Set Sail For Uncharted NT Performance

Dig into a pirate's treasure of Registry gems tomaximize system performance

I guess you can say that I've always questioned authority. When Ihear, "Don't do that," my usual response is, "Why? What wouldhappen if I did ?" Although my questioning nature sometimesfrustrated my teachers (and perhaps contributed to a few gray hairs), suchrebelliousness has its virtues. Questioning authority--in this case,Microsoft--has helped me discover new levels of system performance for WindowsNT.

Mutiny on the MS Bounty
I never heeded Microsoft's decree that NT is a completely self-optimizingoperating system, one that users don't need to tweak to achieve maximumperformance. "Just add more expensive hardware," said Microsoft, "and the promised land of faster performance will be yours." Bah! I knew there must be ways to improve NT's performance with my existing equipment. Remembering the significant performance increases I achieved by tweaking other Microsoft operating systems, I doubted that Microsoft's developers made NT so different that they removed every possibility for the user to enhance performance. I realized that I could no longer be a mild-mannered, obedient NT user; this job clearly required a Registry pirate. With this mindset, I donned my eye patch and sword (and Registry editor), and set sail for uncharted NT performance. In this article (and in future articles), I'll log the results of my expeditions.

Pirate's Rule #1:
Default Settings Equal Milquetoast Performance
The first thing any good NT performance pirate needs to know is that defaultsettings are usually not ideal. The good news about default settings is thatthey work for most users. The bad news is that they don't give everyone the bestperformance for a particular situation or application. After all, how can asystem be truly self-optimizing if it doesn't know how you're using it? Are yourapplications disk bound, compute bound, or both? Does the amount of physical RAMyou have far exceed your typical working set (the amount of memory a processuses or allocates), or are you running close to the edge? Do you want thehighest priority to go to foreground or background tasks, or do you wantexecution spread evenly among all tasks? The answers to these questionssignificantly affect NT's performance. Furthermore, if you haven't explicitlytold NT how you want the system conFigured, NT is automatically answering thesequestions for you. If you're like me, you'll want more involvement in thedecision-making process.

Pirate's Rule #2:
The Best Buried Treasure Is in the Registry
Several Registry modifications play an important role in optimizing NT.After you understand these buried gems, you can significantly alter yoursystem's performance. Some changes can substantially boost your system's overallspeed, but inappropriate changes can decrease performance. Therefore, as Idiscuss each Registry modification, I'll provide enough information to help youmake intelligent decisions about each change and determine which changes areappropriate for your situation. You need to be proficient in using NT's Registryeditors (REGEDT32.EXE and REGEDIT.EXE) and always be prepared for disaster,which leads us to Pirate's Rule #3.

Pirate's Rule #3:
Smart Pirates Make Backups
Any modification to the system Registry, no matter how well documented orwell intentioned, always involves a certain degree of risk. Any of the Registrymodifications I discuss in this article can potentially damage your NTinstallation or make it unbootable. Therefore, you need a full system backup andan updated copy of the Emergency Repair Disk (use RDISK /S so that you get theSAM and SECURITY Registry hives in addition to the usual information that theRDISK utility backs up) before you make any changes to the Registry. Irecommend that you make an additional copy of the Registry using the REGBACK.EXEutility from the Microsoft Windows NT Workstation Resource Kitor Microsoft Windows NT Server Resource Kit CD-ROMs. If your bootpartition is a FAT volume accessible via an MS-DOS boot disk and the Registrybecomes corrupt or damaged, you can replace the damaged version in the%SYSTEMROOT%SYSTEM32CONFIG folder with the uncompressed copy.

You can also restore a damaged Registry by using the option to "Pressspacebar now to invoke Hardware Profile/Last Known Good menu" duringNT's boot process, or by using NT Setup's option to "Repair a damagedWindows NT installation" (which uses the information stored on theEmergency Repair Disk to restore the system Registry). However, the ultimatemethod of performing Registry backups and restores is to use a utility designedspecifically for that purpose, such as the ConfigSafe NT utility from imagineLAN. This handy utility lets you make multiple backups of your system Registryand dynamically restore your choice of versions if a problem occurs. One finalutility toolkit to consider is the set of NT tools available at the NT InternalsWeb site (http://www.ntinternals.com and http://www.winternals.com). TheNTRecover utility is handy for doing dead-system recovery when your system won'tboot at all; another handy utility is NTFrob, which gives you an amazing levelof control over just about every aspect of NT's file cache.

Pirate's Rule #4:
The Proof Is in the Benchmark
One final rule to keep in mind: Do not conclude that a change is effectiveor worthwhile until you've proved it with a benchmark. To determine the effectof a particular change, use a benchmarking utility to gain both before and afterpictures of system performance. Also, remember to make only one changeat a time; then, reboot the system and test. Otherwise, you won't be able topinpoint the source of a performance improvement or degradation. I recommend twocomplementary benchmarking utilities that serve different purposes. U Software'sBench32 is a very effective NT and Windows 95 utility that measures CPU, memory,disk, and video performance and compares them to a baseline system. BAPCo'sSYSmark for Windows NT 4.0 is a real-world application benchmark utility. Ratherthan measuring raw throughput for I/O subsystems, this utility measures theperformance of several business applications, such as Microsoft's Word, Excel,and PowerPoint. (For more information about these two benchmark utilities, visitthe U Software and BAPCo Web sites.)

First Stop: The Paging File
Let's begin our voyage by examining one of the most important contributingfactors to an NT system's overall performance: the disk subsystem. NT heavilyuses the paging file to swap program code and data from memory to disk and back.NT's use of the paging file is significant even on systems with large amounts ofinstalled memory. Don't fall into the trap of believing that just because yoursystem has lots of available RAM, the paging file goes unused. It doesn't.Although use of the paging file will certainly decrease, NT will continue to usethe paging file to swap system code, user code, and data between memory anddisk. Therefore, how well NT performs paging on a system is extremely important.Even systems with fast CPUs and lots of memory will suffer from a non-optimizedpaging file.

The steps for increasing paging file performance are simple but effective.First, in the Virtual Memory box on the Performance tab of the System applet inControl Panel, click Change to display the paging file configuration window. Setthe initial and maximum sizes of the paging file to the same value. Matchingthese sizes reduces the inevitable and performance-hampering file fragmentationthat occurs to a dynamically resizable paging file (one with a different initialand maximum size) as the system grows and shrinks the file. The maximum valueneeds to be large enough to easily accommodate the largest memory footprint yoursystem will achieve; you definitely don't want your system running out ofpaging-file space in mid-operation. To get a sense of the maximum memory usageon your system, load all the applications you typically run, launch NT TaskManager, and check the Peak Commit Charge value on the Performance tab.

Next, spread the paging file across as many physical disks as possible,rather than placing it on one disk. This approach distributes the load acrossmultiple independent drives and improves paging file performance. To furthermaximize paging file performance, place the paging file on a dedicated diskpartition (preferably a separate physical disk) and set the initial and maximumpaging file sizes to the size of the partition. This setup eliminates theproblem of paging file fragmentation and optimizes paging performance. However,you need to format the volume as FAT and not NTFS (for more information aboutthese two file systems, see "NTFS vs. FAT," October 1996), for tworeasons: FAT is significantly faster than NTFS on smaller (under 2GB) volumes,and the NTFS file system places a second copy of the MFT (Master File Table) inthe middle of your hard disk. This placement breaks your paging file into twopieces and prevents it from occupying one contiguous block of disk space.Finally, to enhance performance even further, place your dedicated paging fileon a stripe set volume made up of two or more equally sized partitions onseparate physical disks. Ideally, choose SCSI drives because SCSI is typicallymuch faster for multidrive volumes such as stripe sets, mirror sets, and stripesets with parity. You'll be amazed at the performance differences you achieveduring paging file access with this setup compared with placing the paging fileon a volume containing the NT operating system or applications. The performanceincrease is especially significant on NT systems that experience a high amountof paging file usage. However, if you have limited disk resources and you mustshare the disk that contains the paging file with other data, be sure to placethe paging file on the least busy disk in your system.

Stop Paging the Executive
NT doesn't limit paging activity to only user applications and data: NT maypage out portions of itself to disk during system operation. On systems withsufficient RAM (at least 16MB more than the average total working set of thesystem, including the operating system, user applications, and data), disablingNT's ability to page the Windows NT Executive to disk can enhance performance.To force this behavior, you need to find the following Registry key:HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession ManagerMemoryManagement. The DisablePagingExecutive value tells NT whether it can page systemdrivers and code to disk when they're not in use. The default value is 0 (allowpaging); if you change the value to 1, all drivers and the NT kernel remain inRAM at all times. If you make this change, be sure your system has plenty ofavailable memory after you load the system and user applications; otherwise,application performance will suffer. On systems with plenty of RAM, this changereduces NT's paging operations and helps improve performance.

Cashing In on Cache Priorities
Another useful disk-related performance tweak relates to NT's prioritizationof the file system cache. NT constantly juggles memory used for the file systemcache and memory used for running processes (services and applications). On NTServer computers, you can change this prioritization by editing the propertiesof the Server service on the Services tab in Control Panel's Network applet.

Screen 1 shows the Server configuration dialog box. Depending on theOptimization setting, NT either minimizes the memory used for the file cache(Minimize Memory Used), balances the distribution of memory between the cacheand the running processes (Balance), favors the use of memory for the systemfile cache (Maximize Throughput for File Sharing), or favors the use of memoryfor applications (Maximize Throughput for Network Applications). In a futurearticle, I'll detail the effects these settings have on the system and look atanother problem concerning this entry.

Although this procedure works fine for NT Server, what about NTWorkstation? If you attempt to conFigure the Server service on an NTWorkstation, you get a message that you cannot conFigure the service. Should youaccept this statement? Heck, no! You can conFigure NT Workstation with the sameentries as NT Server; however, you must manually edit the Registry. Thefollowing Registry values control the file system cache prioritization:LargeSystemCache in HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession ManagerMemoryManagement and Size in HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanManServerParameters.

Microsoft's documentation states that configuring the Server serviceaffects only the LargeSystemCache value. However, examining the Registry duringServer configuration reveals that both values change. Table 1 summarizes Serverconfiguration options and the corresponding LargeSystemCache and Size values.The default values are the settings for the Minimize Memory Used option, whichminimizes the memory NT allocates to the system cache and the working set ofprocesses.

If you have plenty of RAM on your system and want to realize significantincreases in disk performance, try changing the Registry values to the settingsfor the Balance or Maximize Throughput for File Sharing options. The Balanceoption balances memory usage between the file system cache and the processworking sets, but it uses a larger file system cache than the cache it uses withthe default setting. Maximize Throughput for File Sharing prioritizes the cacheover the working set of processes; consequently, it may not be the best settingfor workstations.

On some systems, I've seen disk performance increase from 5 percent to 50percent after making one of these changes. However, you'll need to experimentwith different LargeSystemCache and Size values and benchmark results before andafter the change to find the best settings for your system. In most cases,you'll find that the Balance settings give the best overall performance.

On NT systems with insufficient amounts of free physical memory, settingLargeSystemCache to a non-zero value usually increases paging file activitybecause memory usage is prioritized in favor of the system cache rather thansystem processes. If applications need additional memory, the extra memoryusually comes from the paging file. The resulting increase in paging fileactivity typically reduces overall system performance.

Turbocharging NTFS
If you're using NTFS on your system, several changes can help you increasethe file system's speed. The first and most basic setting is one that NTFSchooses automatically when you format a new NTFS partition: the volume's clustersize (NTFS allocates disk storage in units known as clusters).Typically, NTFS selects the volume's cluster size (measured in bytes) from alist of defaults that relate to the volume's total capacity. Table 2 lists thedefault cluster sizes for ranges of volume size.

Usually, the default cluster size provides good performance; however,reformatting the volume with a different cluster size can enhance performance insome environments. Unfortunately, to change cluster size, you must back up theentire volume to tape (or to another volume), reformat the volume with the newcluster size, and then restore the data. You can use NT's Disk Administratorutility, as shown in Screen 2, or use the FORMAT command from the NT commandprompt to specify the cluster size when you format NTFS volumes. The syntax forthe FORMAT command is

FORMAT : /FS:NTFS /A:

where drive is the drive letter of the drive to format, and sizeis the cluster size to use on the new volume (512, 1024, 2048, 4096, 8192, 16K,32K, or 64K). This setting overrides the default cluster size. (At cluster sizesabove 4096, NTFS does not support some features, such as NTFS compression andvirus checking.) A third method for specifying cluster size is to double-clickMy Computer on the desktop, right-click the volume, and select Format. When theFormat dialog box appears, simply change Allocation Unit Size to a value fromthe drop-down list.

Changing a volume's cluster size may be appropriate depending on the typeof files on the volume. For example, a volume with a large number of small filesmay perform better with a small cluster size, whereas a volume with a few verylarge files may perform better with a large cluster size. Be sure to benchmarkeach cluster size scenario with lengthy file I/O operations, using files ofdifferent sizes if possible (Bench32 lets you test disks with files from 1MB to20MB in size). If you experiment with different cluster sizes, start small: Moveup or down one cluster size at a time and then retest. Once you find the clustersize that yields the best performance for the average file size to be stored onthe volume, you can restore the data to the volume.

NTFS is a sophisticated file system, and features such as the extendedattributes that NTFS files use to support NT permissions increase overhead toyour system. Certain default NTFS behaviors can unnecessarily reduce yoursystem's performance. One such behavior is the automatic generation of 8.3DOS-style filenames for all files stored on NTFS volumes. Because NTFS mustgenerate an 8.3-style name for each new file created on the volume, writeoperations with such names take longer than write operations that use only longfilenames. If your network doesn't include any DOS or Windows 3.x clients, youcan disable this automatic feature. In the Registry, change the value ofNtfsDisable8dot3NameCreation to 1 in HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlFileSystem.

Several points are important to keep in mind about this procedure. First,be sure that your network does not now contain (and will not contain in thefuture) any systems that use DOS, Windows 3.x, or Windows for Workgroups 3.x.These systems cannot use NTFS files without 8.3-style names. Second, be awarethat changing this Registry value affects only future files stored on thevolume. Existing files retain their 8.3 version names until you remove the filesfrom the volume. If you want to start with a clean slate, set the Registry valueto 1, move all the files to another volume or tape, and then move them back tothe original volume.

As long as we're in HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlFileSystem,I'll point out another file system-related setting that canimprove NTFS performance. The NtfsDisableLastAccessUpdate entry controlswhether NTFS updates the LastAccess time/date stamp on directories as NTFStraverses the directory structure. Disabling updates can also reduce NTFSoverhead, without significantly impairing functionality. The default value is 0(NTFS updates directory time/date stamps); change the value to 1 to disableupdates. If you don't see the NtfsDisableLastAccessUpdate entry, you canmanually add it as a REG_DWORD type with value 1. However, if you add thisentry, be very careful to spell the name correctly, including capitalization.

Here's one last item on disk performance optimization: Whenever possible,keep the amount of free space on a physical disk at 40 percent or more. When theamount of free space drops below 40 percent, the disk takes significantly moretime to find free space to write data. Although you can mitigate this effect byregularly using a disk defragmentation tool (e.g., Executive Software'sDiskeeper or Symantec's SpeedDisk utility in Norton Utilities for Windows NT),you'll still experience a significant performance hit on a crowded disk.

X Marks the Spot
As with all system-tuning modifications, I highly recommend that you firsttry the modifications I've described in this article on non-production machinesbefore you change your network servers and workstations. Occasionally, you mayfind hidden ramifications that affect particular applications. By testing themodifications first, you reduce the possibility of any unpleasant surprises.Finally, remember to benchmark system performance before and after each systemmodification so that you can quantify the performance effects of each change.You might also want to consider doing each benchmark twice or (even better)doing the tests on two different systems. This tactic gives you a more objectivetest and helps reduce the possibility that some software or hardware peculiaritywill interfere with the accuracy of your tests.