Windows Explored

Everyday Windows Desktop Support, Advanced Troubleshooting & Other OS Tidbits

Posts Tagged ‘Process Monitor’

Unraveling and Resolving An Outlook Crash with Process Monitor

Posted by William Diaz on March 2, 2012

While trying to import documents into our document management system via Outlook, Outlook would just abruptly close on the user. I started the initial troubleshooting by disabling a couple 3rd party add-ins in HKLM and HKCU\Software\Microsoft\Office\Outlook\Addins that were not part of the normal image. This can be done by modifying the load behavior of the add-in (see this MSDN article for details), but this had no effect on correcting the behavior. I thought about capturing a crash dump of Outlook but decided to not waste any time there because, at this point, with the add-ins disabled, I likely was not going to see anything but the document management modules in the dump.

Instead, I turned to Process Monitor; perhaps it might reveal what Outlook was doing just before it crashed and give me some important clues. I set a filter to monitor only outlook.exe, dragged an item into the document management space in Outlook and waited for it to crash after clicking Save. Afterwards, I scrolled to end of the log, working my way up. I also added a filter to only include registry activity and then process and thread activity so I could quickly see where Outlook was crashing: Read the rest of this entry »


Posted in Office, Troubleshooting | Tagged: , , | Leave a Comment »

The Case of the Missing Visio Menu Bar

Posted by William Diaz on March 1, 2012

When opening Visio, the user didn’t see the common Menu Bar one normally see in Microsoft Office products before 2007. The menu bar contains the literal menu options like File, Edit, View, Insert, so on. There was also the presence of a 3rd party toolbar that didn’t look like it was properly functioning:
Perhaps the Menu bar was disabled. This can be checked by right-clicking in the menu bar area and selecting Customize, then Toolbars.
Read the rest of this entry »

Posted in Office, Troubleshooting, Troubleshooting Tools | Tagged: | 1 Comment »

Resolve Symbols in Process Explorer-Monitor Without Installing the Debugging Tools

Posted by William Diaz on January 31, 2012

Sometimes when you are troubleshooting with Process Explorer, it’s helpful to be able to view functions in threads to isolate a problem. The same goes for Process Monitor when viewing the Stack tab in the properties of an operation. By default, Process Explorer and Process Monitor will point to the dbghelp.dll in the windows\system32 folder, but this is a stripped down version and doesn’t support symbol server functionality. Instead, you need the dbghelp.dll from the Windows Debugging Tools to properly resolve symbols, otherwise you will encounter the Process Explorer Warning box when you click the Threads tab in process properties:
Read the rest of this entry »

Posted in Uncategorized | Tagged: , , | 1 Comment »

The Case of the IE Hangs and Missing PNG Images (or Killing Two Birds with One Stone)

Posted by William Diaz on January 9, 2012

The initial issue I was asked to look at started with Internet Explorer failing to gracefully exit. Instead, it would just hang and required manual intervention via the Task Manager to kill the iexplore.exe process. I connected remotely to the workstation and ran Process Explorer so I could examine IE’s threads for anything out of the ordinary. Sure enough, I saw the presence of a .tmp file:
Read the rest of this entry »

Posted in Troubleshooting | Tagged: , , , , , | 5 Comments »

The Case of the Missing SharePoint “Connect to Outlook” Action

Posted by William Diaz on December 1, 2011

This one originally came to me as a complaint from a single user about his inability to connect one of his SharePoint calendars to Outlook 2003. In most SharePoint lists, there is an Actions menu that should contain this option:
Often, this problem is resolved by installing the SharePoint Services Support for Office and/or simply repairing Office. You can also find a good guide to troubleshooting this issue here. But none of these options were resolving the issue. Additionally, as I began to investigate to see if the problem could be recreated on various tech workstations, I realized that the impact was not isolated to a single workstation, but almost all workstations in our helpdesk. Of the systems that were not affected, one of them resided on my desk, a lab PC that had since departed from the standard Windows XP Pro image we deploy firm-wide. Read the rest of this entry »

Posted in Office, Troubleshooting | Tagged: , , , | Leave a Comment »

When A Process Does Not Exit Normally

Posted by William Diaz on November 28, 2011

i.e., it crashes.

When processes exit, they should exit with a status code that indicates whether or not it exited gracefully or abnormally. This comes in helpful when you need to examine large Process Monitor logs and want to isolate the time of the crash. Simply filter for Process Exit:
Read the rest of this entry »

Posted in Inside Windows | Tagged: , | 1 Comment »

Some PDF Internals

Posted by William Diaz on November 2, 2011

Often times when sorting through Process Monitor logs, you find yourself having to employ some intuition to zero-in on what is an otherwise vague result: NAME NOT FOUND. Its normal to see these results en masse, and most of these are perfectly legit. But knowing how to apply a few filters and some basic understanding of what you are looking for is sometimes enough to narrow down why your application is failing. In a previous post, I demonstrated this approach. Here is another example.

In this case, the user was not able to open PDFs from within our Outlook-integrated document management system. The error reported was rather generic as you can see below: Read the rest of this entry »

Posted in Troubleshooting Tools | Tagged: , , | 1 Comment »

An Instance Where Process Monitor Failed to Run

Posted by William Diaz on October 28, 2011

While doing some troubleshooting on a workstation one evening, I wanted to run Process Monitor but encountered the following error: “Procmon was unable to allocate sufficient memory to run. Try increasing the size of your page file.”

As seen here, the available memory and page file size were sufficient:
Read the rest of this entry »

Posted in Uncategorized | Tagged: | 1 Comment »

Repair Office To Fix Issues With Internet Explorer

Posted by William Diaz on October 12, 2011

In technical support, there is a common knee-jerk reaction when something doesn’t work in Microsoft Office: run a repair of the product or reinstall it. My colleagues have probably spent several hours combined going through this step countless times. Often (often is 99% of time) this fails to resolve whatever issue they are encountering. Over the course of a few years of troubleshooting Office, a repair has only corrected an issue once ( or maybe twice). In our case, it’s the nature of the custom environment that is chock-full-o-add-ins. Other times it is some weird, unexplained element of a document, spreadsheet, or whatever that just doesn’t want to work. Those can be rather complex to figure out sometimes.

That being said, sometimes repairing MS Office fixes issues in areas you might not otherwise think.  For example, I recently setup a small document library in SharePoint, but while trying to edit the files from Internet Explorer some of the tech workstations were reporting the following error: “Windows Internet Explorer – ‘Edit Document’ requires a Windows SharePoint Services-compatible application and Microsoft Internet Explorer 6.0 or greater.”
Read the rest of this entry »

Posted in Office, Troubleshooting Tools | Tagged: , , | Leave a Comment »

Uninstalling Doesn’t Mean Its Been Completely Uninstalled

Posted by William Diaz on October 1, 2011

I don’t trust uninstallers. They always tend to leave something behind. Every now and then one of these orphaned components still ends up not playing well with some other application or the OS, resulting in crashing user-mode apps or the kernel. A good example of this was a previous post where I was experiencing a BSOD when running Process Monitor (read about it here) after installing a Microsoft application.

So, we have a workstation that is about to be sent off to be re-imaged because iLinc, a web conferencing application, is crashing when the user tries to join a session. I intervene because I hate to see these issue written off as unexplained. Who knows, the system gets re-imaged, the user installs some application again and the problem repeats itself (which it would have been the case here).

It happened that Dr. Watson, the Windows XP post-mortem default debugger, was capturing the user-mode crash so I jumped in without hesitation:
Read the rest of this entry »

Posted in Troubleshooting | Tagged: , , , , | Leave a Comment »