Some of the main topics in this chapter are
Because many users and businesses rely on data stored on computers, protecting that data is a very important function of an operating system. Hardware, especially hard disks, can fail--minimizing the effects of computer failures is critical. Backup protection and fault tolerance are two major features that Windows NT provides to minimize the risk of lost data.
Backups of data are the first link to ensuring data security. The Backup utility provided with Windows NT enables data to be copied to a storage medium and later restored. With Windows NT, disk fault tolerance enables data to remain safe even in the event of a hard drive failure.
Because vital information is stored on computers, loss of that data can be catastrophic. Data should always be backed up to ensure that it can be recovered if the computer's disks fail. It's important, therefore, to implement a good backup strategy to minimize the risk of losing data. You must also choose the correct media to store your backup information.
There are many types of media that can be used to store extra copies of computer data. The type of media used depends on the particular needs and requirements of the user. Floppy disks, tape drives, and other storage devices are types of media often used to store extra copies of data.
Floppy disk drives usually are standard equipment with most personal computers and can store small amounts of data from 360K to 1.44M. Because they are so commonplace, they often are used to back up data on personal computers. Due to the small amount of data stored on a disk, however, floppy disks are not the preferred medium to store the entire contents of a hard drive. To do so often takes hundreds of disks and backup time is tediously long. It is better to use floppy disks to copy a few important files for safekeeping.
Tape drives are the most common medium to back up large amounts of information, such as an entire hard drive, in a reasonably fast and inexpensive fashion. Tapes last between 5 and 10 years depending on the quality of the tape. Tape drives can store anywhere from 120M to 8G or more on a single tape. Tape drives can be single tape drives in which tapes are manually changed when they are full or tape autoloaders that automatically change a full tape with a blank one. Tape autoloaders are used to effectively increase the storage capacity on computers with large storage requirements such as database servers on a network.
Quarter-Inch Cartridge (QIC). The Quarter-Inch Cartridge (QIC) standard uses a quarter-inch-wide tape with nine parallel tracks. The QIC standard is divided into different types based on the tape's storage capacity. The QIC standard uses data compression to enable more data to be stored on the tape. The storage capacity can vary from 60M to 1.4G or more, depending on the QIC type used. QIC tapes and drives are usually the least expensive type of tape backup.
4mm Digital Audio Tape (DAT). Although more expensive than QIC types of drives, 4mm Digital Audio Tape (DAT) drives offer more storage capacity and speed. These types of tape drives are more commonly found on high-end workstations and servers. 4mm DAT also uses data compression to increase the storage capacity of a tape. 4mm DAT tapes can store from 2G to 4G of data.
8mm Digital Audio Tape (DAT). Although similar to 4mm DAT, 8mm Digital Audio Tape (DAT) is twice the width of 4mm DAT and is able to hold more information on a single tape. 8mm DAT is usually found on larger network installations to back up multiple servers in a network. As with 4mm DAT, it uses data compression to help increase the capacity of tapes. An 8mm DAT tape can store from 4G to 8G of data.
Other storage media exist to which data can be copied, such as Zip drives, Compact Disk-Recordable (CD-R) discs, and Magno-Optical discs. These devices hold anywhere from 1M to 660M of data depending on the device. Many of these devices require special drivers and might not be supported in the Windows NT Backup utility.
There are many backup strategies available to back up data while keeping costs and the number of tapes to a minimum. Although backing up an entire drive with all files--even if they have been backed up previously--provides the best backup protection, it's the most costly method, uses the most tapes, and might not be practical for all situations.
Other methods use a combination of full backups and incremental backups in which only the files that are new or not copied on the last backup are copied to the backup media. The most common implementation is the Grandfather-Father-Son backup method.
The Grandfather-Father-Son Method. The Grandfather-Father-Son backup method is a fairly simple and commonly used method of tape rotation. There are four daily tapes (for example, Monday-Thursday), four weekly tapes (for example, Fridays), and 12 monthly tapes (January through December). The daily tapes, known as the sons, are used at the end of the listed day. The weekly tapes, known as the father tapes, are used at the end of the day on Friday, with Weekly1 being the first Friday of the month and so on. The 12 monthly tapes, known as the grandfather tapes, are used on the last day of the corresponding month.
Usually the daily tapes are not full backups, but incremental backups. The weekly and monthly tapes are usually full backups. The Grandfather-Father-Son backup method allows for recovery throughout the entire year using the monthly tapes. The rotation of tapes also helps to minimize the risk of lost data if a tape is damaged. This method is also one of the simplest to manage.
Table 28.1 describes the tape rotation of the Grandfather-Father-Son method.
| Tape | Description |
| Daily | Four tapes are labeled Monday through Thursday and a backup, usually incremental, is performed at the end of the corresponding day. |
| Weekly | Four tapes are labled Weekly1, Weekly2, Weekly3, and Weekly4. A backup, usually a full backup, is performed at the end of the day on Friday. |
| Monthly | Twelve tapes are labeled January through December, and a full backup is performed on the last day of the corresponding month. |
Other Backup Methods. Another tape backup method is the Ten-Tape method. The Ten-Tape method rotates all the tapes evenly and provides a backup history for about 12 weeks. This method uses a series of four-week cycles. In the first four-week cycle, the four tapes are labeled Monday through Thursday. This is similar to the Grandfather-Father-Son method described previously. On the first Friday, a tape is made and only used once in the series. The next Friday, a different tape is used to back up the data. So, you will end up with 4 different tapes with the different Friday backups. Again, at this point, it is similar to the Father and Son tapes of the Grandfather-Father-Son method.
After the four-week cycle, the tapes are moved up in the schedule. For example, the Tuesday tape becomes the Monday tape. The Monday tape is rotated "out" and one of the two unused tapes becomes the last Friday tape. This process continues every 4 weeks, with tapes moving up in the tape order. Although harder to manage than the Grandfather-Father-Son method, it helps to evenly distribute the use of the tapes. It also requires fewer tapes than the Grandfather-Father-Son method.
A third tape backup method is the Tower of Hanoi method. The Tower of Hanoi method is named after the mathematical game in which disks are moved around on three pegs. Seven tapes are typically used instead of the 10 to 20 that are used with the other methods. Tape sets are labeled A, B, C, and so on. This method is used by some automated programs and is difficult to maintain manually.
Other backup methods can be used to safeguard data on Windows NT systems. Although the three methods just described are the most common, other methods can provide a better solution for a particular user's or organization's needs. Determining the best backup solution depends on factors such as the overall cost of tapes, the ease of tape management, the length of the backup history, and so on.
TIP: If you are a casual user, you might not need daily backups. You might want, instead, to make weekly or monthly backup tapes.
For the best data security, some backups should be kept away from the computer site so that if physical damage occurs at the site, data can be restored on a repaired or replacement computer. In many instances, a network administrator will take the backups to a home location or a predefined corporate location for safe keeping. Usually, weekly system backups are taken off-site; however, this depends on the needs of a particular organization. Regardless, current logs should be kept on the status of off-site tapes. Home users using Windows NT 4.0 can incorporate off-site storage, such as taking the tapes to a personal bank box or safe, if the situation warrants.
Windows NT 4.0 has a Backup utility in the Administrative Tools folder. To start the Windows NT 4.0 Backup utility, click the Start button, and then choose Programs. When the Program list displays, choose Administrative Tools, Backup.
When the Backup utility starts, you see two windows: One lists the machine's drives and the other lists the tape devices connected to the computer (see Figure 28.1). You also see a menu and toolbar for backup functions.
If you don't have a recognized tape drive on your computer, you see an error message displayed when you first start the Backup utility. If you don't have a recognized tape drive on your system, you won't be able to use the Windows NT Backup utility to back up files. Although you might be able to select files in the Drives window, you will not be able to back them up if no tape device is available.
This figure shows the Backup utility main screen showing the Drives window.
You need to have the Backup Files and Directories user right to back up all the files on a Windows NT system. The Administrator and Backup Operators groups have this right by default. If you do not have this user right, you will only be able to back up files you have created or otherwise been given access to.
Backing up data with the Backup utility is very straightforward. The Backup utility windows are similar to the Windows NT Explorer in both look and functionality. In the windows for the drive and file listing, you can either click the check box to back up all the files on an entire drive, or you can double-click the drive to see the first-level directory tree of that drive. You can then select files and directories by clicking the check boxes beside them, or you can continue to double-click directories to expand them (see Figure 28.2). To deselect an item that has been checked, simply click the check box to clear it.
NOTE: Although you can use the Windows NT Backup utility to handle complete system backups, restoring the entire system can be a complex process. In almost all instances in which an entire drive fails, you must reinstall Windows NT, and then the Backup utility will be able to restore the rest of the system. For protection of an entire system drive, see the section "Understanding Fault Tolerance," later in the chapter.
You need to select items in the Drives window before starting the backup.
The group of files and directories selected is known as the backup set. As soon as you have created a backup set, you can click the Backup button in the toolbar at the top of the screen (or choose Operations, Backup) to start the backup. The Backup Information dialog box appears, enabling you to select different backup options (see Figure 28.3).
Before the backup is started, the Backup Information dialog box displays.
This dialog box provides information and options related to the tape, backup set, and backup log:
| Backup Type | Description |
| Normal | Backs up all data selected and marks each file as backed up. |
| Copy | Backs up all selected files, but doesn't mark as backed up. Keeps the archive file attribute for the files the same. |
| Incremental | Backs up and marks only the files that have changed since the last backup in the file selection. |
| Differential | Backs up the files that have changed since the last backup in the file selection but doesn't mark as backed up. |
| Daily | Backs up (but doesn't mark as backed up) only the selected files that have been modified on the day of the backup. |
After you choose OK in the Backup Information dialog box, the backup process starts with the settings you've specified. As soon as the backup process starts, the Backup Status dialog box appears (see Figure 28.4).
As soon as the backup is started, you can monitor the process in the Backup Status dialog box.
If you need to stop the backup process before it's complete, click the Abort button. You'll see a message asking if you want to abort or continue the operation.
The second major function of the Backup utility is the restoration of files from a backup tape. The Backup utility enables you to do a full restoration or selected files restoration on a tape set.
TIP: Be sure to test your backup and restore procedure beforehand to ensure that when you need to copy data off of a tape, the procedure works properly. After important files have been deleted or corrupted is a very bad time to discover that your backup/restore procedure doesn't work!
To restore files from a tape or tape set to the hard disk, insert the first tape that contains the files that you want into the tape drive. Then open the Tapes window by clicking on the Restore or Maximize buttons in the title bar, if the window is not already displayed. The tape name appears to the right of each tape icon in the left panel of the Tapes window. The right panel in the Tapes window displays information such as: the drive that was backed up, the backup set number, the tape number, the backup type, the date and time of the backup, and a description of the backup.
To restore files from a tape or tape set, you need to load the tape's catalog. The catalog displays a list of any other backup sets on the tape. By default, the information in the Tapes window displays information about the first backup set on the tape.
To load a catalog of a tape's backup sets, select the tape of the catalog you want to load from the Tapes window, and choose Operations, Catalog. After the Backup utility builds a list of the backup sets on the tape, select a backup set to load by double-clicking its icon.
NOTE: When restoring files, the backup type used is very important. If incremental or differential backups were used, you first need to restore a complete backup and then the incremental or differential backup to restore an entire directory with the most recent files. For individual files, you might need to restore only the files from the incremental or differential backup tape.
After the catalogs of a tape are loaded, you can copy all the files on a tape, restore individual backup sets on a tape, or copy individual files in a backup set. To select all the files on a tape to be restored, select the tape in the left side of the Tapes window. To restore a backup set, click the check box of the tape set or tape sets that you want to restore. To select individual files, enable the check box of the files you want to copy from the tape set.
After you have selected the items to bring back from tape, click the Restore button on the toolbar or choose Operations, Restore. The Restore Information dialog box appears (see Figure 28.5).
Before files are restored to the hard disk, the Restore Information dialog box displays.
After you choose the OK button in the Restore Information dialog box, the restore process starts with the settings that you've specified. As soon as the restore process starts, the Restore Status dialog box appears, as shown in Figure 28.6.
As soon as the restore process is started, the Restore Status dialog box displays.
If you need to stop the restore process before it's complete, click the Abort button. This displays a message asking you if you want to abort or continue the operation.
If a tape is damaged or missing in a backup set that spans several tapes, you probably won't be able to restore the information on the tape. The last tape in a set, however, which contains the catalog information of a multiple tape set, can sometimes be missing or damaged. When this occurs, the Backup utility can be forced to treat each of the remaining tapes as a single tape instead of as a member of a tape set. To force the Backup utility to do this, use the /missingtape switch with the Backup command on the command line.
This breaks the set into individual tapes. So, if you had four tapes in a set, and the fourth tape were missing or damaged, you could restore the data from the other tapes, one at a time, with the /missingtape switch.
The Backup utility does not enable scheduled backups. You can use the scheduler service and command line, however, to create and run a batch file to schedule backups. The Windows NT Backup Help file contains more information on how to create a batch file to handle backups.
To access Windows NT Backup in a batch file, use the NTBACKUP command, which has the following switches:
Consider the following line in a batch file:
NTBACKUP Backup C:\WINDOWS /t Normal /v /d "Windows Backup" /l Â"C:\backlog.txt"
This line causes the Backup program to perform a normal backup of files in the C:\WINDOWS directory, verify the backup, use Windows Backup in the description, and log to C:\backlog.txt.
If you need more sophisticated backup scheduling, there are many third-party backup utilities on the market for both Windows NT Workstations and Windows NT Servers. Some titles include: Arcada Backup Exec, Cheyenne ARCserve, Legato NetWorker, and Palindrome Backup Director. Many of these programs provide more advanced features, as well as backup scheduling.
The Backup utility has three choices on the Operations menu to help maintain tapes: Erase Tape, Retension Tape, and Format Tape. The Erase Tape command can either use a Quick Erase, in which the header of the tape is deleted, or a Secure Erase, which erases the entire tape. The Secure Erase provides the best security but can take a long time, based on the tape type and length.
The Retension Tape command retensions QIC tapes to ensure proper winding of the tape. Retensioning a tape causes the tape to rewind around the tape reel. This helps prevent tape errors and should be performed after about 20 uses of a QIC tape. This command is unavailable for 4mm or 8mm tapes because they do not require retensioning.
The Format Tape command formats a mini-cartridge tape.
Although backups help protect data by copying files to another medium, they require scheduled maintenance and are only as good as the most recent backup of the data. Disk fault-tolerance supplements, but does not replace, backups of data. Disk fault-tolerance helps protect data by spreading data across drives. That way, if a drive fails, all the data on the drive is not lost. There are different methods to restore the data on the lost drive. One method simply copies the same data to two drives, whereas the other keeps information on how to rebuild the data from information kept on other drives.
RAID (Redundant Array of Inexpensive Disks) levels enable network servers to increase network disk performance and provide for fault tolerance of data. Windows NT Server supports RAID Levels 0, 1, and 5. Descriptions of the RAID levels follow:
NOTE: Only Windows NT Server 4.0 provides fault-tolerance options like disk mirroring, disk duplexing, and disk striping with parity. Windows NT Workstation 4.0 provides only disk striping. If you need fault-tolerance options to protect data, you must use Windows NT Server instead of Windows NT Workstation.
Windows NT 4.0 uses software-based RAID solutions that support Levels 0, 1, and 5. However, many hardware vendors use hardware-based solutions when building fault-tolerant computers. These solutions usually bypass the Windows NT software drivers and might offer some performance advantages. Also, some users might want to use different levels of RAID than Windows NT supports.
One of the disadvantages of a hardware-based RAID solution is that it can lock you into a single vendor. Also, hardware-based solutions are usually more expensive than using the software-based solution that Windows NT provides. Which type of RAID solution to use depends on the requirements and results desired by particular Windows NT users.
Sector sparing, also known as hot fixing, is another fault tolerance feature of Windows NT Server 4.0. With normal disk formatting, if a disk sector is found to be bad, it will be marked so that data is not written to the bad sector. If a sector goes bad after the disk is formatted, however, it's possible that data will be written to that bad sector.
Sector sparing enables all read/write operations to check for a bad sector. If a bad sector is found during the read/write operation, the following steps occur:
2. The data is transferred to a valid sector that does not have any errors.
3. The bad sector is "mapped out" so that data is not sent to the bad sector again.
4. The data is read from the transferred sector, if needed again. The Event Viewer program notifies the Administrator of the sector sparing operation.
NOTE: Sector sparing is only available on Windows NT Server 4.0 with SCSI devices. Windows NT Server 4.0 computers with IDE or EIDE devices can't perform sector sparing. Windows NT Workstation 4.0 computers also can't perform sector sparing. If you need sector sparing to protect data, you should use Windows NT Server with SCSI drives.
Windows NT 4.0 provides a tool named Disk Administrator that enables you to implement fault-tolerant volumes (see Figure 28.7). Disk Administrator also handles other aspects of disk management not related to fault-tolerance, such as disk partitioning, disk formatting, and extending volumes (see Chapter 22, "Managing Disks and File Systems," for more information). To use Disk Administrator, you must be logged on to Windows NT with the Administrator account or an account with administrative privileges.
Disk Administrator shows all the available drives and partitions on a Windows NT Computer.
Disk Administrator displays all the disks and partitions currently located on the Windows NT computer. A legend above the status bar provides information about the colors used to signify different disk configurations currently used on the computer. If a disk configuration is not used, it does not appear on the legend. Disks on the system can have various configurations such as:
The fault-tolerance options in Disk Administrator are found in the Fault Tolerance menu on the menu bar. The Fault Tolerance item is only found in Windows NT Server 4.0, not Windows NT Workstation 4.0. Standard partitions, volume sets, and stripe sets, however, can be created and managed under Windows NT Workstation. Windows NT Workstation can also convert mirror sets and stripe sets with parity that were created by Windows NT server to drive types that Windows NT Workstation can use.
Implementing a mirror set requires at least two drives on a Windows NT Server computer. When implementing mirrored drives, the second disk partition must be at least as large as the size of the first partition. The space should not be much larger than the first, however, otherwise the space is wasted. Disk Administrator can mirror both the system and the boot partition. The hard disks being mirrored can be of any type (SCSI, EIDE, or IDE) or any file type (FAT or NTFS). To create a mirror set, follow these steps:
2. Choose Fault Tolerance, Establish Mirror. If you are mirroring a boot or system partition, a message appears informing you of the mirror. Dismiss the message.
3. Choose Partition, Exit. A message box asking you to confirm the current settings appears. Choose Yes if you want to keep the mirror set you just created.
Restart your computer as instructed. You're also reminded to update the Emergency Repair Disk, which you should do rather quickly, as the previous disk is no longer valid.
To implement disk duplexing, connect each drive to a different drive controller and create a mirror set with the drives. No additional steps are required because creating the mirror set automatically uses the different disk controllers of each drive.
Implementing disk striping with parity requires a minimum of three drives on a Windows NT Server computer. Each drive should have a minimum of 5M of unpartitioned free space available and each should be about the same size. If the partitions are not of equal size, the smallest partition of the set is used to determine the amount of space available for files in the set. System or boot partitions can't be part of a stripe set with parity when using the Disk Administrator tool. The hard disks can be of any type (SCSI, EIDE, or IDE) or any file type (FAT or NTFS). To implement disk striping with parity, follow these steps:
2. Choose Fault Tolerance, Create Stripe Set With Parity. A message appears showing the size of the stripe set. The default size for the stripe set is three times the smallest area of free space selected. Choose the size of the stripe set space, and click OK.
3. Choose Partition, Exit, confirm the current settings, and restart the computer as instructed. Don't forget to update the Emergency Repair Disk, too.
It's important to know how to recover data after a fault-tolerant volume fails before a data failure occurs. This section covers handling the recovery process by using fault-tolerant volumes.
A fault-tolerant boot disk is needed if a system or boot disk has been mirrored. Because DOS cannot recognize mirrored volumes, the disk must have Windows NT files that enable mirror sets to be recognized. This disk isn't required for disk striping with parity.
CAUTION: You can't create a system boot disk on a failed machine. Be sure to create a system boot disk before a system failure occurs. If you have access to another Windows NT Server machine, you can also create a system boot disk. However, whenever you use a mirror set with a system or boot partition, make sure you create a system boot disk just to be safe!
To create a system boot disk, follow these steps:
2. Copy the following files from the primary partition of your Windows NT Server computer to the boot disk. For Intel x86 computers, copy: NTLDR, NTDETECT.COM, NTBOOTDD.SYS, and BOOT.INI. For RISC-based computers, copy: OSLOADER.EXE and HAL.DLL.
NOTE: The NTBOOTDD.SYS file for Intel x86 machines is needed for SCSI computers only when the SCSI BIOS is not used. If your computer does use the SCSI BIOS or you use an IDE drive, the NTBOOTDD.SYS file will not be located on your drive.
4. Test the boot disk to ensure that it points to the right partition.
To recover a mirror set that contains system or boot information, follow these steps:
2. Boot the system with the System Boot Disk that you created. The boot disk loads Windows NT Server from the second mirrored drive.
3. Break the existing mirror. See "Recovering or Removing a Mirror Set," later in this chapter, for information on breaking mirror sets.
4. Create a new mirror set to the free space on the replaced drive. See "Implementing Mirrored Drives," earlier in this chapter, for more information on creating mirror sets.
5. Reboot the system without the System Boot Disk to ensure that the mirror set is working correctly. If it isn't working correctly, verify that the drive connection is correct and repeat the procedure. If the drive connection is correct, then you need to contact technical support from the drive manufacturer.
When creating a System Boot Disk, knowledge of Advanced RISC Computing (ARC) names is important for modifying the BOOT.INI file. ARC naming conventions are used for both Intel x86 and RISC-based computers to identify devices. An example of an ARC name is:
scsi(0)disk(1)rdisk(0)partition(2)
The ARC name consists of several components: the type of disk controller, the ordinal number of the hardware adapter, the disk parameters, and the partition number.
Disk Controller Type. The first part of the ARC name identifies the type of disk controller used. This setting can either be SCSI for SCSI drives, or Multi for IDE or EIDE devices or SCSI drives accessed by the SCSI BIOS. For example, an IDE drive would have an ARC name similar to:
multi(0)disk(0)rdisk(0)partition(1)
Ordinal Number of the Hardware Adapter. The ordinal number of the hardware adapter refers to the physical controller in the computer. The number 0 refers to the first disk, 1 for the second, and so on. So, if only one controller existed in the computer, the ordinal number would be 0.
Disk Parameters. The next two parameters are disk() and rdisk(). The disk() parameter refers to the hard drive of the controller you are using if you are using SCSI drive. For a SCSI disk with the target ID of 0, the parameter would also be 0. For IDE and EIDE drives, the disk() parameter is always 0.
The rdisk() parameter refers to the ordinal number of the IDE or EIDE disk you're using. The number 0 represents the first IDE or EIDE disk on the controller. The rdisk() parameter is always 0 for SCSI drives.
Partition Number. The partition() parameter refers to the partition number on a disk. Partition numbers start at 1. Primary partitions are assigned numbers first. Then, any drive letters in extended partitions are assigned numbers. So, partition(1) refers to the first primary partition on the specified disk.
So, an IDE drive with one controller and the Windows NT system files located on the second primary partition of the second drive would have the following ARC name:
multi(0)disk(0)rdisk(1)partition(2)
A SCSI drive with the same configuration would have:
scsi(0)disk(1)rdisk(0)partition(2)
When a member of a mirror set fails, you must first break the mirror set relationship. You might also want to break the mirror set relationship if you decide that you no longer want the mirror set.
To break the mirror set with Disk Administrator, select the mirror set you want to break, and choose Fault Tolerance, Break Mirror. A message appears notifying you of the changing of the mirror set into two separate disk partitions. Confirm that you want to break the mirror. Then choose Partition, Commit Changes Now. Once again, confirm the changes you're making and restart your computer when instructed to do so.
After the mirror set is broken, you should assign (if it isn't assigned already) the working partition the drive letter that was previously assigned to the mirror set. The failed partition should be assigned another drive letter. Then, you can use free space on another drive--or replace the failed drive and use the free space on the new drive--to create a new mirror set.
A stripe set with parity contains parity information that can be used to rebuild a failed partition. If a member of the stripe set with parity fails, you can rebuild all the information that was contained on that member. To rebuild a failed member of a stripe set with parity, select the stripe set with partity. Then select either a new area of free space on a different drive or a new drive. Make sure the new area of free space is at least as large as the other members of the stripe set with parity. Choose Fault Tolerance, Regenerate. Exit Disk Administrator and restart the Windows NT Server computer. When the computer restarts, the missing member is rebuilt.
The following list details a number of simple precautions you can take to reduce your chances of getting a virus under Windows NT. Following each precaution are one or more scenarios that can be averted by using the described technique. Finally, each precaution is also accompanied by a resolution section that helps simplify the recovery effort if your computer contracts a virus.
2. Configure your computer (in the CMOS setup) so that it boots from the hard drive, not from floppy disks. In addition, scan all floppy disks with an antivirus program.
3. Make sure you create Windows NT Emergency Disks when installing Windows NT. If you have not created emergency disks, use the RDISK.EXE program found in the WindowsNT\System32 directory to create these disks. Updatethese disks whenever you make changes to your system configuration.
4. Configure your Windows NTFS partitions so they employ file and directory level protection for critical files.
5. Use an on-access antivirus scanner to protect yourself against Macro and other viruses. The on-access scanner runs in the background and constantly searches for viruses each time you access files and disks. (All three products listed in Table 28.3 provide on-access scanning.)
| Product | Company | URL |
| Norton Antivirus for Windows NT | Symantec | http://www.symantec.com |
| VirusScan for Windows NT | McAfee | http://www.mcafee.com |
| InocuLAN for Windows NT | Cheyenne | http://www.cheyenne.com |
© Copyright, Macmillan Computer Publishing. All rights reserved.