付爸爸的神奇日記本

http://dmoisan.spaces.live.com/blog/cns!95CB015E3E4A702A!130.entry

The Heartbeat of Windows
Windows has a heartbeat! Yes, it's true! How can this be? Windows is not exciting for most admins when things are running normally (and the excitement over a new BSOD is much much overrated.)

Windows servers (and desktops) have a registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\TimeStampInterval.
This is a DWORD and the default is 5 for servers and 0 for workstations (XP, Win2K Pro, etc.)

When set, Windows writes a timestamp to the registry every 5 seconds (or, presumably, for whatever the DWORD is set to.) A value of 0 disables it.

With this entry set, if the computer bluescreens or you pull the plug, Windows uses the timestamp to determine that the last shutdown was unexpected, and its approximate time. See the following registry entry from my very sick workstation after one of its many bluescreens:

Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6008
Date: 6/3/2006
Time: 1:06:47 PM
User: N/A
Computer: WAKKO
Description:
The previous system shutdown at 1:02:58 PM on 6/3/2006 was unexpected.

The UPTIME.EXE utility I posted about previously will set the heartbeat. Simply do uptime /heartbeat and follow the prompts to turn it on or off.

Take care,

Dave