Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

lsass problem


  • Please log in to reply
14 replies to this topic

#1 mike_bo

mike_bo

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 07 February 2013 - 08:42 PM

So, I have a small network at home and one of the machines is a Win2003 Server. It has been working fine until yesterday. Today, I did not have access to some of the resources, and upon checking the server, It had blue screened. Rebooting ends up with an error message:

 

lsass.exe system error

 

And in the text it says "Object not found". If I click the "OK" button, the PC reboots and ends up at the same place. This happens regardless what option I use in the boot options (safe mode, safe mode with networking, etc.)

 

I snooped around a bit and found various pages on the web about this issue. Most of them tell me to boot into the recovery console and then copy the lsass.exe file from other locations back into the location where it is supposed to be, as it may be corrupt. That doesn't seem to work for some reason. I can see the file in one other location, but when I try to copy it, I get "access denied". The same when I try to copy it from the Recovery DVD (with the additional complication that it seems to be compressed there (lsass.ex_), and the expand command also gives me "access denied".

 

So, I am stuck. I tried to connect the hard drive to a Win7 laptop to see if I can do it that way, but now that laptop is screwed up also (Invalid Partition Table) when I try to boot it.

 

I need help. anybody has an idea?

 

I don't want to reinstall the system on the 2003 server as it took me a long time to get it where I wanted it, and there is important data on the disk that I dont' want to lose.



BC AdBot (Login to Remove)

 


#2 mike_bo

mike_bo
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 08 February 2013 - 02:19 AM

Ok, some updates. As I was not able to get any further, I decided to run some hardware tests, and it seems that one of the DIMMs is bad. I took it out, and now, when I go into the boot menu and tell the computer to "load the last known good configuration", I get a bit further. I see the Win2003 splash screen and I can see that it goes through the progression "Windoes is starting up", "Preparing network connection", and "Configuring Windows", but then I get a BSOD: "page fault in nonpaged area".

Booting into "safe mode with networking" gets me a bit further. I get to a log on screen where I have to put in my credentials, and I can actually see a desktop with some icons. But then I get an error message that says something about a "hive" and that it was corrupted but fixed, and then I get the same BSOD. "page fault in non-pages area".

 

Any suggestions?



#3 mike_bo

mike_bo
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 08 February 2013 - 01:34 PM

Small steps...

 

I figured that the page fault error might be due to faulty RAM. So I went ahead and got 2 new sticks and put them into the PC. This brought a small improvement:

 

When I boot into safe mode (with networking) now, the boot process actually runs through and I can log in. I get 2 error messages:

 

1) Something about Sharepoint having been updated and that I need to run something else to finish the process

2) A message that says I am running Windows in safe mode and that not everything might work.

 

Both messages only have an OK button. Pressing the button on message 1 simply makes that go away. Pressing the button on message 2 makes it go away, but then the system crashes with a "page fault" stop:0x000000050 message.

 

I am not sure what happens if I leave the message up. Will try that next.

 

Booting normally results in the same BSOD without the messages showing up after login.

 

I am curently running hardware tests to see if anything else might be wrong. I have already disabled the second HD, but no change.



#4 mike_bo

mike_bo
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 08 February 2013 - 02:20 PM

I waited a few minutes with the "Windows is now in safe mode" message on the screen, then clicked it away. The desktop showed up, and I was able to open IE and do a few things, but after a minute or so I got the same page fault BSOD. What could this be? BTW, I loggeed on with a different UserID I had just created on the DC.



#5 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:04:09 PM

Posted 08 February 2013 - 06:42 PM

Are there any recent minidumps for me to examine?

 

Please zip up the 10 most recent minidumps and attach the resultant zip file to your next reply so I can have a closer look. There's a chance I might get some more useful info from them.

  • Navigate to C:\Windows\Minidump <<< folder
  • Click on the first minidump file to select it.
  • Hold down the <Shift> key, and click on the last minidump file to select all of the files.
  • Release the <Shift> key.
  • Now, right-click on any one of the selected files > Send to ... > Compressed (zipped) Folder.
    The zip file will be located in the same place (the Minidump folder).
  • Attach the zip file to your next reply.
    When you click on More Reply Options, you will see the facility to attach a file just below the box where you type your message.


AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#6 mike_bo

mike_bo
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 08 February 2013 - 08:53 PM

Hi AustrAlian,

 

thank you very much for your efforts and your help. Appreciate it.

 

I have enclosed the last dozen or so minidumps. Attached File  Mini020713-09.zip   108.07KB   1 downloads

 



#7 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:04:09 PM

Posted 09 February 2013 - 01:22 AM

One of the 12 minidumps is 0 bytes in size and a couple of others are corrupt. This indicates that the problem is likely hardware-related.
 
Let's have a look at the condition of the hard drive.
  • The following can be done in Safe Mode with networking.
How to obtain hard drive S.M.A.R.T. data on a Windows system and then paste the report into a forum post
  • Download the GSmartControl installer application:
    • Go to the GSmartControl - Downloads page.
    • Scroll part way down the page to where the current version available for download will be displayed.
      gsmartcontrolwindowsdownload.png
    • Click on the link to download the installer file to your computer.
      (There may be a mirror link there also which will enable you download the file if the main download link does not work for some reason.)
  • Double-click the downloaded application to run it and install GSmartControl on the computer.
    Note: Vista/Win7 users, right-click > Run as Administrator
  • When installation is complete, run GSmartControl:
    • Start GSmartControl from the Start > Programs menu.
  • When the interface has loaded and scanning for hard drives is complete, click on the hard drive icon to select the device.
  • Go to Device on the top menu > View Details, and a new Device Information window will open.
  • Click on the Attributes tab to display the S.M.A.R.T data values.
  • Near the bottom of the window, click on View Output and a new Smartctl Output window will open.
  • Right-click anywhere inside that window > Select All.
  • Again right-click in that selected area > Copy.
  • Now paste that in a reply to your topic.
    Note: Please enclose the pasted report in CODE tags so that the spacing/formatting is preserved (to make it easier for all to read).
    • Firstly, click on the "Insert code snippet" button Insertcodesnippetdetail2.png
      You will then see the "start" and "end" code tags (highlighted in dark blue/selected in the image) in the text box.
    • Click between the two tags to insert the cursor between the tags and then press <Ctrl+V> to paste the report there.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#8 mike_bo

mike_bo
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 09 February 2013 - 02:26 AM

Thanks. I will do this tomorrow.



#9 mike_bo

mike_bo
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 10 February 2013 - 03:48 PM

Sorry, no go. I can boot into safe mode, but then I can hardly do anything. I have virtually no permission to do anything. In particular can I not run the software that I downloaded. Is there a way to boot a version of Windows from a CD that would at least allow me to read a memory stick and perhaps run the software from there?



#10 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:04:09 PM

Posted 10 February 2013 - 05:19 PM

Hello mike_bo

 

I suggest that you download and burn a bootable Lucid Puppy CD (since PartedMagic seems to have a compatibility problem?).

Booting the problematic computer from this CD should enable us to check out the hardware to a certain extent.

 

Boot to the Lucid Puppy CD.

  • Does Puppy load successfully to the Desktop?
  • If not, what happens?

Let me know the result.

 

If booting to Puppy is successful, then I will post instruction for you to do the following which will enable us to view the available S.M.A.R.T. data for the HDD.

  1. Configure an internet connection.
  2. Download and install the GSmartControl package to Lucid.
  3. Run GSmartControl and save the results.
  4. Post the GSmartControl results (report) to the forums.

Do you have a USB flashdrive that we can use to save changes (eg installing the GSmartControl package) that you make to the Lucid installation?


AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#11 mike_bo

mike_bo
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 10 February 2013 - 10:12 PM

I will try that next.

 

I had decided to bite the bullet and re-install the OS, but then it offered me the option to repair the existing installation. Took a long time, but eventually it went through, and it seems as if a lot was reinstalled, but I have kept the major parts of the old system (log ins, domains, etc), so I am hopeful that it also kept the old information. The software now boot through to the login screen (in normal mode). Along the way I get an error message that something could not be written by "w3dbsmgr". When I click "OK" (stop the program), it continues booting and I then get a message that "at least one driver failed during startup". At this point I look at my startup screen. When I then log in, I get another message that "mscorwks" could not be loaded, and then it goes to the BSOD. And I have it pared down to the minimum at this point: 1 memory stick (1 GB) which I moved to another DIMM slot, one HD, the CD drive, and the video card. That's it.

I tried to boot into safe mode to look at the events, but it crashed on me before I could get there.

 

I will simply let the computer run tonight, there seems to be a lot of disk activity going on right now (sitting at the login screen), and then try the Puppy thing tomorrow.

 

Thanks.



#12 mike_bo

mike_bo
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 12 February 2013 - 10:14 AM

Ok, This is where I am now:

 

computer boots into Win2003 and gives the error messages above. It runs stable (at least 2 days) at the login prompt, but crashes with the page fault error when I log in (either normal mode or safe mode). I have donwloaded the Puppy Linux and loaded it and I am staring at the desktop now. the PC is now pretty much bare bones (Motherboard, 1 memory stick, HD, video card)

 

You said we could use this to run some hardware tests to see if anything is broken. Can you help me with that? Thanks.



#13 mike_bo

mike_bo
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 12 February 2013 - 10:20 AM

Sorry. Saw that you posted some further instructions above. Will get gsmartcontrol and post results.



#14 mike_bo

mike_bo
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 12 February 2013 - 12:10 PM

Ok, so I downloaded gsmartcontrol (which is a test utility for the hard disk, right?) and ran the short self test. Result: "Completed without error."

 

Then I ran the extended self test: "Completed without error"

 

What's next?



#15 mike_bo

mike_bo
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:10:09 PM

Posted 13 February 2013 - 07:01 PM

Ok. MAJOR developments: As I had mentioned, I can run the server without logging in and it runs stable. It crashes when I either log in from the screen, or when I use remote desktop to log in. Same in safe mode. So I thought, let's have someone else try. I got one of my users, who is remote to VPN into the system and try to log in, expecting the PC to crash. Lo and behold, it did NOT! So I set up yet another alias user for me and had my user use those login credentials. And it held!! After than I could log in with those new credentials also. So, it looks as if something was corrupt with my old login. So, it seems we're back in business and I can try to hunt down the problems reported in the event viewer.

 

But here's the next thing: So I thought I put in another hard disk that I can use as a backup medium. I put in the disk, and connected ti to the SATA connection #3. Then started the computer. It went into the chkdsk routine, and has been working on this for the last 3 hours. I am wondering if that is normal (the new HD it 2 TB, but it's not even formatted). Should I wait at this point, or should I do a hard reset (power button), remove the hard disk, and try again?






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users