unexpected CHKDSK after clean shutdown

[Guest]

I am running Win2000 Pro SP4 with all updates installed (and more anti-virus,
anti-spam, anti-everything than I can count). Since the last update or
possibly the one before, I notice a strange behavior. About 1/3 of the time,
the machine wants to run CHKDSK on startup. The machine is always shut down
properly. I do not run it at night, so shutdown/startup is a normal daily
activity. I've been running this OS for five or six years, and have never
seen this until the last security update. Disk diagnostics indicate no
obvious problems. The disk is a single FAT32 partition.

It's more an annoyance (an extra five minutes to start the machine) than a
serious problem, but I am curious as to whether anyone else is seeing this
behavior.

 

[Dave Patrick]

Five years is a long time without recutting. You may suffer from file system
corruption or possibly the disk is failing. Does it fix anything?

If a volume's dirty bit is set, this indicates that the file system may be
in an inconsistent state. The dirty bit can be set because the volume is
online and has outstanding changes, because changes were made to the volume
and the computer shutdown before the changes were committed to disk, or
because corruption was detected on the volume. If the dirty bit is set when
the computer restarts, chkdsk runs to verify the consistency of the volume.

When Autochk runs against a volume at boot time it records its output to a
file called Bootex.log in the root of the volume being checked. The Winlogon
service then moves the contents of each Bootex.log file to the Application
Event log. One event log message for each volume checked is recorded. So
check the application event log.

I'd also download and run a disk diagnostic utility from the drive
manufacturer's web site.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I am running Win2000 Pro SP4 with all updates installed (and more
anti-virus,
| anti-spam, anti-everything than I can count). Since the last update or
| possibly the one before, I notice a strange behavior. About 1/3 of the
time,
| the machine wants to run CHKDSK on startup. The machine is always shut
down
| properly. I do not run it at night, so shutdown/startup is a normal daily
| activity. I've been running this OS for five or six years, and have never
| seen this until the last security update. Disk diagnostics indicate no
| obvious problems. The disk is a single FAT32 partition.
|
| It's more an annoyance (an extra five minutes to start the machine) than a
| serious problem, but I am curious as to whether anyone else is seeing this
| behavior.

 

[Guest]

Five years is a long time without recutting. You may suffer from file system
corruption or possibly the disk is failing. Does it fix anything?

First, thanks for your reply. I am not sure I understand the meaning of your
term "recutting." But I realize I was not specific enough. I have been
running the OS for five+ years, but not necessarily on the same hard drive.
It has been cloned unsing Ghost, perhaps a year ago. Of course, it is always
possible that the disk is failing. Is there some better way of verifying file
system integrity, other than CHKDSK and such tools as Disk Doctor? I would
appreciate any suggestions here.

If a volume's dirty bit is set, this indicates that the file system may be
in an inconsistent state. The dirty bit can be set because the volume is
online and has outstanding changes, because changes were made to the volume
and the computer shutdown before the changes were committed to disk, or
because corruption was detected on the volume. If the dirty bit is set when
the computer restarts, chkdsk runs to verify the consistency of the volume.

Shouldn't shutting down the machine using the standard shutdown procedure
make sure this never happens? Or am I being too optimistic? I always go
offline before shutting down, BTW. Can't say I never screw up though.

I'd also download and run a disk diagnostic utility from the drive
manufacturer's web site.

As mentioned (I hope), I already performed this step. Sorry if I was not
clear enough. No indicated problems.

I realize this could be coincidental, but it certainly seems strange to me
that this never happened until I downloaded the latest Windows update.

-Ken

 

[Dave Patrick]

:
| > Five years is a long time without recutting. You may suffer from file
system
| > corruption or possibly the disk is failing. Does it fix anything?
|
| First, thanks for your reply. I am not sure I understand the meaning of
your
| term "recutting."
* Clean install.


But I realize I was not specific enough. I have been
| running the OS for five+ years, but not necessarily on the same hard
drive.
| It has been cloned unsing Ghost, perhaps a year ago. Of course, it is
always
| possible that the disk is failing. Is there some better way of verifying
file
| system integrity, other than CHKDSK and such tools as Disk Doctor? I would
| appreciate any suggestions here.
* I'd use the manufacturer's tools.


| >
| > If a volume's dirty bit is set, this indicates that the file system may
be
| > in an inconsistent state. The dirty bit can be set because the volume is
| > online and has outstanding changes, because changes were made to the
volume
| > and the computer shutdown before the changes were committed to disk, or
| > because corruption was detected on the volume. If the dirty bit is set
when
| > the computer restarts, chkdsk runs to verify the consistency of the
volume.
|
| Shouldn't shutting down the machine using the standard shutdown procedure
| make sure this never happens? Or am I being too optimistic? I always go
| offline before shutting down, BTW. Can't say I never screw up though.
* Depends. Does it fix anything?


| >
| > I'd also download and run a disk diagnostic utility from the drive
| > manufacturer's web site.
|
| As mentioned (I hope), I already performed this step. Sorry if I was not
| clear enough. No indicated problems.
* OK, didn't know if this meant using the manufacturer's tools or what.


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

 

[Paul MR]

Five years is a long time without recutting. You may suffer from file system
corruption or possibly the disk is failing. Does it fix anything?

If a volume's dirty bit is set, this indicates that the file system may be
in an inconsistent state. The dirty bit can be set because the volume is
online and has outstanding changes, because changes were made to the volume
and the computer shutdown before the changes were committed to disk, or
because corruption was detected on the volume. If the dirty bit is set when
the computer restarts, chkdsk runs to verify the consistency of the volume.

When Autochk runs against a volume at boot time it records its output to a
file called Bootex.log in the root of the volume being checked. The Winlogon
service then moves the contents of each Bootex.log file to the Application
Event log. One event log message for each volume checked is recorded. So
check the application event log.

I'd also download and run a disk diagnostic utility from the drive
manufacturer's web site.

I am having exactly the nuisance described in the OP. I also
intuitively decided it was connected with a security update, but older
than the latest update -- since about May or maybe even April.

I am very much a computer novice in these kinds of problems. I have
no idea what is meant by "dirty bit." I searched for a file named
bootex.log (and anything similarly named) without any success.

Paul in San Francisco

 

[Dave Patrick]

Check the application event log. Start|Run|eventvwr.msc

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| I am having exactly the nuisance described in the OP. I also
| intuitively decided it was connected with a security update, but older
| than the latest update -- since about May or maybe even April.
|
| I am very much a computer novice in these kinds of problems. I have
| no idea what is meant by "dirty bit." I searched for a file named
| bootex.log (and anything similarly named) without any success.
|
| Paul in San Francisco

 

[Paul MR]

I ran eventvwr.msc, but I have no idea what the information means.
The application log went back to 7/15/06 and showed no errors, just
some warnings that the Symantec could not access certain files that
apparently were in use when I ran virus checks. The security log was
empty. The system log goes back to 4/29/06 and shows at least one
error every day, as many as seven in a day, typically three. These
errors are all identical (except for the time and dates, of course).
Source: "DCOM"; Category: "None"; Event: "10003." I clicked on a few
of these errors and they had identical descriptions: "Access denied
attempting to launch a DCOM server using DefaultLaunchPermission
[sic]. The server is {00020906-0000-0000-C000000000046}. The server
is Unavailable/unavailable. SID=unavailable."

Does this help you understand why the computer runs a scan disk every
third or fourth morning upon turning it on? The only reason I worry
is that it wasn't like this before about 10 weeks ago or so.

Thanks, Paul in San Francisco

 

[Paul MR]

In penultimate sentence of my previous post, I guess I meant chkdsk,
not scan disk.
Paul in San Francisco

I ran eventvwr.msc, but I have no idea what the information means. The
application log went back to 7/15/06 and showed no errors, just some
warnings that the Symantec could not access certain files that
apparently were in use when I ran virus checks. The security log was
empty. The system log goes back to 4/29/06 and shows at least one error
every day, as many as seven in a day, typically three. These errors are
all identical (except for the time and dates, of course). Source:
"DCOM"; Category: "None"; Event: "10003." I clicked on a few of these
errors and they had identical descriptions: "Access denied attempting
to launch a DCOM server using DefaultLaunchPermission [sic]. The server
is {00020906-0000-0000-C000000000046}. The server is
Unavailable/unavailable. SID=unavailable."

Does this help you understand why the computer runs a scan disk every
third or fourth morning upon turning it on? The only reason I worry is
that it wasn't like this before about 10 weeks ago or so.

Thanks, Paul in San Francisco

Check the application event log. Start|Run|eventvwr.msc

 

[Dave Patrick]

No it doesn't help. Check the application log for the most recent Event ID:
1001 Source: Winlogon event.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I ran eventvwr.msc, but I have no idea what the information means.
| The application log went back to 7/15/06 and showed no errors, just
| some warnings that the Symantec could not access certain files that
| apparently were in use when I ran virus checks. The security log was
| empty. The system log goes back to 4/29/06 and shows at least one
| error every day, as many as seven in a day, typically three. These
| errors are all identical (except for the time and dates, of course).
| Source: "DCOM"; Category: "None"; Event: "10003." I clicked on a few
| of these errors and they had identical descriptions: "Access denied
| attempting to launch a DCOM server using DefaultLaunchPermission
| [sic]. The server is {00020906-0000-0000-C000000000046}. The server
| is Unavailable/unavailable. SID=unavailable."
|
| Does this help you understand why the computer runs a scan disk every
| third or fourth morning upon turning it on? The only reason I worry
| is that it wasn't like this before about 10 weeks ago or so.
|
| Thanks, Paul in San Francisco

 

[Paul MR]

This morning happened to be one of the days that the chkdsk ran when I
turned the machine on. I had no event ID 1001; looking back in time
I have never had event ID 1001 as far back as the log goes.
I had two events this morning prior to connecting to my isp. At 8:12
a.m. I have source "eventlog"; category "none"; event "6009";
description "Microsoft(R) Windows 2000(R) 5.0.2195 Service Pack 4
Uniprocessor Free."
At the exact same time I have source "eventlog"; category "none";
event "6005" description "eventlog service was started"
Paul in San Francisco

 

[Dave Patrick]

Those two are in the system log and are informational and can be ignored.
Sounds like chkdsk wants to run but cannot.

If you get an error something to the effect "cannot open volume for direct
access" There is some system/boot start device that is reading/writing to
the drive before chkdsk can get a lock on the drive. Some anti-virus
applications do this.

After backup you can also run;
chkdsk /r
from the recovery console command line. (/r implies /f and /p)

To start the Recovery Console, start the computer from the Windows 2000
Setup CD or the Windows 2000 Setup floppy disks. If you do not have Setup
floppy disks and your computer cannot start from the Windows 2000 Setup CD,
use another Windows 2000-based computer to create the Setup floppy disks. At
the "Welcome to Setup" screen. Press F10 or R to repair a Windows 2000
installation, and then press C to use the Recovery Console. The Recovery
Console then prompts you for the administrator password. If you do not have
the correct password, Recovery Console does not allow access to the
computer. If an incorrect password is entered three times, the Recovery
Console quits and restarts the computer. Note If the registry is corrupted
or missing or no valid installations are found, the Recovery Console starts
in the root of the startup volume without requiring a password. You cannot
access any folders, but you can carry out commands such as chkdsk, fixboot,
and fixmbr for limited disk repairs. Once the password has been validated,
you have full access to the Recovery Console, but limited access to the hard
disk. You can only access the following folders on your computer: drive
root, %windir% or %systemroot%


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| This morning happened to be one of the days that the chkdsk ran when I
| turned the machine on. I had no event ID 1001; looking back in time
| I have never had event ID 1001 as far back as the log goes.
| I had two events this morning prior to connecting to my isp. At 8:12
| a.m. I have source "eventlog"; category "none"; event "6009";
| description "Microsoft(R) Windows 2000(R) 5.0.2195 Service Pack 4
| Uniprocessor Free."
| At the exact same time I have source "eventlog"; category "none";
| event "6005" description "eventlog service was started"
| Paul in San Francisco

 

[Sid Knee]

Dave Patrick wrote:

I am having exactly the nuisance described in the OP. I also intuitively
decided it was connected with a security update, but older than the
latest update -- since about May or maybe even April.

FWIW, I had the same kind of problem with one of my systems a while
back. It would frequently run chkdsk on bootup and if I ran chkdsk
independently (from a Bart's Boot CD) I would get several file errors
(as I recall, it was mainly the indexes ... rarely lost allocation units).

The manufacturer's HD test utility swore the drive was good.
Re-installing Win2K didn't help and neither did installing a second copy
in a multiple boot configuration. The second copy, even as a clean
install with minimal additional apps, suffered the same problem.

I started to think in terms of a hardware problem and someone reminded
me that motherboards of a certain vintage suffered widespread problems
of faulty (rapid degradation) electrolytic capacitors. The story was
widely reported on the internet several years ago and applied to some
P3-era boards from most manufacturers. My P3 board would have nicely
fitted the bill. I visually examined the capacitors for any sign of
swelling etc and didn't find any but that proves little and the problem
remained unresolved.

I decided, in the end, that an upgrade was in order anyway and dumped
that MB in favour of a P4 version .... and the problem went way (using
the same HD).

One thing that would be worth doing before looking to the hardware is to
do the standard cable checks (unplug, reconnect and make sure they are
all seated properly). Also make sure you are using the correct and
latest *manufacturer's* chipset drivers. (Personally, I wouldn't rely on
the default Windows drivers in this instance).

 

[Paul MR]

Thanks, Dave for your help. But this new round of advice is beyond my
competence. Danger: quicksand ahead! My plan is to ignore this issue
and keep backing up my data frequently in anticipation of the day this
machine dies.

Paul in San Francisco

 

[Paul MR]

Thanks, Sid, for your advice. I think I am competent to do what you
suggest about cable connections and latest chipset drivers. Beyond
that, I plan to ignore this issue and just continue to back up my data
frequently until this machine dies.

Paul in San Francisco

 

[Dave Patrick]

OK, sounds good.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Thanks, Dave for your help. But this new round of advice is beyond my
| competence. Danger: quicksand ahead! My plan is to ignore this issue
| and keep backing up my data frequently in anticipation of the day this
| machine dies.
|
| Paul in San Francisco