Command Reference for IPCONFIG MS-DOS Command

Ipconfig is a MS-DOS command-line tool used to display and manage the network settings of your computer. Ipconfig is available on Windows machines, and it displays the current network connection details and DHCP client settings.

Ipconfig is an external MS-DOS command, and is available on Windows 95, Windows 98, ME, NT, 2000, XP and Windows Vista Operating Systems. On Windows 9x machines, a graphical tools such as "winipconfig" or "winipcfg" may be used instead. On Linux machine, the ifconfig command performs equivalent function.

C:\> ipconfig /?

USAGE:
    ipconfig [/? | /all | /renew [adapter] | /release [adapter] |
              /flushdns | /displaydns | /registerdns |
              /showclassid adapter |
              /setclassid adapter [classid] ]

where
    adapter         Connection name
                   (wildcard characters * and ? allowed, see examples)

    Options:
       /?           Display this help message
       /all         Display full configuration information.
       /release     Release the IP address for the specified adapter.
       /renew       Renew the IP address for the specified adapter.
       /flushdns    Purges the DNS Resolver cache.
       /registerdns Refreshes all DHCP leases and re-registers DNS names
       /displaydns  Display the contents of the DNS Resolver Cache.
       /showclassid Displays all the dhcp class IDs allowed for adapter.
       /setclassid  Modifies the dhcp class id.

The default is to display only the IP address, subnet mask and
default gateway for each adapter bound to TCP/IP.

For Release and Renew, if no adapter name is specified, then the IP address
leases for all adapters bound to TCP/IP will be released or renewed.

For Setclassid, if no ClassId is specified, then the ClassId is removed.

Examples:
    > ipconfig                   ... Show information.
    > ipconfig /all              ... Show detailed information
    > ipconfig /renew            ... renew all adapters
    > ipconfig /renew EL*        ... renew any connection that has its
                                     name starting with EL
    > ipconfig /release *Con*    ... release all matching connections,
                                     eg. "Local Area Connection 1" or
                                         "Local Area Connection 2"

C:\>ipconfig /all

Windows IP Configuration

        Host Name . . . . . . . . . . . . : topwebhosts
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Wireless Network Connection:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : Intel(R) PRO/Wireless LAN 2100 3B Mi
ni PCI Adapter
        Physical Address. . . . . . . . . : 00-0C-F1-65-5B-70
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.1.100
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
        DHCP Server . . . . . . . . . . . : 192.168.1.1
        DNS Servers . . . . . . . . . . . : 192.168.1.1
        Lease Obtained. . . . . . . . . . : Thursday, February 08, 2007 2:27:17
PM
        Lease Expires . . . . . . . . . . : Thursday, February 15, 2007 2:27:17
PM

Ethernet adapter Local Area Connection:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Mobile Connecti
on
        Physical Address. . . . . . . . . : 00-0D-60-FB-4E-E9

To learn the names of ethernet adapters that you can optionally specify with "ipconfig" command, you may simply type ipconfig command by itself. The command output displays all adapters by name that are available on your computer: e.g. "Local Area Connection", "Wireless Network Connection".

Ipconfig command is most often used to diagnose network problem on a Windows machine. If you're using DHCP, you may try releasing and renewing IP address by performing "ipconfig /release" and "ipconfig /renew" commands shown below.

C:\> ipconfig /release
Windows IP Configuration

No operation can be performed on Local Area Connection while it has its media di
sconnected.

Ethernet adapter Wireless Network Connection:

        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 0.0.0.0
        Subnet Mask . . . . . . . . . . . : 0.0.0.0
        Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection:

        Media State . . . . . . . . . . . : Media disconnected

C:\> ipconfig /renew

Windows IP Configuration

Ethernet adapter Wireless Network Connection:

        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 192.168.1.100
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1

To workaround DNS caching issue, you may perform "ipconfig /flushdns" to clear DNS cache value on your computer. DNS uses TTL (Time-To-Live) value which let the intermediate name servers to cache DNS information. If you changed your DNS settings, and your computer doesn't see the change immediately, you may perform "ipconfig /flushdns" to clear the DNS cache.

C:\> ipconfig /flushdns

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

FAQ:

On Windows Vista machine, if you are getting an error "The requested operation requires elevation", you'll need to run Command Prompt as an administrator. To do this, you'll need to do the following:

All Programs -> Accessories -> right click Command Prompt and click Run as administrator!

What is Denial of Service (DoS) attack?

DoS attack, denial-of-service attack, is an explicit attempt to make a computer resource unavailable by either injecting a computer virus or flooding the network with useless traffic. There are two types of DoS attacks: computer attack and network attack. Common forms of denial os services attacks are:

Ping of death 

Ping of death is caused by an attacker deliverately sending a ping packet, normally 64 bytes, that is larger than the 65,535 bytes. Many computer systems cannot handle an IP packet larger than the maximum IP packet size of 65,535, and often causes computer systems crash. It is illegal to send aping packet of size greater than 65,535, but a packet of such size can be sent if it is fragmented. When a receiving computer reassembles the packet, a buffer overflow occurs, which often causes computer to crash. This exploit has affected a wide variety of systems including Unix, Linux, Mac, Windows and routers; but the fixes have been applied since 1997 making this exploit mostly historical.

Ping of flood 

Ping of flood is caused by an attacker overwhelming the victim's network with ICMP Echo Request (ping) packets. This is a fairly easy attack to perform without extensive network knowledge as manyping utilities support this operation. A flood of ping traffic can consume singificant bandwidth on low to mid-speed networks bringing down a network to a crawl.

Smurf Attack 

Smurf attach exploits the target by sending repeated ping request to broadcast address of the target network. The ping request packet often uses forged IP address (return address), which is the target site that is to receive the denial of service attack. The result will be lots of ping replies flooding back to the innocent, spoofed host. If number of hosts replying to the ping request is large enough, the network will no longer be able to receive real traffic.

SYN Floods 

When establishing a session between TCP client and server, a hand-shaking message exchange occurs betwen a server and client. A session setup packet contains a SYN field that identifies the sequence in the message exchange. An attacker may send a flood of connection request and do not respond to the replies, which leaves the request packets in the buffer so that legitimate connection request can't be accommodated.

Teardrop Attack 

Teardrop attack exploits by sending IP fragment packets that are difficult to reassemble. A fragment packet identifies an offset that is used to assemble the entire packet to be reassembled by the receiving system. In the teardrop attack, the attacker's IP puts a confusing offset value in the sebsequent fragments and if the receiving system doesn't know how to handle such situation, it may cause the system to crash.

Mail Bomb 

Unauthorized users send large number of email messages with large attachments to a particular mail server, filling up disk space resulting in denied email services to other users.

What is distributed DoS (DDoS) attack? 

DDoS (Distributed Denial Of Service) is a tactic used to attack a victim from multiple compromised computers. Attacker installs a virus or trojan software on compromised systems, and use them to flood a victim's network in a way that the victim's server cannot handle it.

DDoS involves 3 parties: an offender, helpers and a victim. The offender is the one who plots the attack, and helpers are the machines that are compromised by the offender to launch attack against a victim (the target). The offender commands the helpers to attack the victim's host at the precisely same time. Due to this co-ordinated nature between the offender and helpers, the DDoS is also known as co-ordinated attack.

Resolutions 

If you suspect a DoS or DDoS attack due to a significant network slowdown or denied service, you may execute a few diagnostic Linux commands to find a host under attack.

First, you'll have to identify a host under DoS or DDoS attack. To do this, you'll have to monitor network traffic and see where the traffic is coming from and where they are going. This can be done with ethereal or tethereal Linux command.

# tethereal
  0.809751  10.1.1.5 -> 192.168.1.4 IP Fragmented IP protocol 
(proto=UDP 0x11, off=2960)
  0.810357  10.1.1.5 -> 192.168.1.4 IP Fragmented IP protocol 
(proto=UDP 0x11, off=1480)
...

## If you do not have ethereal installed, you may use 'yum' to
## install it on your system.
# yum install tethereal

Once you have identified the host, logon to the server and find server load. You may use w, uptimecommand to find server load. You may also use top and ps commands to determin Linux process that consumes most resource. To learn more about top command output, please read an article abouthigh volume traffic.

# uptime
 15:19:51 up 127 days, 5:39, 2 users, load average: 10.78, 8.68,
4.82

# top
top - 15:20:02 up 127 days, 5:39, 2 users,  load average: 10.78,
 8.68, 4.82
Tasks: 170 total,   6 running, 163 sleeping, 0 stopped, 1 zombie
Cpu(s): 3.5% us, 1.7% sy, 0.1% ni, 94.3% id, 0.4% wa, 0.0% hi,
 0.0% si
Mem:   2074924k total,  2046676k used,    28248k free,    58692k
 buffers
Swap:  4192956k total,      144k used,  4192812k free,  1553828k
 cached

  PID USER   PR NI  VIRT  RES SHR S %CPU %MEM   TIME+  COMMAND
14815 apache 25  0 52776  628 500 R 98.6  0.0  9:59.91 cw7.3

DoS and DDoS attacks occur due to running vulnerable software on your server(s). The attackers use known application vulnerability and security holes to compromise the servers in different network either by installing viruses and trojan horses (intrusion) or initiate DDoS attacks. To prevent DoS and DDoS attacks, you may take following actions.

1. Install Intrusion Detection System (IDS) such as Advanced Intrusion Detection Environment (AIDE). For installation procedure, consult Linux Gazzette. Perform regular system audits by installing and running RKHUNTER and CHROOTKIT to make sure installed Linux binaries are healthy. You may also install open-source network audit tools like NESSSUS, NMAP, and SAINT and perform regular network audits for vulnerabilities.

2. Implement Sysctl. Prevent ping attacks (ping of death, ping of flood, and smurf attacks) by disabling ping responses on the network machines. Enable IP Spoofing protection, and TCP SYN Cookie Protection. On Linux variant machines, follow sysctl configuration procedure.

3. Install advanced firewall and DDoS utilities. To secure your server and protect from DoS attacks, you may want to install APF, BFD, DDoS and Rootkit. To install those utilities, please follow DDoS Prevention: APF, BFD, DDoS and RootKit setup procedure.

APF: Advanced Policy Firewall
BFD: Brute Force Detection
DDoS: DDoS Deflate
Rootkit: Spy and Junkware detection and removal tool

4. Install Apache mod_evasive and mod_security modules to protect against HTTP DDoS attacks. For installation procedures, consult mod_evasive and mod_security how-tos.

For more technical information, please visit CERT or Wikipedia.

PC Maintenance 3

Using Disk Defragmenter In the June and August newsletters, I explained how to use ScanDisk and Disk Cleanup. If you didn't get those issues, scroll to the bottom of this page for the links to the June and August columns. It's important that you run both ScanDisk and Disk Cleanup before you use Defrag. When you load a program or save a file onto your hard drive, your computer looks for the nearest open area and starts writing to it. If that space isn't big enough to hold the entire file, the disk drive will look for the next space and continue writing. If you have deleted a lot of files, there will be more spaces and these spaces won't all be side by side waiting for new data. Actually, it's not your hard drive that is fragmented, it's your files. The next time you want to load a file, your drive has to go looking for it all over the drive. This is why your hard drive slows down after a while. The Disk Defragmenter that comes with Microsoft Windows rearranges files and unused space, making your programs run faster. Here's how to do it: First, close all programs, including your Anti-Virus programs. To see what you have open, look on your task bar to the left of the clock. (figure 1) Right click on each one and select exit. Don't worry, the next time you turn on your computer, they'll reappear. I've seen the suggestion to disconnect the computer from your telephone line, but I never do. I'm not sure of the reasoning behind this, but thought I'd mention it incase you want to be extra safe.

The easiest way is to click on Start on your Taskbar, then onRun. Type C:\windows\defrag and hit enter. You'll see figure 2. If you have more than one hard drive, or your hard drive is partitioned, you'll want to select "All Hard Drives". Then click onSettings on the left toward the bottom. You should check both settings under "When defragmenting my hard drive" and also the box that says "Every time I defragment my hard drive." Click "OK" twice, and Defrag will start to run. (Figure 2). I always like to see what's going on, so I click on "Show details" Figure 3 Click on Legend in Figure 4 and you'll see what all those little squares mean. Figure 4 With today's huge hard drives, degragging can take quite a while, but it's worth it. I usually set it up and go do something else or go to bed.

PC Maintenance 2

Computer Maintenance, Part 2 Using Disk Cleanup In Part 1 I explained how to run ScanDisk. Now we'll go over the next step in hard drive maintanence, Disk Cleanup. After you've used your computer for a while, you're bound to have a lot of files you don't need. These could be temporary Internet files, downloaded files, or files in the Recycle Bin, for example. Windows includes a utility with versions 98 through XP that does a decent job of getting rid of some of the clutter. Disk Cleanup in Windows XP is a little different than in the other versions, but not a lot. In the other versions Click on START on the task bar. Click on Programs, Accessories, System Tool, and then Disk Cleanup Click the drive you want to clean. The program will tell you how much disk space is available for cleanup. You will now see a Disk Cleanup window that has 3 tabs at the top. The General tab shows categories of files you may delete. When you click on one, you'll see an explanation below in the gray part of the window. Click on the View Files button, and you'll see a list of the files in that category. To delete the files, put a check in the box beside the file category.

If you click the More Options tab, you'll be able to delete Windows components you don't need. Click on the Clean Up < B>button for Windows Components. For example, I deleted Paint because I never use it. Then click on Clean Up underInstalled Programs. You'll see a list of the programs on your disk. Be careful. If you don't know what a program does, you probably should leave it alone. Click on OK. You'll be asked if you are sure you want to delete files. Most likely you're ready to click Yes If you have a newer computer, you probably have lots of room on your hard drive. However, it's still a good idea to get rid of what you don't need. You'll be sur-prised how fast your drive can fill up. It's important to keep at least 100 MBs free on your C drive so Windows can use it to function smoothly. Otherwise, you won't be able to burn CDs if you have a burner, or your drive could start getting slower and slower. If you're using Windows XP, you have one other type of data you may want to remove, the restore points. Don't remove all of them. Keep the most recent. Also, in Win-dows XP, you may get the following message: "You are running out of disk space on [drive]. To free space on this drive by deleting old or unnecessary files, click here." This first turns up when you have only 200 MBs available. If you click on the message, you open Clean Up. If you're really getting low on space, you start get-ting messages more often. It's easy to clean up the clutter, so there's no reason to run out of space. There are software programs you can buy that do a better job, or at least are easier to use. This type of program works best when it�s installed when the com-puter is new. It needs to keep track of all your pro-grams. However, in combination with the Disk Cleanup utility, you can do a really good job of getting rid of useless files. Next month's topic will be defragmenting your hard drive - what that means and how to do it. ScanDisk and Clean Up are the steps you should take before you run DeFrag.

PC Maintenance

Computer Maintenance, Part 1 Don't let the word maintenance scare you - you don't have to open up the case to your computer. There are a few procedures you can do that will keep your computer functioning smoothly - at least most of the time. ScanDisk This utility comes with all Windows versions except NT. It is scans for errors on your hard drive. Sometimes parts of your files get "misplaced." Scandisk can find these lost parts and put them back where they belong. Before you run this utility, be sure you've closed any other programs that are running. For Windows 95/98/ME, go to: Start/Programs/Accessories/System Tools/ScanDisk You'll see a box like figure 1. My hard drive is partitioned into 2 sections, C and D which act like separate drives. If this is true of yours or you have more than 2 partitions, you'll need to use ScanDisk on each drive separately. The Standard scan doesn't take as long, and you may want to do that first. If that finds many errors, or stops and won't go on, then you'll need to do the Thorough scan. I usually do that one whenever I run ScanDisk. If you click on Options, you'll see figure 2. If you haven't scanned your disk before or it's been a long time, be sure to choose the top option. Otherwise, you might want to only scan one of the others. I always do the top one. If you click on Advanced, you'll see figure 3. I suggest you check the ones checked in the illustration. Back at figure 1, you see the choice "Automatically fix errors." This should be checked also. Then click on start, and sit back to wait. The rest is taken care of for you. If may take a while or even start over a few times.

If you have Windows XP, Double click on the My Computer icon which should be on your desktop. Right click on C: drive. Left click on Properties. Click on Tools tab: Error-checking is the same as Scandisk. Select: Automatically fix.....errors. It will tell you it can't run it now, but will next time you reboot. So agree to that. That's all there is to it. You should run ScanDisk once a month if not sooner. Some people feel you should run ScanDisk once a week. Next month we'll go over the Cleanup utility that comes with Windows 98/ME/200 or XP. Its purpose is to get rid of unneeded files. Figure 1    Figure 2 Figure 3

Computer Maintenance

Ten Tips to Keep your Computer Running Smoothly

1. Never, never, turn your computer off with the power switch until Windows has shut down.

The one exception to this rule is when your computer locks up and your hard drive is not running (hard drive light is not blinking). In this situation, you can turn the power off without harmful effects to the hard drive. As cutting the power can also result in lost data or Windows files, you should only do this when you have to.

Following this rule will prevent permanent hard drive defects caused by the hard drive heads contacting the surface of the drive disc, and it will prevent a host of Windows problems.
Whenever possible, recover from crashes by pressing the Ctrl + Alt + Delete keys at the same time. Press them again to reboot your computer.

2. I highly recommend that you purchase an UPS (uninteruptable power supply) for your computer. This will keep your computer from crashing during power outages, and will protect your computer from low and high voltage occurrences.
An UPS is far superior to a surge protector and will save your computer from almost any type of power disaster. (See #1 above for what happens when your computer crashes.)

3. Backup, backup, backup, any data you cannot afford to lose to at least two separate physical drives. So backup data to external hard drives, Zip disks, CD-RWs etc.
The time to backup is when you create something you can't afford to lose. Don't wait until tomorrow.

4. Run Scandisk and Defragment at least once a month. This will keep your hard drive healthy and prevent crashes. Alternatively, purchase Norton Utilities and use it to keep your hard drive healthy.

5. Never unplug peripherals from the computer when it is powered up. Unplugging with the power on can short out the connector socket or the motherboard.

The only exception to this rule is if you know a peripheral is "hot pluggable". If you do not know what "hot pluggable" means then ignore this exception.

6. Do keep at least 300 MBs of your C: drive free for Windows to use. If you useWindows XP or Vista then you should have 400-600 MBs of free space on your C: drive.
If you do not have enough free space you will choke Windows and it will start dumping data to your hard drive, or it will just get really, really, slow.
Use the ADD/Delete tool in the Windows Control Panel to delete unneeded programs from your drive.
You can also use Cleansweep included in Norton Utilities to clean up your drive. If you do use Cleansweep or another hard drive cleaner, do not delete shared files unless you back them up. The cleaners do a rotten job of knowing if another program uses shared files.

7. Do not let a lot of programs load up when you start your computer. They use valuable memory and Windows Resources (Windows internal workspace).
All programs in your Windows System Tray (in the lower left of your screen) are running on your computer. Close them if you don't need them or run them and configure them not to load when you boot up.
Other programs running in the background can be found by pressing Ctrl + Alt + Delete at the same time.

8. Do use a virus checker regularly. Everyone should use a virus checker. The best type of protection is continuous monitoring from a dedicated anti-virus program like Norton Antivirus.
The second best thing is to use is the free online virus checkers such as Housecall provided by Trend Micro.

9. If you have a high speed Internet connection you need a firewall program. A firewall program keeps those who want to hijack your computer from gaining access to your system. You really do not want someone else running your computer.
I suggest you purchase and run Norton's Personal Firewall program. Your firewall should boot up with your computer to protect it from invasion.

Case in point: When I am online 10 hours or more with my DSL connection, my computer is usually attacked by a hacker at least once.
Do not think you are safe from hackers!! Hackers use search programs to seek out computers at random. Get a firewall program and use it.

10. Keep track of the software disks you receive with your computer and new peripherals. These disks contain valuable software drivers and programs for Windows and are needed when Windows must be reloaded. Keep these disks and your Windowssoftware disks in a safe, dry, place -- you never know when you will need them.

Speeding up the Windows XP's shutdown

It’s not only start-up that you’d like to speed up; you can also make sure that your system shuts down faster. If shutting down XP takes what seems to be an inordinate amount of time, here are a couple of steps you can take to speed up the shutdown process:

Don’t have XP clear your paging file at shutdown. For security reasons, you can have XP clear your paging file (pagefile.sys) of its contents whenever you shut down. Your paging file is used to store temporary files and data, but when your system shuts down, information stays in the file. Some people prefer to have the paging file cleared at shutdown because sensitive information such as unencrypted passwords sometimes ends up in the file. However, clearing the paging file can slow shutdown times significantly, so if extreme security isn’t a high priority, you might not want to clear it. To shut down XP without clearing your paging file, run the Registry Editor (click Start > Run, then type regedit in the Run box) and go to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

Change the value of ClearPageFileAtShutdown to 0. Close the Registry, and restart your computer. Whenever you turn off XP from now on, the paging file won’t be cleared, and you should be able to shut down more quickly.

Note: Please be careful when editing the Registry; you can do a lot of damage here. Don’t change or delete anything unless you know exactly what it is.

Seven Golden Rules for Disk Maintenance

Let's begin with a proactive approach to file system maintenance. What steps should an administrator take to help prevent file system problems from happening in the first place? Here are my seven golden rules on the subject, in no particular order:

1. Upgrade your servers to Windows Server 2003. There's real value in doing this as far as disk maintenance is concerned, for example:

• The chkdsk command in Windows Server 2003 runs a lot faster than the Windows 2000 version of this utility, plus it can fix things like a corrupt Master File Table (MFT) that the previous version of the utility would choke on.
• Powerful new command-line tools like DiskPart.exe, Fsutil.exe and Defrag.exe give you more flexibility for managing disks from the command-line instead of the GUI. These tools can be scripted to automate common disk management tasks you need to perform on a regular basis.
• The new Automated System Recovery (ASR) feature greatly simplifies the task of restoring your system/boot volume in the event of catastrophic disk failure.

2. Use hardware redundancy. RAID 1 disk mirroring lets you recover from catastrophic system volume failure with zero downtime, while RAID 5 is a great way of protecting your data volumes. Windows servers include support for built-in software RAID but you'll get better performance and true hot-swap redundancy by investing more money and buying a hardware RAID controller for your system instead. Don't forget though, keep a few spare drives handy so you can swap them during an emergency—redundancy is useless if you don't have the redundant hardware around to use it. Note that if you do choose to go with the software RAID provided by Windows, mirroring your boot and system volumes requires that these volumes be one and the same i.e. one volume is both your boot volume (contains operating system files) and your system volume (contains hardware-specific boot files).

3. Use a good antivirus program. Viruses can be nasty, and one of the things they can do when they infect a machine is to corrupt the Master Boot Record (MBR) and other critical portions of your hard drives. Not only should you have AV installed on your servers, you should also avoid risky behaviors such as running scripts from untrusted sources, browsing the web, and so on. These are just the kinds of behavior that can lead to infecting your system, so avoid doing things like this on your production servers.

4. Defragment your file systems on a regular basis. This is especially important on servers on which a high number of transactional operations occur as the file systems can quickly become fragmented, dragging down the performance of applications running on your server. To perform a successful defrag you should really have at least 15% free space left on your disk, so make sure you don't let critical system or data disks fill up too much or they'll be harder to maintain. The new command-line Defrag.exe tool of Windows Server 2003 is useful here since you can schedule regular running of this tool during off-hours using the Schtasks.exe command instead of having to defrag manually or buy a third-party defrag tool.

5. Run chkdsk /r on a regular basis. This command finds bad sectors on your disk and tries to fix them by recovering data from them and moving it elsewhere. You can run this command either from a command-prompt window or from the Recovery Console if you can't boot your system normally. Remember that when you try and run chkdsk.exe on your system or boot volume, Windows configures autochk.exe (the boot version of chkdsk.exe) to run at your next reboot. This means you'll need to schedule downtime for your server when you perform this kind of maintenance so that autochk.exe can run.

6. Check your event logs regularly for any disk-related events. Windows sometimes determines on its own when a disk is "dirty" i.e. there are file system errors present on it. In that case, Windows automatically schedules autochk.exe to run at the next reboot, but it also writes an event to the Application log using either the source name "Chkdsk" or "Winlogon". So filter your Application log to view these kinds of events on a regular basis or collect them using Microsoft Operations Manager (MOM) or whatever other systems management tool you use on your network.

7. Back up all your volumes regularly. As a last recourse in the event of a disaster, having working backups of both your system/boot volume and data volumes is critical. ASR in Windows Server 2003 makes backing up the boot/system volume easier, while backing up your data volumes can be done using the Windows Backup (ntbackup.exe) tool or any other backup tool such as one from a third-party vendor. Whatever way you choose to back up your system, do it regularly and verify your backups to ensure you can recover your system using them.

I should also add an eighth and final rule as well:

8. (the Platinum rule) If your disk starts to make funny sounds, don't ignore them—do something. Disk failure is often preceded by funny sounds emanating from your computer. These clicking, scraping, screeching, or other types of sounds mean trouble, so when you hear them it's time to make sure you've got a recent backup and a spare disk handy just in case. And it's also time to check your event logs, run chkdsk –r, and use other maintenance and troubleshooting tools to check the health of your disks. Don't ignore these funny sounds!