Coping with Change

Enterprise Networks & Servers, Nov 2003 by Robb, Drew

Inventory Change Logs simplify the Process of Keeping Track of Changes

Change is good. At least that is what the wise men tell us. "Change in all things is sweet," Aristotle opined.

Change, they say, will make you happy. "They must often change, who would be constant in happiness or wisdom," Confucius advises us.

And lead you to perfection. "To improve is to change," said Sir Winston Churchill; "to be perfect is to change often."

Well, we'll let others ramble on about how great change is. From a tech support standpoint, however, "change is hell" is probably more appropriate. Every change in code has the potential to bring down totally unrelated systems. That's why software goes through alpha and beta trials before getting released to manufacturing. That's why we use development servers to test everything before it touches the production environment. Even then, we do phased roll outs so we can catch and fix any bugs we missed earlier.

But, despite all these precautions, there are still times we have to track down and undo changes, whether it is a buggy Windows 2000 migration, a piece of outdated software or an authorized configuration modification some user decided to make. In this article we take a look at several ways to put things back the way they were.

Windows Options

Odds are you are using some sort of Windows devices in your network, so let's start with the methods that Microsoft includes with its operating systems.

With the release of Windows NT, Microsoft introduced its Last Known Good Configuration option. Let's say that you have installed a new application or driver, changed some registry settings, or whatever. You then reboot the system and it crashes. With earlier versions of Windows you then faced the option of having to restore the entire system from a (hopefully) up to date backup disk or tape. With Last Known Good, you instead reboot the machine, press F8 and then select "Last Known Good." Windows will then restore the previous device driver and finish booting the system.

But what if the system boots, but doesn't work properly? Well, with Windows XP, Microsoft included a new tool called Device Driver Rollback. To use it, open the Control Panel, click on the System icon, click on the Hardware tab and then on the Device Manager button. Next you will locate the device with the faulty driver, right-click on it and select Properties. Then click on the Driver tab and the Roll Back Driver button. This will restore the previous driver.

Windows XP also has a broader ranging tool called System Restore which is also accessible through the System Properties icon on the Control Panel. System Restore sets aside a section of the hard drive to record the system's status whenever software is installed or updated, as well as at set points throughout the day. This lets the administrator roll the system back to any of the earlier restore points. System Restore will not restore any user data files such as word processing documents or graphics. You must recover those from a backup. It will, however, restore any .exe, .sys, .com or .dll files. (It monitors a total of nearly 600 file types. See msdn.microsoft.com/library/ default. asp?url=/library/en-us/sr/sr/monitored_file_extensions.asp for a full list of extensions.)

Narrowing the Target

While much better than doing a reformat and restore, the Microsoft tools still have their limitations and liabilities. To begin with, the System Restore option takes up a sizeable chunk of the hard drive to store all the restore point information. The default setting on this is 12 percent of the volume, though the administrator can set this at a lower level. There is also some resource load necessary to record all this information, though it is likely not to affect end user performance. A larger problem is that it restores everything in the system back to that earlier point in time. This means that you lose all of the changes, both beneficial and harmful, that have occurred since then. It is fine if you use it immediately after making a change that you know you want to get rid of. But going back further you may find that you have wiped out other changes you want to keep, such as the latest security updates to the operating system or other applications.

The Device Driver Rollback on the other hand very narrowly targets only the most recent change to one specific driver. If you know that that one driver is what is wreaking havoc, you can go back to what worked earlier.

Too often, however, you don't know where the problem lies. Everything was working perfectly and now it's not. You know something changed, otherwise there wouldn't be a problem. But what changed? You know you didn't do it. Did the user add or modify something? Was there an automatic update or autoconfiguration change?

Now, certainly there are ways to lock down desktops to prevent users from making any alterations. And, of course, you have a firewall and antivirus software in place to keep out any worm that might change directory or security settings. But, whether they are malicious or simply due to unawareness, somehow changes manage to creep in anyway. While you may keep meticulous records of every alteration you have made, that doesn't tell you what is happening with the upset user on the other end of the phone line. How do you find out what changed there?