The Windows XP Layout

By Stu Sjouwerman

Date: Nov 7, 2003

Sample Chapter is provided courtesy of Que.

Return to the article

---

This sample book chapter looks at the file and folder structure created by a Windows XP installation, provides a roadmap for important programs, and discusses other issues related to file structure and layout.

---

When compared to other Microsoft operating systems, Windows XP has many important differences, ranging from capabilities to functions and security, but one rarely discussed area is the layout of Windows XP files and components.

This chapter looks at the file and folder structure created by a Windows XP installation, provides a roadmap for important programs, and discusses other issues related to file structure and layout.

Windows XP Directory Structures

The Windows XP installation routine makes several changes to your hard drives. Windows XP uses two different partitions to store its information: a system partition and a boot partition. These partitions can exist on a single physical partition or on two physical partitions. Unfortunately, the way these terms are used is the reverse of common sense usage. The system partition is the partition containing the initial bootstrap components and the boot menu. The boot partition is the partition hosting the Windows XP root folder and all operational drivers and files.

The boot and system partition files can be located on the same partition, on different partitions, or even on different hard drives. However, the system partition must always be on the first hard drive in the system and must be an active primary partition. The boot partition can be a primary partition or a logical drive within an extended partition.

System Partition

Table 3.1 shows the files contained on the system partition for an x86 computer.

Table 3.1 Files Located on the System Partition for an x86 Computer

File	Description
NTLDR	Controls the operating system boot selection process and hardware detection before the actual Windows XP Kernel is launched. It requires that boot.ini, ntdetect.com, bootsect.dos (if dual booting), and ntbootdd.sys (if booting on a non-BIOS enabled SCSI drive; that is, scsi() is used instead of multi() in the ARC name in boot.ini) exist in the root system partition.
boot.ini	Contains the contents of the boot menu displayed by NTLDR. This file contains the default operating system selection, the timeout period for the selection, and an ARC name or pathname for each listed operating system boot selection.
ntdetect.com	Detects the major components of the computer before NTLDR selects a configuration and loads the Kernel.
bootsect.dos	Present only on dual-boot systems. NTLDR uses this file when the selected operating system is not Windows XP. Bootsect.dos in turn seeks out the OS-specific operating system loader file, such as io.sys for MS-DOS or os2ldr.exe for OS/2.
ntbootdd.sys	Used only on systems with SCSI drives that do not have on-board BIOS translation enabled. It is a copy of the device driver for your particular SCSI drive.
hiberfil.sys	Available if hibernation is enabled on the computer.

• For more information on the boot.ini file, see Chapter 7, "Booting Windows XP," p. 129.

Other files can appear in the system partition on x86 dual-boot and multi-boot systems. The addition of these files does not affect the function or capabilities of the required Windows XP boot files in the system partition. Installing multiple operating systems on a single computer with Windows XP Professional (or Home Edition) often requires a specific installation order or manual post-installation configuration changes. Both the Microsoft Windows XP documentation and TechNet include detailed articles on performing multi-boot setups with Windows XP Professional, Windows 2000 Professional, Windows Server 2003, Windows 95, Windows 98, MS-DOS, and OS/2.

Multi-booting Windows XP with non-Microsoft operating systems, such as Linux, often requires third-party boot and partition managers. For popular tools, see the "For More Information" section at the end of this chapter. Red Hat Linux contains two boot loaders—LILO and GRUB—that can also be used for a dual-boot configuration with Windows XP.

The system partition does not include any folders. It exists as a root folder only with three or more files. Having additional folders in the system partition does not affect the operation of boot files.

You might notice that the files in the system partition are among the files found on an Emergency Repair Disk (ERD). This should not be surprising because an ERD is used to restore files to the system partition if these files are corrupted, deleted, or otherwise destroyed.

Boot Partition

The directory structure and subsequent files installed into the boot partition are quite a bit more complex than those of the system partition. Table 3.2 describes the five folders created in the boot partition's root folder (normally the C:\ drive) during the installation of Windows XP.

Table 3.2 Folders Created by Windows XP in the Boot Partition's Root Folder

Directory	Description
Documents and	This folder is used to hold the configurations for each user
Settings	who accesses the system. In Windows NT, this information was stored in the \Windows\profiles folder.
Program Files	This folder is the default installation location for Windows applications.
System Volume Information	This folder stores all disk permission and security information.
Recycler	This is not a true folder; instead, it is the system-controlled temporary repository for deleted files. You can access its contents by launching the Recycle Bin tool from the desktop.Note that this folder does not appear until a file is deleted.
Windows	This is the main folder containing all the Windows XP system files, and the default folder for Windows XP.

The root of the boot partition is also the default location for pagefile.sys, which is the page file the Windows NT virtual memory system uses.

• For information on how to tune Windows XP performance by placing and configuring the page file, see Chapter 22, "Tuning and Optimizing Windows XP," p. 485.

The Program Files folder is home to 16 subfolders:

• Common Files. This folder contains files shared with the Microsoft applications.

• ComPlus Applications. This folder contains files used by ComPlus applications. If there are no ComPlus applications installed on your XP machine, this folder will be empty. COM+ builds on the Microsoft Component Object Model (COM) integrated services and features, making it easier for developers to create and use software components in any language, using any tool.

• Internet Explorer. This folder contains the files and executables for Internet Explorer, a Web-browsing tool.

• Messenger. This folder contains files and executables for the new Windows Messenger Service. This service combines features found in MSN Messenger with an improved communications infrastructure.

• Movie Maker. This folder contains the files and executables for the Movie Maker application.

• MSN. This folder contains the files and executables for MSN Explorer, the new Internet connectivity tool from Microsoft that combines Web, e-mail services, and Internet setup services.

• MSN Gaming Zone. This folder contains the files and executables for the MSN Gaming Zone.

• NetMeeting. This folder contains all the files used by Microsoft NetMeeting.

• Online Services. This folder contains files used to establish Internet connectivity. These files enable you to set up Internet access through MSN or to select another available Internet service provider.

• Outlook Express. This folder contains all the files and executables needed by Microsoft Outlook Express, a simple e-mail application.

• Uninstall Information. This is a hidden folder containing files and information for uninstall services.

• Windows Media Player. This folder contains the Microsoft Media Player application.

• Windows NT. This folder contains any applications that have been ported over from other Windows operating systems (such as Pinball). This folder has empty folders in it if the ported components were not selected during installation.

• Windows Update. This folder contains all the files used by the Windows Update Service.

• Xerox. This folder contains all the files used by Xerox applications. By default, this folder is empty.

The Windows root-level folder contains an extensive subfolder hierarchy but very few files. The Windows\System32 folder is the main repository of all files required to launch and operate Windows XP. The following files are among those stored in the Windows folder:

• Wallpaper and tiling images (.bmp)

• Initialization and configuration files for backward-compatibility with various 16-bit utilities and applications (.ini)

• Readme, log, and documentation files (.txt, .log, and .wri)

The following is a listing of the subfolders under the Windows folder:

• Addins. ActiveX controls files.

• AppPatch. Contains application compatibility .dlls and Appfix packages.

• Config. Contains configuration .idf files used by the MIDI sound system. Depending on system configuration, this folder might be empty.

• Connection Wizard. Files used for establishing Internet connectivity. Can be an empty folder.

• CSC. The Client Side Cache is where contents of mapped network drives are cached so that the contents of these drives will be available offline. By default, this folder contains empty folders.

• Cursors. Contains static and animated cursor files. You can use these files by configuring the Mouse applet.

• Debug. Contains .log files that can be used to debug network connectivity and other setup functions.

• Downloaded Program Files. Contains ActiveX controls and Java applets that have been downloaded from the Internet.

• Driver Cache. Contains a platform subdirectory and a copy of the driver.cab file so that new devices can be easily installed without needing the Windows XP CD. Might contain SP1.cab if installing an integrated copy of the operating system.

• Fonts. Contains all installed fonts.

• Help. Contains the help files used by the Windows XP Help system and all its native utilities.

• Ime. Files to support the Input Method Editor. Provides language support for Windows XP.

• Inf. Contains the .inf (system information) files used to install software components. This is a hidden folder.

• Installer. The location for temporary files used by the Windows Installer program. This is a hidden folder.

• Java. Folder structure for Java files.

• Media. Contains media files (sound and video) used by sound themes.

• Msagent. Microsoft agent files, which are software services that support using animated characters in the Windows interface to assist users in manipulating the operating system.

• Msapps. Contains files for backward-compatibility with applications that use shared components.

• Mui. MUI (Multilingual-User Interface) Packs give companies flexibility in making language options available to users.

• Offline Web Pages. Any Web pages designated as offline accessible are stored in this folder, along with any images and other files that go with it.

• PCHEALTH. Contains files and subfolders to support the Microsoft Help Center Service. These files support all the Windows XP Help services, including features such as Remote Desktop Assistance.

• Prefetch. Contains the files that XP is tracking for prefetch execution. Caching frequently used files decreases startup time for applications and optimizes XP performance.

• Registration. Contains files that support COM+ applications.

• Repair. Contains backup copies of the permanent Registry hives. The NTBackup program updates this directory with the System State option.

• Resources. Contains files to support the user's shell interface.

• Security. Contains subfolders and files related to security. Includes log files that define the default security applied during setup and templates for assigning new security privileges.

• Srchasst. Contains files and subfolders for Search Companion, the updated search assistant included with XP. Includes files to support an indexing function that improves search performance.

• System. Contains 16-bit versions of protected and real mode drivers and .dll files used by applications. These files are provided for backward-compatibility with older applications. Additional 16-bit driver files can be stored in this folder.

• System32. Contains the core operating system files and subfolder trees.

• Tasks. Contains scheduled tasks that run without operator intervention.

• Temp. Contains any temporary files used by the system and applications.

• Twain_32. Contains files to support Twain technology, enabling a scanner document to be inserted into a file.

• Web. Contains files and subfolders to support Internet printing and document access.

• WinSxS. A folder to store the shared components of side-by-side applications. These can be multiple versions of the same application or the same assembly.

The System32 subfolder contains most of the files used by Windows XP. This is the primary storage location for DLLs, Control Panel applets (.cpl), device drivers (.drv), help files (.hlp and .cnt), MS-DOS utilities (.com), language support files (.nls), screensavers (.scr), setup information files (.inf), and a handful of other files used for support, configuration, or operation.

The most commonly accessed subfolders in Windows\System32 are described in the following list:

• 1025, 1028, 1031, 1033, etc. Contains locationization languages files. Most of these folders will be empty. The English language is 1033. The complete list of locale IDs can be found at http://www.microsoft.com/globaldev/reference/loclanghome.mspx.

• CatRoot. Contains security catalog files.

• CatRoot2. Contains catalog database files.

• Com. Contains COM object information.

• Config. Contains the Registry hives used during bootup and is the storage location for the System, Security, and Application log files viewed through Event Viewer. Config now contains a new folder called \systemprofile that holds a standard profile for the local system.

• DHCP. This is an empty folder used to hold Dynamic Host Configuration Protocol (DHCP) database files if the host becomes a DHCP server.

• DirectX. Contains files to support the accelerated performance features of game devices.

• Dllcache. Contains backup copies of the operating system files that are under the Windows File System Protection system.

• Drivers. Contains driver files (.sys); the \etc folder contains sample copies of the TCP/IP text-based configuration files, such as Hosts and LMHosts files.

• Export. This is an empty folder.

• IAS. If there is no Internet connection capability, this is an empty folder used to hold configuration files for the Internet Authentication Service. This service is typically found on servers. If the machine has a device capable of connecting to the Internet, the IAS folder should not be empty. It will contain two files: DNARY.MDB (used to phrase IAS log files) and IAS.MDB (used to store remote access policies).

• Icsxml. Contains files for Univeral Plug and Play.

• IME. Contains files for Input Method Editors.

• Intsrv. Contains files used by the World Wide Web service. This folder is empty.

• Macromedia. Contains a subfolder with the Shockwave Flash .ocx file.

• MsDTC. Contains Microsoft Distributed Transaction Coordinator files that control transaction output and message delivery between two different applications or processes.

• MUI. Contains Multilingual-User Interface files that are created by applications, such as Service Pack 1.

• Os2. Contains drivers used by the OS/2 subsystem.

• NPP. Contains files to support collecting network traffic from an XP PC by a Network Monitor server.

• Oobe. Contains "Out of Box Experience" files that prompt users to complete product activation and registration and to create a new user other than Administrator. This feature is activated only after setup.

• Ras. Contains the default scripts used by Dial-Up Networking.

• Restore. Contains a list of files to be monitored and saved to an alternative location in case of file corruption. The System Restore service takes snapshots of the XP system periodically to enable the system to be restored from a previous set of data. This folder also contains the machine GUID.

• Setup. Contains setup files for additional services, such as FrontPage Server Extensions and Microsoft Fax.

• ShellExt. By default, this folder is empty.

• Spool. Used by the printing system to store spooled print jobs and related files. The Printers subfolder is used to store spool files. The other folders found here vary based on printer drivers and configuration.

• USMT. USMT stands for User State Migration Tool. This folder contains files to support both USMT and the File and Settings Transfer Wizard. Both tools enable user files and settings to be copied to another PC.

• WBEM. Used by Web Based Enterprise Management to store its data and executable files and utilities. The Microsoft implementation of WBEM is the Windows Management Instrumentation (WMI) Service. With WMI, programmers can create applications that control network devices, using the same commands regardless of platform.

• Wins. Contains files to support the Windows Internet Name Service (WINS). This folder is empty.

As you can see, the folder structure that the Windows XP setup process creates is quite extensive. If you add services and applications from the Windows XP distribution CD, install service packs and hotfixes, upgrade Internet Explorer, add Microsoft Outlook, or install other Microsoft and third-party applications, this folder structure increases in depth and complexity.

Key Windows XP Executables

The range and number of files included in the Windows XP folder structure are enormous. Most of these files are drivers, DLLs, or some type of configuration storage. Driver, configuration, and DLL files sustain the operating environment. However, most of the executable (.exe) files and the MS-DOS utilities (.com) are quite useful. You can launch them from the Start menu or other standard GUI launch site (when applicable), or you can launch them from Windows Explorer, My Computer, or a command prompt or through the Run command from the Start menu. The following sections list the files you can launch manually and briefly describe each utility or application.

Main Windows Root Folder

The following executables reside in the main Windows root folder:

• EPLORER.EXE (Windows XP Explorer). Used to interact with the file systems hosted by Windows XP. It is also the program responsible for creating the Start button and associated objects. If you ever lose the desktop, the Start button, and the taskbar, you can usually restore them by pressing Ctrl+Alt+Delete, selecting Task Manager from the pop-up menu, and starting Explorer back up with the Run command, accessed by choosing File, New Task (Run) from the menu.

• HH.EXE (HTML help). Opens an HTML-based Help window.

• NOTEPAD.EXE (Notepad). Used to edit text files.

• REGEDIT.EXE (Registry Editor). A 16-bit Registry-editing tool that you can use to search the entire Registry at once.

• TASKMAN.EXE (Task Manager). Used to view active applications and processes and view CPU and memory performance.

• TWUNK_16.EXE (Thunking Server). Allows 16-bit DOS applications to make 32-bit calls.

• TWUNK_32.EXE (Thunking Server). Allows 32-bit DOS applications to make 16-bit calls.

• WINHELP.EXE (Windows Help). A 16-bit Windows Help reader.

• WINHLP32.EXE (Windows Help). A 32-bit Windows Help reader.

Windows\System32

The following list of executables resides in the Windows\System32 folder:

• ACCWIZ.EXE (Accessibility Wizard). Used to configure the different accessibility options of your system.

• ACTMOVIE.EXE (DirectShow Setup Tool). Part of the the DirectX series of tools. Used for media capture and playback.

• AHUI.EXE (Application Compatibility User Interface). Used to configure the different accessibility options of your system.

• ALG.EXE (Application Layer Gateway Service). Used to configure the different accessibility options of your system.

• APPEND.EXE (Append). Allows applications to open or access files in folders other than the current working, or active, folder by appending the path parameter. This utility is from MS-DOS 5.0.

• ARP.EXE (ARP). The Address Resolution Protocol command-line utility used to manage the ARP cache on TCP/IP systems.

• ASR_FMT.EXE (ASR). The Automated System Recovery utility.

• ASR_LDM.EXE (ASR). The Logical Disk Manager ASR utility.

• ASR_PFU.EXE (ASR). The Automated System Recovery Protected Files utility.

• AT.EXE (AT). Used to schedule tasks to occur at a specific time and date. It requires that the Scheduler service be running.

• ATIEVXX.EXE (ATI). The ATI Hotkey Polling utility.

• ATMADM.EXE (ATM). The ATM Call Manager utility.

• ATTRIB.EXE (Attributes). Displays or changes file attributes (read-only, archive, hidden, or system).

• AUTOCHK.EXE (Auto Check Disk). Launches automatically during Windows XP bootup if a volume is marked as dirty (has bad clusters, has error blocks, or is otherwise damaged).

• AUTOCONV.EXE (Auto Convert). Used by the Windows XP setup routine to convert a FAT volume to NTFS.

• AUTOFMT.EXE (Auto Format). The Auto File System conversion utility.

• AUTOLFN.EXE (Auto Long Filenames). Used by the Windows XP setup routine to repair, copy, or enable long filenames on drives that have been converted from another file system (usually FAT) to NTFS. Also capable of converting long filenames to the 8.3 format.

• BOOTCFG.EXE (Boot Configuration Tool). A command-line tool for editing the boot.ini file.

• BOOTOK.EXE (Boot Acceptance). Used with the Last Known Good Configuration process to save the configuration parameters after a successful logon.

• BOOTVRFY.EXE (Boot Verify). Used with the Last Known Good Configuration process to verify a boot selection.

• CACLS.EXE (Change ACLs). A command-line utility used to change or edit permissions for files and folders.

• CALC.EXE (Calculator). A GUI calculator that can act as a standard or scientific calculator.

• CHARMAP.EXE (Character Map). A GUI utility that displays the characters in each font installed on the system.

• CHKDSK.EXE (Check Disk). A disk inspection tool that can search for and repair disk errors.

• CHKNTFS.EXE (NTFS Drive Checker). Used to verify the integrity of Windows XP NTFS partitions.

• CIDAEMON.EXE (Content Index Filter Daemon). Process that determines which files will be indexed on the hard disk for faster search queries.

• CIPHER.EXE (Encrypted File System Configuration Manager). A command-line utility used to encrypt/decrypt files and folders using EFS.

• CISVC.EXE (Content Index Service). The Content Index engine that performs file indexing to improve performance of resource searches.

• CKCNV.EXE (Cookie Converter). A supporting process that controls how cookies are handled under Windows XP.

• CLEANMGR.EXE (Disk Space Cleaner). A utility used to remove unused temp files from a hard drive to reclaim used space.

• CLICONFG.EXE (SQL Server Client Network Utility). Used to configure connections from network clients to SQL servers.

• CLIPBRD.EXE (Clipboard Viewer). Used to view the contents of the object or data currently copied into memory (also known as the Clipboard).

• CLIPSRV.EXE (Clipboard Server). The network dynamic data exchange (DDE) clipboard service used by Clipboard Viewer to access objects or data copied into memory.

• CMD.EXE (Command Prompt). An executable that provides the command prompt (MS-DOS shell interpreter) for Windows NT.

• CMDL32.EXE (Auto Connection Manager). Tracks network addresses to their appropriate connection destinations to support auto-dial functions.

• CMMON32.EXE (Connection Manager). The Connection Manager Monitor.

• CMSTP (Connection Manager Installer). Installs and configures Connection Manager service profiles.

• COMP.EXE (Compare). An MS-DOS utility used to compare the contents of two files or sets of files.

• COMPACT.EXE (Compact). A command-line utility used to compress individual files or directories on an NTFS volume.

• CONIME.EXE (IME Console). The console for the Input Method Editor used to convert non-Arabic letters from a 101-keyboard.

• CONTROL.EXE (Control Panel). Provides the Control Panel window where all Control Panel applets are displayed.

• CONVERT.EXE (Convert). Used to convert partitions from FAT to NTFS and from NTFSv4 to NTFSv5.

• CSCRIPT.EXE (Command Based Script Host). A command-line version of the Windows Script Host that enables you to run previously created VBScript and JScript from the command line.

• CSRSS.EXE (Client-Server Runtime Server Subsystem). Used to maintain the Win32 system environment console and other essential functions.

• CTFMON.EXE (CTF Loader). Supports speech recognition, handwriting recognition, and other Alternative User Input services.

• DCPROMO.EXE (Domain Controller Promotion). Used to promote and demote a Windows NT or 2000 server. Installs Active Directory on the system.

• DCOMCNFG.EXE (DCOM Configuration). Used to display and configure DCOM settings and configuration.

• DDESHARE.EXE (DDE Share). Displays the active DDE shares and enables property editing for these shares.

• DEBUG.EXE (Debugger). A command-line debugging tool.

• DEFRAG.EXE (Disk Defragmenter). A command-line utility that consolidates files so that they are saved in contiguous locations on the hard disk.

• DFRGFAT.EXE (FAT Defragmentation Tool). Used to defragment FAT partitions.

• DFRGNTFS.EXE (NTFS Defragmentation Tool). Used to defragment NTFS partitions.

• DIANTZ.EXE (Cabinet Maker). Allows a file to be compressed and included in a cabinet file.

• DISKPART.EXE (Microsoft Diskpart). A command-line tool for disk management.

• DISKPERF.EXE (Disk Performance Counters). Used to switch performance counters for the disk subsystem on and off.

• DLLHOST.EXE (COM+ Server Process). The COM+ process manager.

• DLLHST3G.EXE (COM Surrogate). A COM+ process component.

• DMADMIN.EXE (Logical Disk Manager Administrative Service). Runs during hard disk configuration only.

• DMREMOTE.EXE (Logical Disk Manager). A Logical Disk Manager component.

• DOSKEY.EXE (DOS Keyboard). An MS-DOS 5.0 keyboard history utility that provides a history of command-line executions and macros.

• DOSX.EXE (DOS Extender). A virtual DOS machine (VDM) MS-DOS extender for standard mode.

• DPLAYSVR.EXE (Microsoft DirectPlay Helper). Supports game connections over a modem, the Internet, or a LAN.

• DPNSVR.EXE (DirectPlay8 Server). A forwarding service for games that have multiple processes using the same IP or IPX port.

• DRIVERQUERY.EXE (Driver Query). A command-line tool that displays a list of currently installed drivers and associated properties.

• DRWATSON.EXE (Dr. Watson). A 16-bit GUI application failure-detection and fault-logging utility that watches over the Win16 subsystem.

• DRWTSN32.EXE (Dr. Watson 32). A 32-bit GUI application failure-detection and fault-logging utility that watches over the Win32 subsystem and native Windows XP applications.

• DUMPREP.EXE (Windows Error Reporting). A dump reporting tool.

• DVDPLAY.EXE (DVD Play). A placeholder application.

• DVDUPGRD.EXE (DVDUpgrd). Upgrades a non-XP compatible DVD decoder.

• DWWIN.EXE (Microsoft Application Error Reporting). The application used to report errors in Microsoft applications.

• DXDIAG.EXE (DirectX Diagnostic Tool). A tool for troubleshooting DirectX components.

• EDLIN.EXE (Edit Line). An MS-DOS–based line editor.

• ESENTUTL.EXE (Windows XP Database Tools). A collection of tools used to check and repair the Windows XP folder.

• EUDCEDIT.EXE (Private Character Editor). An application that enables you to create up to 6,400 unique characters, such as special letters and logos, for your font library.

• EVENTCREATE.EXE (Event Create). Allows creating custom events in an event log.

• EVENTTRIGGERS.EXE (Event Triggers). This application displays and configures event triggers.

• EVENTVWR.EXE (Event Viewer). The executable for the Event Viewer.

• EXE2BIN.EXE (Executable to Binary). A programmers' tool from MS-DOS used to convert .exe files to .bin files.

• EXPAND.EXE (Expand). A command-line utility used to decompress individual files or folders on an NTFS volume.

• EXTRAC32.EXE (CAB File Extract Utility). Allows cabinet files to be extracted to disk.

• FASTOPEN.EXE (Fast Open). An MS-DOS utility that improves performance on systems that have large folders by decreasing the time it takes to open frequently accessed files.

• FC.EXE (File Comparison). An MS-DOS utility that compares files or sets of files to reveal their differences.

• FIND.EXE (Find). A command-line utility used to search for a string of characters in a file or files.

• FINDSTR.EXE (Find String). A command-line utility used to search for a string of characters in a file or files.

• FINGER.EXE (Finger). A TCP/IP utility used to obtain information about a user account via a remote system.

• FIXMAPI.EXE (MAPI Repair Tool). Detects and resolves problems with Messaging Application Programming Interface (MAPI) files.

• FONTVIEW.EXE (Font View). A command-line utility that displays a sample output for a font in a printable GUI window.

• FORCEDOS.EXE (Force DOS). Instructs Windows XP to launch an application as an MS-DOS utility when it contains the code for both OS/2 and MS-DOS.

• FREECELL.EXE (Free Cell). A GUI card game.

• FSUTIL.EXE (FSUtil). A volume management tool. Manages reparse points and sparse files.

• FTP.EXE (FTP). A TCP/IP command-line File Transfer Protocol (FTP) utility used to transfer files between the local system and a remote FTP server.

• GDI.EXE (Graphical Device Interface). A core system component that provides the Win16 Graphical Device Interface API library for backward-compatibility with Win16 applications.

• GETMAC.EXE (Get MAC Address). Displays the Media Access Control (MAC) address of the specified system.

• GPRESULT.EXE (Query RsoP Data). A tool that displays the Group Policies applied to a user or computer.

• GPUPDATE.EXE (Group Policy Refresh Utility). Manually applies Group Policies after the Group Policy administrator makes changes instead of waiting for the next automatic update.

• GRPCONV.EXE (Group Convert). Converts Microsoft Windows 3.x and Microsoft Windows for Workgroups Program Manager groups into Start menu items.

• HELP.EXE (Help). Displays basic and general help information about many Windows XP commands.

• HOSTNAME.EXE (Hostname). A TCP/IP command-line utility that displays the hostname of the current system.

• IE4UINIT.EXE (IE Install Utility). The IE 5.0 Per-user Install utility.

• IEXPRESS.EXE (Self Extracting/Installing Creator). Creates self-extracting or self-installing executable files.

• IMAPI.EXE (CD-Burning COM Service). Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this service is stopped, the computer cannot record CDs.

• IPCONFIG.EXE (IP Configuration). A TCP/IP command-line tool that displays the IP configuration for all installed interfaces and can be used to renew and release DHCP leases.

• IPSEC6.EXE (Ipv6 Security Configuration Utility). A tool for configuring IPv6 security.

• IPV6.EXE (Ipv6 Configuration Utility). A tool to install and configure IPv6.

• IPXROUTE.EXE (IPX Route). A utility used to display and control the IPX routes when using the IPX protocol.

• KRNL386.EXE (Kernel 386). Contains the core Kernel routines for Win16 enhanced mode functionality.

• LABEL.EXE (Label Drive). A command-line tool used to display, edit, or change a drive's volume label.

• LIGHTS.EXE (Lights). Provides the settings for modem status lights in Windows 95/98 by monitoring the COM ports.

• LNKSTUB.EXE (Win95-Winnt Migration Utility). The Windows 95 side of a Windows 95–to–Windows NT upgrade program.

• LOCATOR.EXE (Locator). Adds support for Remote Procedure Calls (RPCs) to the Windows XP environment.

• LODCTR.EXE (Load Counters). Used to add new counters to Performance Monitor.

• LOGAGENT.EXE (Windows Media Player LogAgent). The application that logs errors with Windows Media Player.

• LOGMAN.EXE (Performance Log Utility). Manager and scheduler for trace logs and performance counters.

• LOGOFF.EXE (Session Logoff Utility). A utility to terminate a user's session on the PC.

• LOGONUI.EXE (Windows Logon User Interface). The user interface that appears when Windows XP first starts.

• LPQ.EXE (Line Printer Queue). Displays printer queue information on a printer hosted on a Unix system.

• LPR.EXE (Line Printer). Prints to a printer hosted on a Unix system.

• LSASS.EXE (LSA Security Service). The Local Security Authority server process.

• MAGNIFY.EXE (Microsoft Magnifier). Magnifies portions of the screen for visually impaired people.

• MAKECAB.EXE (Cabinet File Maker). Creates .cab files for install packages.

• MEM.EXE (Memory). A command-line utility that displays the current state of memory.

• MIGPWD.EXE (Migration dll). A Windows 95–to–Windows NT migration utility.

• MMC.EXE (Microsoft Management Console). A built-in programming interface where most administrative tasks can be added through snap-ins, ensuring the same interface for all administrative functions.

• MNMSRVC.EXE (NetMeeting Remote Desktop Sharing). Allows authorized users to remotely access your desktop.

• MOBSYNC.EXE (Offline Web Synchronizer). Synchronizes offline Web sites.

• MOUNTVOL.EXE (Volume Mounter). Creates, lists, and modifies volume mount points.

• MPLAY32.EXE (Multimedia Player). A GUI multimedia player.

• MPNOTIFY.EXE (Multiple Provider Notify). Used by the WinLogon service to notify non-Microsoft network servers about security events.

• MQBKUP.EXE (MSMQ Backup/Restore Utility). A backup and restore utility for Microsoft Message Queuing (MSMQ) service messages.

• MQSVC.EXE (Message Queuing Service). A messaging service between source and destination computers running distributed applications.

• MQTGSVC.EXE (MSMQ Trigger Service). Message queuing trigger service.

• MRINFO.EXE (Multicast Information). A command-line tool to query a multicast router about its interfaces.

• MSCDEXNT.EXE (Microsoft CD-ROM Extensions). Provides CD-ROM extensions for the Windows XP environment, enabling data CDs to be accessed just like hard drives.

• MSDTC.EXE (DTC Console Program). The console for the Distributed Transaction Coordinator (DTC).

• MSG.EXE (Message Utility). A utility for sending messages to other users.

• MSHEARTS.EXE (Hearts Network). A multiplayer Hearts card game.

• MSHTA.EXE (HTML Application Host). The application used to run an HTML Application (HTA) file.

• MSIEXEC.EXE (Windows Installer). Used to create install packages for applications and programs.

• MSPAINT.EXE (Microsoft Paint). A basic graphics creation and viewing tool.

• MSSWCHX.EXE (Onscreen Keyboard Program). Provides keyboard access for mobility-impaired people.

• MSTINIT.EXE (Task Scheduler Setup). Allows scheduling automated tasks.

• MSTSC.EXE (Remote Desktop Connection). An application that enables a computer to be accessed remotely.

• NARRATOR.EXE (Microsoft Narrator). Reads files for people who are hearing impaired.

• NBTSTAT.EXE (NBT Statistics). Displays NetBIOS over TCP/IP statistics.

• NDDEAPIR.EXE. The server-side application programming interface (API) for the Network DDE Agent.

• NET.EXE (Network). Used to manage, configure, and view network-related controls, such as net use, net print, net user, and so on.

• NET1.EXE (Network). Another network command utility that performs the same functions as NET.EXE.

• NETDDE.EXE (Network DDE). A background network DDE provider.

• NETSETUP.EXE (Network Setup Wizard). A utility to help configure other PCs on your network using a floppy disk.

• NETSH.EXE (Routing and Remote Access Service Configuration Tool). Used to configure RRAS settings.

• NETSTAT.EXE (Network Statistics). Displays TCP/IP network statistics.

• NLSFUNC.EXE (National Language Support Function). Used to load country-specific language support.

• NOTEPAD.EXE (Notepad). The Notepad text-editing utility.

• NSLOOKUP.EXE (Name Server Lookup). Used to display diagnostic and statistical information from DNS servers.

• NTBACKUP.EXE (Windows NT Backup). The Windows XP Backup executable.

• NTKRNLPA.EXE (NT Kernel and System). A Windows Kernel component.

• NTOSKRNL.EXE (Operating System Kernel). The Windows XP operating system Kernel.

• NTSD.EXE (Symbolic Debugger). A troubleshooting utility that gives a detailed view of the system state at the moment of failure.

• NTVDM.EXE (NT Virtual DOS Machine). An executable that provides the VDM used to host MS-DOS applications and Windows-on-Windows (WOW—support for Win16).

• NW16.EXE (NetWare Redirector). The NetWare VDM Redirector.

• NWSCRIPT.EXE (Netware Logon Script Utility). A tool to allow logons to a NetWare server from a Windows PC.

• ODBCAD32.EXE (ODBC Administrator). Used to administer ODBC connections.

• ODBCCONF.EXE (MDAC Installer). Used to reconfigure and reinstall Microsoft Data Access Components (MDAC).

• OPENFILES.EXE (Open Files). Displays and allows disconnects of open files on a system.

• OSK.EXE (On Screen Keyboard). Displays an onscreen keyboard that can be used to enter information with the mouse.

• OSUNINST.EXE (Uninstall Utility). A utility to uninstall Windows XP and return to an earlier Windows OS. Can be run from a command prompt in Safe mode.

• PACKAGER.EXE (Object Packager). Used to create icon links to embedded data for use in documents.

• PATHPING.EXE (PathPing Command). A command for verifying an IP route that enables the user to specify options to test for along the path.

• PENTNT.EXE (NT Pentium Test). A command-line tool that tests the system for the Pentium floating-point error.

• PERFMON.EXE (Performance Monitor). The Performance Monitor executable.

• PING.EXE (PING). A TCP/IP utility used to test the existence of, or the capability to communicate with, remote systems.

• PING6.EXE (Ipv6 Ping Command). A utility that verifies connectivity to a specific IP address or hostname.

• PRINT.EXE (Print). A command-line print utility used to send print jobs to a port.

• PROGMAN.EXE (Program Manager). An alternative shell that can be used in place of Windows XP Explorer. It is the main interface used in Windows 3.x, Windows for Workgroups, and Windows NT 3.51.

• PROQUOTA.EXE (Profile Quota Manager). An application for limiting the size of user profiles.

• PROXYCFG.EXE (Proxy Configuration Tool). A command-line tool to view and change your current proxy settings.

• QAPPSRV.EXE (Query Terminal Server Utility). Identifies terminal servers on the network.

• QPROCESS.EXE (Query Process Utility). Displays processes running on a machine. Can be sorted by username and other criteria.

• QWINSTA.EXE (Query Session Utility). Displays session information and related statistics, such as connect and flow control settings.

• RASAUTOU.EXE (Remote Access Dialer). A program that allows remote dial-up connections between PCs.

• RASDIAL.EXE (RAS Command-Line Dialer). A client-side user interface.

• RASPHONE.EXE (RAS Phone). The Dial-Up Networking Phonebook application.

• RCIMLBY.EXE (Remote Assistance). A program used to help another user with a computer problem over the network or Internet.

• RCP.EXE (Remote Copy). A TCP/IP utility used to copy files between the current system and a remote RSHD (Remote Shell) server.

• RDPCLIP.EXE (RDP Clip Monitor). A Remote Desktop Protocol component.

• RDSADDIN.EXE (Remote Desktop Addin). A Remote Desktop Terminal Services session add-in.

• RDSHOST.EXE (RDSHost Server Module). A Remote Desktop Service module.

• RECOVER.EXE (Recover). A command-line utility to recover readable data from a defective drive.

• REDIR.EXE (Redirector). A Win16 network redirector.

• REG.EXE (Registry Console Tool). A command-line tool for querying and editing the Registry.

• REGEDT32.EXE (Registry Editor). A 32-bit Registry-editing tool that can set security permissions on Registry keys and values.

• REGINI.EXE (Registry Initializer). A utility to change Registry values from a command line or script.

• REGSVR32.EXE (Registry Server). A program for viewing and editing the Registry.

• REGWIZ.EXE (Registration Wizard). Automates the process of registering your XP operating system.

• RELOG.EXE (Performance Relogging Utility). Displays performance counter data in other formats.

• REPLACE.EXE (Replace). A command-line tool used to replace files.

• RESET.EXE (Reset Utility). A Terminal Services reset utility.

• REXEC.EXE (Remote Execute). Used to issue commands on remote systems running the REXEC service.

• ROUTE.EXE (Route). Used to view and edit the local routing table.

• ROUTEMON.EXE (Router Console Monitor). A utility that is no longer supported. Refers you to the netsh command.

• RSH.EXE (Remote Shell). Issues commands on remote systems running the RSH service.

• RSM.EXE (Removable Storage Manager). Command-line interface for the Removable Storage Manager.

• RSMSINK.EXE (Removable Storage Manager). Sink layer for the Removable Storage Manager.

• RSMUI.EXE (User Interface). A Removable Storage Manager component.

• RSNOTIFY.EXE (Recall Notification). A Removable Storage Manager component.

• RSOPPROV.EXE (RSoP Service Application). A Resultant Set of Policies (RSOP) application. Determines the current policies applied to a particular user or PC.

• RSVP.EXE (Resource Reservation Protocol). A protocol that sets up a reserved pathway with a specific quality of service for a set of data packets.

• RTCSHARE.EXE (RTC Application Sharing). A real-time clock component.

• RUNAS.EXE (Run As Utility). A utility that allows a process to be implemented with a new user ID and password combination. Typically used to run a process or application as an Administrator or other user with higher levels of privileges than the currently logged on user.

• RUNDLL32.EXE (Run DLL). Used to run DLL files from a command line.

• RUNONCE.EXE (Run Once). Used to perform tasks as defined in the RunOnce Registry key.

• RWINSTA.EXE (Reset Session Utility). A utility to reset a hardware or software session.

• SAVEDUMP.EXE (Save Dump). Saves the contents of memory to a dump file in the occurrence of a STOP error.

• SC.EXE (Service Development for Windows NT). A service management tool.

• SCARDSVR.EXE (Smart Card Resource Management Server). Smart Card Server component.

• SCHTASKS.EXE (Schedule Tasks). A command-line tool for scheduling unattended tasks.

• SDBINST.EXE (Installer). AppFix and AppHelp installer.

• SECEDIT.EXE (Security Configuration Manager). Used to set and configure Windows XP security options.

• SERVICES.EXE (Services). Used by Windows XP to manage services.

• SESSMGR.EXE (Session Manager). A Remote Desktop help session manager.

• SETUP.EXE (Setup). The Windows Setup tool.

• SETVER.EXE (Set Version). Used to define the version of MS-DOS reported to an application.

• SFC.EXE (Windows XP Windows File Checker). Verifies that all Windows XP files are present and of the correct version.

• SHADOW.EXE (Session Utility). A Session Remote Control utility.

• SHARE.EXE (Share). An MS-DOS utility used to enable two applications to use the same file.

• SHMGRATE.EXE. A Windows XP user data migration tool.

• SHRPUBW.EXE (Shared Folder Creator). Used to create shared folders on a Windows XP system.

• SHUTDOWN.EXE (Remote Shutdown Tool). Allows shutdowns and restarts on local or remote PCs.

• SIGVERIF.EXE (File Signature Verifier). Verifies that the selected file is signed and authorized to run under Windows XP.

• SKEYS.EXE (Serial Keys). A system service that adds support for the SerialKeys feature.

• SMLOGSVC.EXE (Performance Logs and Alerts Service). An application that allows statistics to be monitored and collected on local and remote PCs.

• SMSS.EXE (Session Manager). A session manager used to establish the Windows XP environment during bootup.

• SNDREC32.EXE (Sound Recorder). A sound recorder application.

• SNDVOL32.EXE (Sound Volume). A GUI volume application.

• SOL.EXE (Solitaire). A GUI solitaire card game.

• SORT.EXE (Sort). A command-line utility that sorts input and writes the results to a file or the screen.

• SPIDER.EXE (Spider). The Spider solitaire game.

• SPOOLSV.EXE (Spooler Service). The spooler service for the print subsystem.

• SPRESTRT.EXE. Used to restore the Registry to restart the GUI-mode portion of the Setup application.

• STIMON.EXE (Still Image Devices Monitor). Enables a USB still-image device to transfer data.

• SUBST.EXE (Substitute). An MS-DOS command used to associate a path with a drive letter.

• SVCHOST.EXE (Service Host). A generic host process for Win32 services.

• SYNCAPP.EXE (Synchronize Application). A tool used by the Briefcase to synchronize contained files.

• SYSEDIT.EXE (System Edit). A system file-editing utility that opens the system.ini, win.ini, config.sys, and autoexec.bat files in one editor window.

• SYSKEY.EXE (Windows XP Account Database Manager). Used to secure the Windows XP account database.

• SYSOCMGR.EXE (Optional Component Manager). The System Stand-alone Optional Component Manager.

• SYSTEMINFO.EXE (System Information). Queries a system for configuration information, including hotfix and dynamic patches that have been applied, IP addresses, and so forth.

• SYSTRAY.EXE (System Tray). The system tray provider. It controls the taskbar and icon tray.

• TASKKILL.EXE (Kill Process). Ends a process or task on a local or remote system.

• TASKLIST.EXE (Task List). Displays a list of all running processes on a local or remote computer.

• TASKMAN.EXE (Task Manager). Used for backward-compatibility with older, non-Windows XP software instead of actually providing access to the Task Manager.

• TASKMGR.EXE (Task Manager). The Task Manager application.

• TCMSETUP.EXE (Telephony Client Setup). Used to set up the Telephony configuration on a Windows XP client.

• TCPSVCS.EXE (TCP Services). The TCP Services provider.

• TELNET.EXE (Telnet). A Telnet client used to access remote Telnet server systems.

• TFTP.EXE (Trivial FTP). An alternative FTP program for use over User Datagram Protocol (UDP).

• TLNTADMN.EXE (Telnet Administrator). Used to configure the settings for the Telnet server under Windows XP.

• TLNTSESS.EXE (Telnet Sessions Viewer). Displays the currently connected Telnet sessions.

• TLNTSVR.EXE (Telnet). An application that allows a Telnet terminal session with an online host.

• TOURSTART.EXE (Windows Tour Launcher). A guided overview of Windows XP.

• TRACERPT.EXE (Event Trace Report Tool). Provides trace analysis reports from trace logs or data generated by an event trace provider.

• TRACERT.EXE (Traceroute). Used to identify the route between the local system and a remote system on a TCP/IP network.

• TRACERT6.EXE (Ipv6 Traceroute Tool). A tool to trace the route a packet would take to get from the source host to the destination host.

• TSCON.EXE (Session Connection Utility). Attaches a user session to a terminal session.

• TSCUPGRAD.EXE (Setup Custom Action DLL). The Terminal Services setup component.

• TSDISCON.EXE (Session Disconnect Utility). A Terminal Services utility for disconnecting a session.

• TSKILL.EXE (End Process Utility). A utility to terminate a Terminal Services process on a session-by-session basis or for all sessions.

• TSSHUTDN.EXE (System Shutdown Utility). A Terminal Services utility to perform a controlled shutdown of the server. Includes variables for rebooting or powering down the server.

• TYPEPERF.EXE (Command-line Performance Monitor). An application that collects performance data and outputs it to a file or display.

• UNLODCTR.EXE (Unload Counter). Used to unload Performance Monitor counters.

• UPNPCONT.EXE (UPnP Device Host Container). A Universal Plug and Play component.

• UPS.EXE (UPS Service). The uninterruptible power supply service.

• USER.EXE (Win16 User). A utility for Win16 compatibility.

• USERINIT.EXE (User Initialization). Used to establish the operating environment for a user after logon.

• USRMLNKA.EXE (U.S. Robotics Driver Interface). A driver utility.

• USRPRBDA.EXE (U.S. Robotics Enable/Disable Probe). U.S. Robotics device support utility.

• USRSHUTA.EXE (U.S. Robotics Shutdown Helper). A U.S. Robotics device support utility.

• UTILMAN.EXE (Utility Manager). An application for configuring tools for disabled people.

• VERIFIER.EXE (Driver Verifier Manager). Attempts to determine whether a driver will cause a system conflict by testing its operation.

• VSSADMIN.EXE (Shadow Copy Service). Command-line interface for the Volume Shadow Copy Service.

• VSSVC.EXE (Volume Shadow Copy Service). Manages and implements a volume shadow copy for backup purposes.

• VWIPXSPX.EXE (Redirector). A NetWare redirector component.

• W32TM.EXE (Windows Time Service). The Windows Time Service diagnostic tool.

• WEXTRACT.EXE (Win32 Cabinet Self Extractor). A component used in extracting cabinet files to disk during setup.

• WIAACMGR.EXE (Windows Picture Acquisition Wizard). A program that steps you through downloading pictures from a digital device to a file location.

• WINCHAT.EXE (Windows Chat). A chat tool.

• WINHLP32.EXE (Windows Help). The 32-bit Windows Help tool.

• WINLOGON.EXE (Windows Logon). The Windows Logon service.

• WINMINE.EXE (Mine Sweeper). The Mine Sweeper game.

• WINMSD.EXE (Windows XP Diagnostics). The Windows XP diagnostics application.

• WINSPOOL.EXE (WOW Spooler). The printer spooler service for WOW (the Win16 subsystem).

• WINVER.EXE (Windows Version). Displays the current Windows version.

• WMPSTUB.EXE (Windows Media Player). The Windows Media Player autoplay loader.

• WOWDEB.EXE (WOW Debugger). The WOW debugger.

• WOWEXEC.EXE (WOW Execute). Runs Win16 applications for Win32 applications.

• WPABALN.EXE (Windows Product Activation). Windows Product Activation Balloon reminder.

• WPNPINST.EXE (Internet Printing). Supports .exe files for Internet printing.

• WRITE.EXE (Write). A text and rich-text document-editing tool.

• WSCRIPT.EXE (Script Host). The Windows-based script host.

• WUAUCLT.EXE (Windows Update). An auto-update client.

• WUPDMGR.EXE (Windows Update). The Windows Update Manager for NT.

• XCOPY.EXE (Extended Copy). A command-line utility used to copy files and folders.

The Windows XP Distribution CD

The Windows XP distribution CD contains more than just the files for installing Windows XP. There are extra tools, release notes, and value-added software from third-party vendors and Microsoft.

The root folder of the distribution CD hosts four subfolders. Only one of these folders is a platform-specific version of the setup file.

The \Docs subfolder contains documents that should be read before starting your Windows XP setup. There is a Read1st.txt file, a release notes document, and a document describing the setup procedure.

The \i386 subfolder contains all the files (mostly in compressed format) that make up the Windows XP operating system. This is the folder the Setup program uses to install the OS.

The \Support subfolder contains a \Tools subfolder with many troubleshooting and support tools for Windows XP (such as the Process Resource Monitor and the Quick Fix Application for resolving application compatibility problems with Windows XP).

The \Valueadd subfolder contains some sample third-party tools and utilities for Windows XP as well as extra documents, fonts, utilities, and applications from Microsoft.

Living with Service Packs and Hotfixes

All operating systems have their share of application fixes and driver updates, and Windows in any flavor is no exception. Microsoft is trying to make applying these fixes a smoother process, however, by continuing to add new features that assist in the update process. The latest feature is called Dynamic Update. You can launch this tool during setup so that critical fixes are applied to drivers that might cause problems during the setup process. Dynamic Update requires a PC to have an Internet connection to receive the updates. Network administrators on larger networks that are running a deployment cycle have the option of downloading these files to a network share so that large numbers of workstations can be updated at once without affecting wide area network (WAN) bandwidth.

The service packs themselves contain only bug fixes. Any product enhancements are available through a different channel, so administrators can install relatively small service packs. Although service packs are expected to be a fairly regular event in the Windows XP world, bugs are detected between releases of these service packs. When the bug could affect the security or performance of systems, Microsoft releases what are known as hotfixes.

In the past, hotfixes had to be individually downloaded and installed in a specific order. Beginning with Windows 2000, however, Windows Update is used to automatically detect, download, and install the required hotfixes.

This modification to the Windows XP distribution files provides two important items. First, it creates new files that can allow installating the OS with all service packs and hotfixes already applied. Second, it makes it unnecessary to reinstall service packs and hotfixes after adding applications or services to an existing Windows XP installation.

For More Information

If the information about Windows XP file layout issues in this chapter has increased your desire to learn more, here are some resources you can research:

• Microsoft TechNet: http://www.microsoft.com/technet.

Following are two popular tools for multi-booting Windows XP with non-Microsoft operating systems:

• V Communications System Commander and Partition Commander, located at http://www.v-com.com/.

• PowerQuest's Partition Magic (version 7), located at http://www.powerquest.com/.

For more information about the tools and utilities found in the main Windows root directory, you can take the following action:

• Use the help <name> command from a command prompt.

• Look through the Windows XP Help and Support system. (Select Help and Support from the Start menu.)

• Use the /? parameter after the utility name from a command prompt.

• Run or start the program, and then look for help information.

• Consult the TechNet CD-ROM.

• Search the Microsoft Web site: http://support.microsoft.com/.

The following tools monitor your system for changes, especially during software installation. You can use the recorded changes to uninstall software and return your system to its previous state:

• V Communications System Commander and Partition Commander, located at http://www.v-com.com/.

• IMSI Software's WinDelete: http://www.imsisoft.com.

---