Last Updated on April 16, 2017 by Dave Farquhar
The bane of the NT administrator’s existence banished. I had a problem last week with a user who was complaining about lockups. I went and looked at the system, and it turned out not to be lockups at all–the system was running out of CPU cycles, so it appeared to lock up, but if you let it sit long enough, it would recover. The system had so many user-installed toys, such as Webshots and Weatherbug and RealAudio and RealJukebox, that it didn’t have enough punch left to do real work. I disabled the toys, to many objections, and told the user to call me if the system had any more problems. I told her that yeah, the way I set up computers is drab and boring and utilitarian, but they work.
Supposedly Windows NT won’t allow regular users to install software. In reality, they can install a lot.
Here’s the trick. Open regedt32 (not regedit) and navigate to HKLMSoftwareMicrosoftWindowsCurrentVersionRun. Go to Security. The All Users group has special access. Change that to read-only access.
We did that at work on one machine, then logged in with a non-priveliged account, and we must have been the first people in history who had problems installing Webshots and Weatherbug.
Some programs may install anyway, though they fail to write the run key. But in order for them to start up, the user will have to drag the executable to their personal startup group. Most of the users who install this garbage don’t know how to do that.
Hard drive first aid. I had an external Mac SCSI hard drive that was acting up. I was able to get it to run once, for about 5 minutes. From then on, when you powered up, it would just seek incessantly. Stiction, I hoped–though it’s unusual for stiction to set in while a drive is actually running. I shut it down and let it rest. No improvement.
My normal cure for stiction is to blow-dry it to heat it up above operating temperature to loosen the oil. Lacking a blow dryer, I resorted to something I really don’t like to do. Well, since this was a Mac peripheral, I didn’t really care. And I made a pretty big show of it. I held the drive about six inches off the floor. “I’m gonna do it!” I said. My coworkers looked up. I released the drive, sending it hurtling to the floor. The force of the impact knocked the front of the enclosure loose.
“You’re recalibrating it?” someone asked.
I grinned, picked up the drive, snapped the front cover back on, and plugged it in. The drive ran. I copied the data off to another drive. It was a bit slow–this isn’t a healthy drive–but it copied. And the drive ran all day, to my amazement.
Incoming links: http://gsw.edu/~oiit/techsupp/software.html
David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.
Although I do not agree with dropping a drive(!) I did have a Mac that would not start up from the hard disk, though it would from floppy and CD. Norton wouldn’t do anything (just refused to recognise drive other than display a SCSI icon for it) so stiction I thought. I removed the cover. I could see the HD light flickering so it was trying to get going, gave the HD a sharp tap with a pair of scissors, at the side. Ah! It started to boot! Needless to say, quick CD copy of everything!
Thanks for the reassurance to give this a thump!
Dropping a drive definitely should be considered a last-resort desperation tactic, but it’s something that even IBM field service technicians sometimes resort to.
And of course, the next step after resorting to that tactic is to back up the drive and replace it.
That particular drive actually ran for another couple of months before it died again. I connected it up to a PC and reformatted it and used it for a while. When it started acting up again though, I added it to my pile of questionable drives.
>>>added it to my pile of questionable drives.