Windows NT Event Viewer
The Windows NT Event Viewer is a useful tool for deciphering startup error messages when NT does finish loading. Any time that a piece of hardware fails to initialize or a driver or service fails to load an Event Viewer error code is generated (a Stop code). Windows NT usually warns the user of the event, and suggests checking the event viewer.
Using the Windows NT Event Viewer
The typical Event Viewer screen would look like the following:
The following screen shot demonstrates a typical initialization error message.
This error message will be the same regardless of what service or driver fails during startup. As an example, detaching the network connection cable will generate this error. After clicking OK, and opening the Event Viewer we see the following.
Notice the symbols to the far left: a circle with an “i” indicates information such as successful initialization of a device or service; an octagonal stop sign indicates a device or service failure. We happen to be interested in the service error generated at 8:37:30 AM on 10/7/99.
The originator of the error message is NETLOGON. Under “Description” we see that no domain was available for the network logon. This error is expected since the network is not connected. Reattaching the network cable corrects this error.
Any time a hardware component stops functioning under Windows NT check for a service control error at startup. Then open the event viewer to view the error. Remember, a red stop sign indicates that an error has occurred initializing a service or device driver. It is possible that one error may cascade into a number of other errors. All these errors will be listed in the Event Viewer after booting to NT. An important step in eliminating the errors is to determine the root cause of the error. Try eliminating the errors that occur earliest in the event log first. It may be helpful to clear the event log, then reboot. Only messages relating to the current boot will be displayed.