command-line options) is Lite reporting in Verbose mode. If the Tool is already installed, you can execute the MPSRpt.cmd batch file from the Bin folder. Examples: MPSRpt.cmd MPSRpt.cmd /F MPSRpt.cmd /F /Q MPSRpt.cmd /Q For your convenience CAB file containing all of the reports will be created. Please send the cab file to the Microsoft Support Professional who is working on your support incident. Each time your run the Tool it will overwrite any existing report files. However, a new CAB file will be created. If you need to look at an older report you can extract it from the old CAB file. NOTES ===== As the MPS Reporting Tool runs it will display the name of the executable that is currently running to gather the required information. If you suspect that the process is hung or is creating an extremely negative impact on system performance you can kill the currently running utility using Task Manager. Open Task Manager and select the Processes Tab. Locate the name of the executable in the Image Name column, select it and click the End Process button. To locate executable more easily, sort the Image Name column alphabetically by clicking on the column header. If there are multiple instances of a tool running you may need to kill all instances. The instance with the highest Process ID (PID) number is probably the one associated with the running instance of MPS Reports. Problems of hanging utilities are most often reported for MSINFO32.EXE, DUMPEL.EXE and GETEVENTS.VBS. The problems with MSINFO32.EXE are usually related to bugs in WMI. Microsoft has several updates available for WMI components that may resolve this problem. This can also be caused by third-party WMI components. The DUMPEL.EXE and GETEVENTS.VBS utilities are used to get event log in CSV format. These can appear to be hung on systems with very large event logs. It is important that you try to let these complete so that important information is not omitted from the results. Average completion times for the MPS Reporting Tool Lite Mode are in the range of 5 to 15 minutes. If for some reason the data collection process is not completing try running the tool during non-peak usage times. FULL Mode should only be run during non-peak usage times or on systems that are not under heavy load. To ensure that all of the data is collected properly, the user running the MPS Reporting Tool must have Administrative rights on the system. If you have any questions regarding the usage or operations of the Tool, consult with your Microsoft Support Professional. Note on 64-bit systems ---------------------- The 64-bit versions of the tool package will be named MPSRPT_Alliance_IA64.EXE or MPSRPT_Alliance_AMD64.EXE. These are designed to run on the Intel Itanium and AMD Opteron platforms, respectively. The MPSRPT_Alliance_X86.EXE package is a 32-bit package and will run, with errors, on a 64-bit platform. The IA64 package will not run on an AMD64 platform. The AMD64 package will not run on an IA64 platform. For best results, run the package that matches the targeted platform. If you are unsure which processor a system uses you can inspect the processor-related environment variables by issuing the following command in a command window: C:\>set proc PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 0 Stepping 10, GenuineIntel PROCESSOR_LEVEL=15 PROCESSOR_REVISION=000a This example shows the output on an Intel x86-based computer system. Running MPS Reports as a scheduled job -------------------------------------- MPS Reports can be run as a scheduled job. It should be run in QUIET mode to prevent extraneous user interface windows from being invoked. Use one of the following example command-lines when scheduling the job: MPSRpt.cmd /Q MPSRPT_Alliance_X86.EXE /Q /C:"cmd /c Setup.cmd /Q" MPSRpt.cmd /F /Q MPSRPT_Alliance_X86.EXE /Q /C:"cmd /c Setup.cmd /F /Q" Here is an example use the AT command to schedule MPS Reports: AT 1:00am %SystemRoot%\MPSReports\Alliance\bin\MPSRpt.cmd /Q DIRECTORY STRUCTURE =================== %SystemRoot% Example - C:\WINNT \MPSReports MPS Reports root folder - can contain many support specific versions \Alliance Report output folder for the Alliance Edition of MPS Reports \Bin Tools folder - non-version specific \AMD64 Folder for AMD64-based tools \IA64 Folder for Intel IA64-based tools \x86 Folder for Intel I386-based tools \1381 Windows NT specific tools \2195 Windows 2000 specific tools \2600 Windows XP specific tools \Cab Output folder for the CAB files \Doc Folder containing Readme and other files PACKAGE CONTENTS ================ To conserve space, each MPSRPT_Alliance_xxxx.EXE package (X86, AMD64 and IA64) will contain only the files that may be used on that platform. This package contains the Setup script and the appropriate Tools installer. File Size Date Version -------------------- --------- ---------- ------------ MPSTools_amd64.exe 320,811 08/17/2004 5.1.2600.0 MPSTools_ia64.exe 382,794 08/26/2004 5.1.2600.0 MPSTools_x86.exe 507,697 08/27/2004 5.1.2600.0 Setup.cmd 5,885 08/17/2004 5.0 Each Tools installer package contains only the files that may be required to run on that package's specific platform. The table below indicates which files ship in each package. The sizes of the MPSTools packages listed above are approximate (+/- 20 bytes). MPSTools_xxxx.exe CONTENTS ========================== Included in Package File Size Date Version X86 AMD64 IA64 -------------------- --------- ---------- ------------ --- ----- ---- bin\enumprndrv.vbs 6,791 07/06/2004 1.0 Y Y Y bin\getevents.vbs 4,536 04/13/2004 1.0 Y Y Y bin\mpsrpt.cmd 64,705 08/17/2004 5.0.0.0 Y Y Y bin\amd64\checksym.exe 194,048 03/15/2004 6.0.4067.0 N Y N bin\amd64\qfecheck.exe 49,664 03/22/2004 6.1.0.0 N Y N bin\ia64\checksym.exe 348,672 11/06/2003 6.0.4053.0 N N Y bin\ia64\qfecheck.exe 89,600 03/22/2004 6.1.0.0 N N Y bin\x86\checksym.exe 233,472 11/06/2003 2.5.0.0 Y N N bin\x86\Clusmps.exe 245,815 03/17/2004 Y Y Y bin\x86\dumpevt.exe 28,672 03/05/2004 Y Y Y bin\x86\oeminbox.exe 110,592 10/19/2001 Y N N bin\x86\qfecheck.exe 35,840 03/22/2004 6.1.0.0 Y N N bin\x86\rpcdump.exe 90,159 07/07/2003 Y Y Y bin\x86\2600\pstat.exe 8,704 08/17/2001 5.1.2600.0 Y Y Y bin\x86\2195\pstat.exe 9,488 12/01/1999 5.0.2134.1 Y N N bin\x86\2195\reg.exe 49,424 09/25/1999 2.0.0.0 Y N N bin\x86\1381\dumpel.exe 53,248 05/22/2002 6.0.2600.1 Y N N bin\x86\1381\makecab.exe 81,168 11/30/1999 5.0.2147.1 Y N N bin\x86\1381\psapi.dll 17,680 09/18/1997 5.0.1641.1 Y N N bin\x86\1381\pstat.exe 43,792 08/08/1996 4.0.1371.1 Y N N bin\x86\1381\reg.exe 56,080 07/12/1998 Y N N Documentation Description -------------------- ------------------------------------------------ Doc\CHECKSYM.TXT Documentation for CheckSym.exe Doc\EULA.TXT End-User License Agreement Doc\Readme.txt Documentation for MPS Reporting tool (this file) Report files created in LITE mode ================================= Event logs - The event logs are captured in both native and CSV format to allow analysis by different tools. %COMPUTERNAME%_Application.evt %COMPUTERNAME%_System.evt %COMPUTERNAME%_EventApplication.CSV %COMPUTERNAME%_EventSystem.CSV The following event logs are only created on Windows 2000 or later and only if the specific service is installed. %COMPUTERNAME%_Directory_Service.evt %COMPUTERNAME%_DNS_Server.evt %COMPUTERNAME%_File_Replication_Service.evt %COMPUTERNAME%_EventDirectory Service.CSV %COMPUTERNAME%_EventDNS Server.CSV %COMPUTERNAME%_EventFile Replication Service.CSV Other event log files created by third party applications are captured in both EVT and CSV format with a similar naming structure as shown above. Scheduled Job information - information from both the AT Scheduler and the Task Scheduler %COMPUTERNAME%_SCHEDULE.[CSV/TXT] %COMPUTERNAME%_SCHEDLGU.TXT System Startup and Crash Recovery data - copies of the BOOT.INI, Autoexec.NT and Config.NT are collected as well as the registry settings that control application and system crash handling %COMPUTERNAME%_BOOT_INI.TXT %COMPUTERNAME%_CONFIG_AUTO.TXT %COMPUTERNAME%_RECOVERY.TXT %COMPUTERNAME%_DRWTSN32.TXT - summary of entries in Dr Watson log file Cluster Information - gathers information about MSCS and WLBS if these services are configured on the system. %COMPUTERNAME%_WLBS.TXT - configuration of the Windows Load Balancing Service %COMPUTERNAME%_CLUSTERINFO.TXT - configuration state and resource information from CLUSTER.EXE %Computername%_Cluster_MPS_Information.txt - Alliance configuration information from Clusinfo.exe %COMPUTERNAME%_CLUSTER_REGISTRY.HIV - Cluster service registry hive %COMPUTERNAME%_CLUSTERFILES.[CSV/TXT] - file version information for Cluster Service binaries %COMPUTERNAME%_CLUSTER.LOG - cluster log file %COMPUTERNAME%_CLUSTER_CLCFGSRV.LOG - ClCfgSrv.log file %COMPUTERNAME%_CLUSTER_OBJ.TXT - cluster.obj file %COMPUTERNAME%_CLUSTER_OML.TXT - cluster.oml file %COMPUTERNAME%_CLUSTER_CHKDSK*.LOG - copy of all cluster chkdsk logs System service configuration and trace settings - registry settings for key system components %COMPUTERNAME%_TRACING.TXT - Settings for LSA, Winlogon, Netlogon, NTDS, NTFRS, RAS and other misc. settings. %COMPUTERNAME%_IPSEC.TXT - Settings for IPSEC (Windows 2000 or later only) Hotfix information - information about hotfix install history %COMPUTERNAME%_HOTFIX.TXT System Diagnostics - output from the Windows diagnotics tools %COMPUTERNAME%_MSINFO32.NFO - Windows 2000 or later diagnotics report %COMPUTERNAME%_WINMSD.TXT - Windows NT 4.0 diagnostics report %COMPUTERNAME%_SYSINFO.TXT - Windows XP/.NET system information %COMPUTERNAME%_PSTAT.TXT - Process Status output show some performance data for the running processes Network configuration - various network configuration and current state information %COMPUTERNAME%_NETINFO.TXT %COMPUTERNAME%_MISC.TXT Printer configuration - inventory and configuration of installed printer drivers %COMPUTERNAME%_PRINTDRIVERS.TXT - installed driver report from OEMINBOX.EXE %COMPUTERNAME%_ENUMPRNDRV.TXT - installed driver report using WMI %COMPUTERNAME%_PRINTKEY.TXT - Print Spooler registry hive %COMPUTERNAME%_SPOOL.[CSV/TXT] - print driver file infirmation Terminal Server data - lists of users, processes and connections available on a Terminal Server %COMPUTERNAME%_TERMSERV.TXT Process Information - inventory of the currently running processes and device drivers on the system %COMPUTERNAME%_PROCESS.[CSV/TXT] %COMPUTERNAME%_DRIVERS.[CSV/TXT] System File Information - subset inventory of the most important system files %COMPUTERNAME%_IEFILES.[CSV/TXT] %COMPUTERNAME%_SYSTEM32.[CSV/TXT] %COMPUTERNAME%_SYSROOT.[CSV/TXT] - inventory of %SYSTEMROOT% BackOffice File Information - inventory of the BackOffice applications installed on the system %COMPUTERNAME%_EXCH.[CSV/TXT] - Exchange files %COMPUTERNAME%_EXCHREG.TXT - Exchange registry keys %COMPUTERNAME%_IIS.[CSV/TXT] - Internet Information Server files %COMPUTERNAME%_ISA.[CSV/TXT] - Internet Security & Accelleration Server file %COMPUTERNAME%_SMS.[CSV/TXT] - Systems Management Server files %COMPUTERNAME%_SNA.[CSV/TXT] - SNA/Host Interagration Server files %COMPUTERNAME%_SQL.[CSV/TXT] - SQL Server files %COMPUTERNAME%_SQLREG.TXT - SQL Server registry keys Microsoft Office File Information - inventory of the Office applications installed on the system %COMPUTERNAME%_MSOFFICE.CSV Setup log files - Log files created by various component installers %COMPUTERNAME%_SETUPACT.LOG - Windows setup actions log %COMPUTERNAME%_SETUPAPI.LOG - Windows setup API log %COMPUTERNAME%_SETUPERR.LOG - Windows setup error log %COMPUTERNAME%_SVCPack.log - Service Pack installation log %COMPUTERNAME%_dahotfix.log - MDAC hotfix installation log %COMPUTERNAME%_Q*.log - hotfix installation logs %COMPUTERNAME%_KB*.log - hotfix installation logs %COMPUTERNAME%_DCPROMO*.log - DCPromo logs %COMPUTERNAME%_SURVEY.TXT - Compaq/HP Surveyor log Internet Explorer Information - log files and registry settings for IE %COMPUTERNAME%_IESETUPLOG.TXT - Installation log %COMPUTERNAME%_IEBRNDLOG.TXT - Branding log %COMPUTERNAME%_IEPOLICYREG.TXT - Dump of policy registry keys for IE %COMPUTERNAME%_Signup.Log - ISP signup log %COMPUTERNAME%_Install.ins - Custom installation log Report files created in FULL Mode ================================= FULL Mode creates all of the reports in Lite Mode and adds the following extra reports: System File Information - inventory of all application files %COMPUTERNAME%_PROGFILES.[CSV/TXT] - inventory of the %ProgramFiles% folder %COMPUTERNAME%_PROGFILESx86.[CSV/TXT] - inventory of the %ProgramFiles(x86)% folder on 64-bit machines Security Event logs - captured in both native and CSV format to allow analysis by different tools %COMPUTERNAME%_Security.evt %COMPUTERNAME%_EventSecurity.CSV Other files created =================== Progress Report - log file showing the progress of the Tool. Used by the Microsoft Support Professional to debug problems running the Tool %COMPUTERNAME%_PROGRESS.TXT CAB files - Cabinet file containing all of the reports CABDIRECT.[DDF/TXT] - used to create the CAB file - deleted after CAB is created CABERRORS_%DATETIME%.TXT - deleted if no errors occurred during CAB creation %COMPUTERNAME%_MPSReports_%DATETIME%.CAB HISTORY ======= Version Changes 5.0.1.0 - Minor bug fix - Setup.cmd fails if CMD Autorun regkey changed the starting directory Added option to install and run from alternate folder Added NET START output to MISC.TXT 5.0.0.0 - Major version update Added Support for 64-bit platforms - Added 64-bit versions of QFECheck.exe and Checksym.exe - Inventory of ProgramFiles(x86) folder - Inventory of SysWOW64 folder - optimized tools cab by removing tools not needed based on processor architecture Added ENUMPRNDRV.VBS to get print driver information New version of DumpEVT.exe that supports skipping specific logs Added GETEVENTS.VBS to get CSV format event logs Fixed bug where W32Time registry dump was overwritten Added collection of DCPromo logs Added DrWtsn32.log summary file Moved most checksym data out of FULL mode into LITE mode Added Control key to RECOVERY.TXT report Replaced CLUSINFO.EXE with updated CLUSMPS.EXE Added more logging for file copy operations 4.8.1.0 - Updated Readme.txt to include more examples 4.8.0.0 - Collect Security Event log as CSV only in FULL mode Added /n option to NET CONFIG commands for better error handling IE Configuration data collection Collecting hotfix and SP installation log files Updated Checksym.EXE to v2.5.0.0 Updated DumpEVT.EXE Updated OEMInbox.exe Minor edits to README.TXT 4.7.0.4 - Updated Readme to refer to EULA Updated RPCDUMP.EXE to v1.1 Dumping TCP/IP regkey 4.7.0.3 - Minor bug fix - Checksym of Office files would overwrite SQL txt report Added registry dump of SQL Server keys 4.7.0.2 - Renamed to "Alliance" for web publication 4.7.0.1 - Renamed to "General" for web publication 4.7.0.0 - Now running Eventquery.vbs instead of DUMPEL on build 2600+ Minor changes to make it Windows 2003 compatible Added EXE name to progress report per customer request 4.6.0.0 - Clusmps replaced by ClusInfo - New version of Checksym with no DLL dependencies 4.5.4.0 - Added new cluster tool - collecting setup*.log files - improved Event log CSV dump code 4.5.3.0 - Cleaned up registry dumps - added PSTAT back to get some basic performance data - Updated Checksym to v2.2.7.0 - Running IPSECCMD for Windows XP/.NET 4.5.2.0 - Added Exchange registry dump - Added Terminal Server registry dump 4.5.1.0 - Added WLBS to cluster section - Added IPSec info gathering - Now deleting report files after CAB creation - Updated to Checksym.exe v2.2.4.0 - Added rpcdump - minor cleanups 4.4.1.0 - added many new registry queries - consolidated some report files 4.3.1.1 - Refreshed some binaries 4.3.1.0 - Refreshed some binaries removed unneeded Checksym support DLLs Minor syntax improvements 4.2.1.1 - Refreshed some binaries Reordered some actions 4.2.1.0 - Added Cluster info Fixed some output formatting issues 4.1.1.0 - Added quiet and install modes Bugfix querying hotfix registry 4.0.1.0 - Total rewrite Now support Windows NT 4.0, Windows 2000, and Windows XP Uses newest version of Checksym and other tools 3.0 - Integrated tool for Windows 2000 and Windows NT 4.0. Added reporting modes LITE and FULL. 2.0 - Switched from ZIP packaging to IEXPRESS packaging. Switched from FILEVER.EXE to CHECKSYM.EXE to gather file information. 1.0 - Initial version