The Heartbeat of Windows

Windows has a heartbeat!  Yes, it’s true!  How can this be?  Windows is not exciting for most admins when things are running normally (and the excitement over a new BSOD is much much overrated.)
 
Windows servers (and desktops) have a registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\TimeStampInterval.
This is a DWORD and the default is 5 for servers and 0 for workstations (XP, Win2K Pro, etc.)
 
When set, Windows writes a timestamp to the registry every 5 seconds (or, presumably, for whatever the DWORD is set to.)  A value of 0 disables it.
 
With this entry set, if the computer bluescreens or you pull the plug, Windows uses the timestamp to determine that the last shutdown was unexpected, and its approximate time.  See the following registry entry from my very sick workstation after one of its many bluescreens:
 
Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6008
Date:  6/3/2006
Time:  1:06:47 PM
User:  N/A
Computer: WAKKO
Description:
The previous system shutdown at 1:02:58 PM on 6/3/2006 was unexpected.
 
The UPTIME.EXE utility I posted about previously will set the heartbeat.  Simply do uptime /heartbeat and follow the prompts to turn it on or off.
 
Take care,
 
Dave
 
Advertisements


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s