Boswell's Q&A

What You See Is Not What You Get

Admin is seeing strange things, not the contents of his removable drives. Plus, some reader feedback.

• By Bill Boswell
• 03/01/2005

Bill: I've encountered an interesting phenomenon with removable drives such as thumb drives and USB external drives. When I plug in the drive and browse it in Windows explorer, I don’t see the actual drive contents. Instead, I see the contents of my home directory on the server.

If I reboot, the problem is resolved and I see the drive contents, so it’s not a permanent issue. However, do you have any idea why this would be happening?
— J

Get Help from Bill Got a Windows or Exchange question or need troubleshooting help? Or maybe you want a better explanation than provided in the manuals? Describe your dilemma in an e-mail to Bill at mailto:[email protected]; the best questions get answered in this column. When you send your questions, please include your full first and last name, location, certifications (if any) with your message. (If you prefer to remain anonymous, specify this in your message but submit the requested information for verification purposes.)

Readers: I have to admit that I've never encountered this phenomenon. I asked J to get more information using a Sysinternals tool called the Windows Object Browser, or WinObj. (Click here to download this free tool.)

WinObj shows the object namespace that lies behind the operating system. When you put a new device in a system, such as a USB hard drive or USB thumb drive, the system adds a new HardDisk object to the object namespace. Figure 1 shows and example.

I asked J to insert the USB device then see if the Partition symlinks point to the new device or to the other HardDisk devices.

I also asked J to check the Global?? container in WinObj. This container holds objects that represent virtual devices. In the Global?? container, each logical drive is represented by an object with the same letter as the drive letter assigned to the device. I wanted to know if the symlink for that logical drive points at the correct device (see Figure 2).

Figure 1. Use Sysinternals' Windows Object Browser tool to view the object namespace. (Click image to view larger version.)

 

Figure 2. Where, oh, where does the symlink for that logical drive point? (Click image to view larger version.)

I also asked J to try changing the Policies for the USB storage device from "Optimize for Quick Removal" to "Optimize for Performance" to see if that made the problem disappear. If not, I asked him to try reinitializing the Explorer shell without logging off by going to Task Manager and killing the Explorer process then relaunching Explorer in Task Manager using File | New Task (Run) | Explorer.

If you've ever encountered this issue and can shed some light on the root cause, please send me an e-mail.

Roots, Resolution, Reggae
Here's a few housekeeping items. First, speaking of Sysinternals, Mark Russinovich has a new tool called RootkitRevealer that scans a machine looking for hidden rootkits. (Click here for some info on rootkits from Microsoft.) It's a great utility and you should take a look at it. Download it from http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml.

In the "Name Resolution Game" column, I was presented with a problem concerning an Exchange 5.5 server running on an NT server that didn't seem to want to let an Exchange 2003 server join the organization. A reader from Belfast wrote in to suggest that the Exchange server might also be a legacy BDC that was orphaned when the domain was upgraded to Active Directory and shifted to Native mode. It never occurred to me to check for this and I thought I'd pass on the suggestion to you.

In "Hurry Up and Wait," a reader had a need to shutdown all Exchange services prior to restarting. I included a little batch file in my response. Seth A. sent me a much better batch file:

@echo off
Echo This program will stop Exchange Services and allow you to shutdown or restart your server.
pause
Echo Would you like to [R]eboot or [S]hutdown the server? Press C to [C]ancel
choice /c:RSC

If errorlevel 3 goto :cancel
If not errorlevel 3 if errorlevel 2 goto :shutdown
If not errorlevel 2 if errorlevel 1 goto :reboot

:cancel
exit

:reboot
echo Server will now shutdown MS Exchange
net stop "Microsoft Exchange Event"
net stop "Microsoft Exchange IMAP4"
net stop "Microsoft Exchange Information Store"
net stop "Microsoft Exchange Management"
net stop "Microsoft Exchange MTA Stacks"
net stop "Microsoft Exchange POP3"
net stop "Microsoft Exchange Routing Engine"
net stop "Microsoft Exchange Site Replication Service"
net stop "Microsoft Exchange System Attendant"
echo Server will now reboot
shutdown -r -t 5
exit

:shutdown
echo Server will now shutdown MS Exchange
net stop "Microsoft Exchange Event"
net stop "Microsoft Exchange IMAP4"
net stop "Microsoft Exchange Information Store"
net stop "Microsoft Exchange Management"
net stop "Microsoft Exchange MTA Stacks"
net stop "Microsoft Exchange POP3"
net stop "Microsoft Exchange Routing Engine"
net stop "Microsoft Exchange Site Replication Service"
net stop "Microsoft Exchange System Attendant"
echo Server will now Shutdown
shutdown -s -t 5
exit

Thanks to the reader from Belfast and Seth and everyone who writes in with suggestions and corrections.