Any utility that will tell me what program or service is accessing thehard drive?

[XP Guy]

This is for XP, sp3.

I've just installed XP-sp3 on a new motherboard and I'm in the process
of turning off a lot of garbage services and in general optimizing it.

I've turned off indexing service as well as the cache-thing that's
supposed to make it boot-up faster. The system does auto-login as the
default user (with admin privledges) just the way I like it. So at
power-up within about a minute I have the desktop up in classic mode.

I notice that if I do nothing - just let it start up and sit there, I'll
see the hard-drive light pulse on about once per second - and it will
just to this indefinately.

It bugs my ass and I'd like to know what's goosing the drive like this.

Is there any utility or program that can tell me what's accessing the
drive?

 

[Tester]

Try this:

<http://technet.microsoft.com/en-us/sysinternals/bb896645>

Good luck.

 

[Fishface]

Is there any utility or program that can tell me what's accessing the
drive?

The old Systernals Filemon has been replaced by Process Monitor, it seems.
http://technet.microsoft.com/en-us/sysinternals/bb896642

 

[PeterC]

The old Systernals Filemon has been replaced by Process Monitor, it seems.
http://technet.microsoft.com/en-us/sysinternals/bb896642

Also Sysinternals Process Explorer. Enabling the columns for I/O Read bytes,
I/O Write Bytes and Disk Write Bytes might show you that one iteration of
svchost.exe is accessing the disk about once a second in the I/O columns and
that System also Writes a lot (which is reasonable).
The svchost in question is the one that has about 15+ items in it (there's
float-over info for each entry in the LH column.
I don't know why this happens but one thing I have found out is that it does
so only when connected to the interwebs.

 

[JRosenfeld]

If it is a Dell XPS 630i, the disc light flashes as you describe, even if
nothing is accessing the drive. That has never been resolved and the only
suggestion is a bit of black sticky tape. Maybe other models do that
too?

 

[Mayayana]

| I notice that if I do nothing - just let it start up and sit there, I'll
| see the hard-drive light pulse on about once per second -

I've had the same trouble and got curious. I had thought the problem
was Online Armor's odd habit of looking for a file that doesn't exist
every few seconds. But I tried turing of OA and running both Filemon
and Procmon. With no activity at all the light keeps blinking. (I have
disabled just about anything that might run systematically in the
background.)

After doing some searching online I found a lot of other people
describing the same thing. Some had stopped it by stopping
Windows from checking the CD/DVD drive for media. (They removed
the drive in Device Manager and the blinking stopped.) I'm guessing
it may just be part of how some motherboards work. This is the
first time I've seen the behavior. It's annoying, since that light should
only indicate hard disk activity, but it seems to be harmless. If you
test for running processes and find nothing running then there's
apparently nothing more to be done.

 

[Patok]

| I notice that if I do nothing - just let it start up and sit there, I'll
| see the hard-drive light pulse on about once per second -

I've had the same trouble and got curious. I had thought the problem
was Online Armor's odd habit of looking for a file that doesn't exist
every few seconds. But I tried turing of OA and running both Filemon
and Procmon. With no activity at all the light keeps blinking. (I have
disabled just about anything that might run systematically in the
background.)

I'm reading this thread with mounting amazement. I have never, ever,
seen an installation of WinXP that did *not* constantly access the boot
drive. All WinXP installations I've seen, the boot drive is constantly
being accessed (once per second or more often). I've never seen the boot
drive power off. When looking at the SMART data, the Start/Stop Count is
about the same as the Power Cycle Count; the Power Off Retract Count is
very close to 0 (if non-zero). The additional (non-boot) drives are not
accessed, and they may power off (as per power manager settings), but
the boot drive - never. The drive access light is, of course, always
blinking. As far as I've been able to determine, this is because of UPnP.

After doing some searching online I found a lot of other people
describing the same thing. Some had stopped it by stopping
Windows from checking the CD/DVD drive for media. (They removed
the drive in Device Manager and the blinking stopped.) I'm guessing
it may just be part of how some motherboards work. This is the
first time I've seen the behavior. It's annoying, since that light should
only indicate hard disk activity, but it seems to be harmless. If you
test for running processes and find nothing running then there's
apparently nothing more to be done.

As far as I've seen, it *does* indicate disk activity, since XP
accesses the disk all the time. Am I missing something?

 

[Mayayana]

| I'm reading this thread with mounting amazement. I have never, ever,
| seen an installation of WinXP that did *not* constantly access the boot
| drive. All WinXP installations I've seen, the boot drive is constantly
| being accessed (once per second or more often). I've never seen the boot
| drive power off. When looking at the SMART data, the Start/Stop Count is
| about the same as the Power Cycle Count; the Power Off Retract Count is
| very close to 0 (if non-zero). The additional (non-boot) drives are not
| accessed, and they may power off (as per power manager settings), but
| the boot drive - never. The drive access light is, of course, always
| blinking. As far as I've been able to determine, this is because of UPnP.
|

I have UPnP disabled, as I'm not networked. I have
most services disabled. (I even disable the critical Windows
Time because I don't feel that I need atomic clock accuracy
while reporting in to Microsoft on a regular basis.
I have System File Protection killed, along with PC Health.
I have indexing disabled. System Restore disabled. Backup
nonsense disabled. Windows Update disabled. I have no
service running, that I know of, that needs to act when it's
not called upon.

I think that what you're saying makes sense. That's why
we've all been talking about excess services. But I've had
XP on other machines without constant blinking. And while
XP is a bloated hog in its default configuration, it's quite lean
and has no need to access the disk once it's been cleaned
up. (We're not talking about the disk powering down. Just
no programmatic disk access when there's no activity. My
understanding is that the disk light indicates current disk
access.)

If I don't do anything, and I shut down my firewall, I see
nohing happening in Procmon, which is as it should be. But
the disk light keeps blinking. That, and what I've found online,
make me wonder if maybe there's been a change in motherboard
designs. Maybe there's even a way to fix the problem. But
I don't know any more than that.

 

[Nil]

(I even disable the critical Windows Time because I don't feel
that I need atomic clock accuracy while reporting in to Microsoft
on a regular basis.

There are scads of other time servers in the world. You don't have
to use Microsoft's. I think they even supply time.nist.gov as an
alternative.

 

[Paul]

There are scads of other time servers in the world. You don't have
to use Microsoft's. I think they even supply time.nist.gov as an
alternative.

http://en.wikipedia.org/wiki/Ntp_pool

http://www.pool.ntp.org/en/

For example, my little router box, that serves to distribute
Internet in the house, is set to use "pool.ntp.org" to get the
time (the router time stamps log entries with accurate time stamps).
The pool contains hundreds of servers around the world, contributed
by volunteers for the purpose.

So if you're being logged, you're being logged by a
guy in Zimbabwe

Paul

 

[Mayayana]

| > (I even disable the critical Windows Time because I don't feel
| > that I need atomic clock accuracy while reporting in to Microsoft
| > on a regular basis.
|
| There are scads of other time servers in the world. You don't have
| to use Microsoft's. I think they even supply time.nist.gov as an
| alternative.

Yes. But most people are calling home to MS
without knowing it. More to the point is the
sheer absurdity of the idea that the average
person, assuming they're not running a particle
accelerator, needs their clock regularly synchronized.

Windows Time is just one example of the literally
dozens of services that run on XP by default and
are unnecessary and/or inappropriate and/or unsafe.
A good example was the Messenger service, which
allows corporate IT people to send out messages
to the network. (As in, "It's Friday. don't forget to
turn out your lights before leaving.") Microsoft had
that set to run by default. It got exploited to show
people ads. It's now turned off by default. That leaves
another few dozen services that are inappropriately
running by default, but haven't yet drawn enough
attention to disable them, since it's not in the interest
of corporate IT to do so. Business is Microsoft's
customer and business wants intranet-ready
workstation configurations.

 

[Nil]

Yes. But most people are calling home to MS without knowing it.

In this case, so what. I don't believe there's any sensitive
information being exchanged in a time synchronization. And it takes no
effort to change the default server or disable it entirely.

More to the point is the
sheer absurdity of the idea that the average person, assuming
they're not running a particle accelerator, needs their clock
regularly synchronized.

I don't agree. If you have more than one computer on your local
network, it's good to have them all synchronized.

Windows Time is just one example of the literally
dozens of services that run on XP by default and are unnecessary
and/or inappropriate and/or unsafe.

Time synchronization is helpful, appropriate, and safe.

A good example was the
Messenger service, which allows corporate IT people to send out
messages to the network.

That's a good example. Time sync is not a good example.

 

[Char Jackson]

In this case, so what. I don't believe there's any sensitive
information being exchanged in a time synchronization. And it takes no
effort to change the default server or disable it entirely.


I don't agree. If you have more than one computer on your local
network, it's good to have them all synchronized.


Time synchronization is helpful, appropriate, and safe.


That's a good example. Time sync is not a good example.

Very well said.

 

[Flasherly]

This is for XP, sp3.

I've just installed XP-sp3 on a new motherboard and I'm in the process
of turning off a lot of garbage services and in general optimizing it.

I've turned off indexing service as well as the cache-thing that's
supposed to make it boot-up faster. The system does auto-login as the
default user (with admin privledges) just the way I like it. So at
power-up within about a minute I have the desktop up in classic mode.

I notice that if I do nothing - just let it start up and sit there, I'll
see the hard-drive light pulse on about once per second - and it will
just to this indefinately.

It bugs my ass and I'd like to know what's goosing the drive like this.

Is there any utility or program that can tell me what's accessing the
drive?

Whatever access programs you're querying may first be filtered within
a limited set of core DLLs, such as are common to a native application
interface. Hardware abstraction layering first is exhibited upon
chipset dependencies, established so and in order as established
determinants during the course of the OS install process. The Windows
Native application program interface then occurs predominately within
Microsoft's security, Ring-3 level upon booting into the OS
initialization, although not all functions, whether an inclusion or
separately so programmed during subsequent installations, or by
unknown contact, will be visible or intentionally available to the
user interface space. Subsequent to an above hierarchal determinants,
are the Kernel, User and user communications, Comctl and Gdi, input-
output and video library routines, which represent for the greater
number a functional derivative to that means.

As stated at the level Ring 3 security, presuming what you wish to see
cannot be, as intended, is also where programmers will write such as
anti-virus subroutines;- an implication one apparently must shoulder
by onus, in any other case, for one simply to otherwise overlook what
is less obvious than readily apparent.

 

[Nil]

Very well said.

Thank you.

And another thing... Windows's built in time sync client only does its
thing once a week. It's not like it's constantly phoning anywhere.

The router I used to use at home had its own time server. I had it set
up to sync to an internet time server, and the computers on my local
network set to synchronize with the router. Now I have them all just
synchronize with pool.ntp.org .

My main XP computer won't do a time sync with the built-in client, for
some reason. On it, I use the old utility D4 to sync the time upon
bootup, which is often enough.

 

[Char Jackson]

And another thing... Windows's built in time sync client only does its
thing once a week. It's not like it's constantly phoning anywhere.

The frequency is adjustable, of course, but I agree, weekly is the
default.

The router I used to use at home had its own time server. I had it set
up to sync to an internet time server, and the computers on my local
network set to synchronize with the router. Now I have them all just
synchronize with pool.ntp.org .

My main XP computer won't do a time sync with the built-in client, for
some reason. On it, I use the old utility D4 to sync the time upon
bootup, which is often enough.

I used to deal with an XP system that refused to perform its automated
time sync, while a manual sync always worked. I replaced the FQDN with
its IP address and all was well. In that case, I believe I had been
using time.nist.gov so I changed it to 64.147.116.229. It worked
perfectly ever after.

 

[Nil]

The frequency is adjustable, of course, but I agree, weekly is the
default.

Is it? This thread got me reading up on this, and as far as I can tell,
the only way to make it sync more often than the default weekly is to
create a special scheduled task. Otherwise, it keeps on its weekly
schedule no matter what keys in the registry you tweak. I'm still
looking into this.

I used to deal with an XP system that refused to perform its
automated time sync, while a manual sync always worked. I replaced
the FQDN with its IP address and all was well. In that case, I
believe I had been using time.nist.gov so I changed it to
64.147.116.229. It worked perfectly ever after.

I also took a little time and fixed my XP machine! Somehow the W32time
service had gotten messed up. I read instructions on how to re-register
the service, and now it works as advertised. It's been broken for years
but I never bothered to fix it, since I had a workaround.

I also took another look at my new router (the one supplied by my ISP)
and I found that, like my old one, it can sync with the internet time
server(s) of my choice, and that it can also be a time server for my
local network. Now I have all the computers in the house syncing to the
router, and they should all now be precisely in sync. Yay!

 

[BillW50]

In

Is it? This thread got me reading up on this, and as far as I can
tell, the only way to make it sync more often than the default weekly
is to create a special scheduled task. Otherwise, it keeps on its
weekly schedule no matter what keys in the registry you tweak. I'm
still looking into this.

Why bother with that? Just turn it off and use many of the great
utilities out there. One of the best, yet an oldie is Dimension 4 (aka
D4).

Thinking Man Software - Dimension 4 v5.0
http://www.thinkman.com/dimension4/index.htm

 

[Char Jackson]

Is it? This thread got me reading up on this, and as far as I can tell,
the only way to make it sync more often than the default weekly is to
create a special scheduled task. Otherwise, it keeps on its weekly
schedule no matter what keys in the registry you tweak. I'm still
looking into this.

Grabbing the first Google hit, it matches what I've done to my XP
systems. <http://www.pctools.com/guides/registry/detail/985/>

Key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\
TimeProviders\NtpClient]

Value Name: SpecialPollInterval

I use a value of 3600 (seconds) so it syncs hourly.

 

[Char Jackson]

In

Why bother with that? Just turn it off and use many of the great
utilities out there.

Ridiculous, no? Why turn off an included part of the OS and replace it
with something that does exactly the same thing?