Ghost Solution Suite

One of the PCs I applied an image to was crashing and going into sleep mode unexpectedly, and after poking around a bit I decided to run scandisk on it. It rebooted and scandisk started, and during the 3rd pass is started reporting hundreds of errors - 670 in all.

I checked the source PC and it was fine. I then re-imaged the PC that was having the problems and after it was all done I logged in and ran scandisk again, and it reported the same problems.

I then created a new image from the source PC and applied that to a different PC, and scandisk once again reports hundreds of errors on the newly images system.

Is this a known problem? Is there something I'm doing wrong in my process? Scandisk claims to have repaired all the problems, but I'm not left feeling very confident about it all.

Hi Daniel,

What are the errors reported by Scandisk?

Are they related to security descriptors or just lost chains etc.?

Krish

They scroll by too fast to read (and the LCD display I'm using has poor latency so they all kind of blur together), but it looks like it's saying something about "Inserting an entry into INDEX..." and "Repairing INDEX...".

A second run-throuhg doesn't produce any errors, so it appears they are being fixed, but it still bothers me.

Hi Daniel,

When you say scandisk, I assumed that you are running chkdsk in Windows. Is that correct?

You can redirect the output to a text file if it is difficult to read when scrolling, by running chkdsk with redirector as follows.

'chkdsk c: > report.txt'

This will create a report.txt file with all the output and you can use wordpad to check it (formatting will not be good under notepad).

When you run chkdsk in this way, if it asks any questions, they will go to the file too, and you will not see it. But if you run chkdsk without /f switch, usually it does not ask questions.

Krish

Yes, it's WIndows XP  Pro.

I'm running the Disk Check option under Properties -> Tools for the C: drive. I was checking the "Automatically fix file system errors" check box, so it says it needs to reboot to continue. After rebooting the disk check runs and I get all the errors.

I'll try running it manually this morning and will redirect the output and report back.

Message Edited by Daniel Segel on 07-16-200706:58 AM

OK, the output is as follows.

Several hundred lines of:
    Repairing an index entry with id 1401 in index $SII of file 9.
    Inserting an index entry with Id 1401 into index $SDH of file 9.
    ...<these lines repeat several hundred times, with incrementing Id>

Followed by:
    Repairing the security file record segment.
    Deleting an index entry with Id 690 from index $SDH of file 9.
    Deleting an index entry with Id 693 from index $SDH of file 9.
    Deleting an index entry with Id 760 from index $SDH of file 9.
    Deleting an index entry with Id 695 from index $SDH of file 9.
    Deleting an index entry with Id 752 from index $SDH of file 9.
    Deleting an index entry with Id 1493 from index $SDH of file 9.
    Deleting an index entry with Id 572 from index $SDH of file 9.
    ... <the "Deleting" lines repeat several hundred times, Id jumps around a lot, forward and back>

Followed by:
Fixing mirror copy of the security descriptors data stream.
Security descriptor verification completed.

Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.

 156272287 KB total disk space.
   6635024 KB in 23831 files.
      6632 KB in 2284 indexes.
            0 KB in bad sectors.

    100071 KB in use by the system.
     65536 KB occupied by the log file.
 149530560 KB available on disk.

          4096 bytes in each allocation unit.
  39068071 total allocation units on disk.
  37382640 allocation units available on disk.

Hi Daniel,

Thanks for the information,

These entries are related to the security database, and chkdsk seems to find they are no longer necessary for some reason.

Have you edited the image in any way prior to the restore?

Did you run any other tools after restoring the image, before booting to OS (Ghost Walker etc.)

Is this a syspreped image?

Krish

The image is clean and unedited. I'm not using sysprep, but I am using Ghostwalker to perform a SID change on the target machine, and I am joining the target to the domain in the imaging task (specified in the Configuration file).


I'm in the process of rebuilding the source system I take the image from in case it has something wierd in it that doesn't show up until the image is cloned to a new PC.

Was this source machine a member of a domain prior to take the image?

Let me know what happens with your new image.

Krish

Message Edited by Krish Jayaratne on 07-19-200704:51 PM

It was in the domain at one point, but was removed by an imaging Task prior to taking the most recent image. It's actually been joined and dis-joined a few times over the past several weeks, since I found out that the imaging process itself fails to complete properly if the source PC was in the domain when the image was taken (see here for more info on that issue.)

I just finished imaging a new PC with an image taken from my rebuilt source PC. The source PC drive checks out with no errors in chkdsk. The target PC comes up with the same hundreds of lines of errors as before.

The source PC is not now and has never been part of our domain. The target PC was joined to the domain as part of the imaging task.

Hi Daniel,

I will try to reproduce some scenarios I suspect.

In the source or target machine, do you use partition restore and if that's the case, what is in the other partition?

If you restore it without SID change with Ghostwalker, would you still get the scandisk errors?

Krish

I'm doing a whole-disk restore; there's only one partition.

If I don't use Ghostwalker to do a SID change then the errors I reported intially don't happen, but there is still a "free space marked as allocated" error showing up. I'm much less concerned about that error.

In this case, does the target machine end up with the same SID as the source, and if so, wouldn't this cause errors in Active Directory when I try to add more than one machine to the domain?

Hi Daniel,

Absolutely. Not changing the SID could lead to many issues, I was suggesting that only as a test.

It appears that when the SID is changed, these descriptors become unnecessary as far as chkdsk is concern. Do you have any application installed that changes the permission in a relatively large number of files?

Krish

Not that many things are installed:

Adobe Flash Player ActiveX
Adobe Reader 8.1.0
Adobe Shockwave Player
Canon DR-2050C scanner driver
Citrix Presentation Server Client
Office 2003
Java

and a few others, mainly drivers and .NET 1.1 and 2.0 from Microsoft.

Is there a way to tell which file(s) it's complaining about?

Hi Daniel,

I can't think of an easy way to find the file names.

Could you check if there is an event log entry about this? (in the application log). For some errors, chkdsk creates an event log entry with more details.

Could you run chkdsk /I. This will do a less rigorous check on indexes, it could be an indication of level of the problem.

Krish

There's nothing in the event logs.

Chkdsk /i still reports all the errors.

Hi Daniel,

Could you see if you have restore points created in the source machine? Restore points could become after a clone, and that could lead to have this kind of errors.

Could you create the image after removing the restore points from the source machine and try that? Turning off restore points will clear the existing ones, and if you plan to use restore points, you can turn it on again.

(Even if you did not create restore points, Windows would create them automatically when installing applications.)

Krish

Unfortunately, that's not it. System Restore is one of the first things I turn off when creating a new source PC, and it's still off on the source now.

I'm having the same problem. After the image has been pushed I run scandisk and recieved over 12,000 unused security descriptors. What can this be?

Hi,

Unused security descriptors mean that there are security descriptors in the database that are not linked to any file.

I could get the same situation with system restore, but in your case it seems to be turned off.

I will try to see if it is possible to reproduce here.

Krish

I was wondering if it's known by now whether this issue can have any adverse effects. Running chkdsk /f removes the errors, but is that all there's to it?
A customer was experiencing slow performance on their PC's, which had been imaged by us. When they ran checkdisk, they got the errors like the ones mentioned by the TS. Of course they immediately linked the slow performance to the errors. Can there be any truth to this or is this most likely unrelated?

We image 100-500 computers at a time in our environment.  Whenver this kind of thing manifested we would have a student worker run a hard drive analysis and invariably the hard drive was what was in question.

It happened so often in fact that we added Western Digital, Toshiba, Dell and gateway hard drive scanning tools to our netboot menu to make it easy to run the analysis.  Of course these days most of that ability is built in to machines.

In fact if we ghostcast say 50 comptuers and the session was REALLY slow we could usually pick out the one or two computers causing this and run the hard drive analysys and we found that the drive was bad in those cases as well.

Hi,

I don't think it has anything to do with slow performance, since it is only about orphan security descriptors. Did this happen after SID change?

Krish

You're probably right about it being unrelated. I've contacted Microsoft and according to them it's purely a cosmetic thing and nothing to worry about.

p.s. Sorry for the late response.