In my last post I described a little bit about ReadyBoot and when looking at a xbootmgr trace what to look for when viewing the ReadyBoot data. I also described one method on how to fix it if there are no cache hits. So great, you fixed the one machine you looked at when following along in the blog but you want to make sure all the machines are healthy and if not fix them. Taking traces on every single machine in your environment and forcing 6 reboots is just not feasible. This is an alternate way.
It goes back to our old friend that we seem to always forget, the event log. You’ll want to navigate to Microsoft-Windows-ReadyBoost/Operational and look for Event ID 1016 about 1 minute after boot. This is logged every time the bootplan is calculated. The result should be 0x0. If you’re having the issue, the data will be 0x57.
How do I fix this for all my machines? Well, so far in the cases I’ve seen were able to fix this with this http://support.microsoft.com/kb/2555428. Now to be CLEAR about this, System Restore Points is not the ONLY way this file can hit its 512 KB size restriction. Other things such as a heavily loaded boot process(lots of apps, drivers, registry, etc) can cause this to occur as well. After applying the update go ahead and reboot. You should be all set. To confirm you can look for the same Event ID above but with 0x0 value.
I want to send a thanks to my down under, right near the end of the world Australian PFE Roger Southgate, hotlanta’s own PFE Jeff Stokes(whose blog you should also read http://blogs.technet.com/b/jeff_stokes/) , Eugene from the Product Group and Scott Ladewig for his help with testing.
Mark “I want to go on vacation to where Roger lives” Morowczynski