lsass problem

So, I have a small network at home and one of the machines is a Win2003 Server. It has been working fine until yesterday. Today, I did not have access to some of the resources, and upon checking the server, It had blue screened. Rebooting ends up with an error message:

lsass.exe system error

And in the text it says "Object not found". If I click the "OK" button, the PC reboots and ends up at the same place. This happens regardless what option I use in the boot options (safe mode, safe mode with networking, etc.)

I snooped around a bit and found various pages on the web about this issue. Most of them tell me to boot into the recovery console and then copy the lsass.exe file from other locations back into the location where it is supposed to be, as it may be corrupt. That doesn't seem to work for some reason. I can see the file in one other location, but when I try to copy it, I get "access denied". The same when I try to copy it from the Recovery DVD (with the additional complication that it seems to be compressed there (lsass.ex_), and the expand command also gives me "access denied".

So, I am stuck. I tried to connect the hard drive to a Win7 laptop to see if I can do it that way, but now that laptop is screwed up also (Invalid Partition Table) when I try to boot it.

I need help. anybody has an idea?

I don't want to reinstall the system on the 2003 server as it took me a long time to get it where I wanted it, and there is important data on the disk that I dont' want to lose.

Ok, some updates. As I was not able to get any further, I decided to run some hardware tests, and it seems that one of the DIMMs is bad. I took it out, and now, when I go into the boot menu and tell the computer to "load the last known good configuration", I get a bit further. I see the Win2003 splash screen and I can see that it goes through the progression "Windoes is starting up", "Preparing network connection", and "Configuring Windows", but then I get a BSOD: "page fault in nonpaged area".

Booting into "safe mode with networking" gets me a bit further. I get to a log on screen where I have to put in my credentials, and I can actually see a desktop with some icons. But then I get an error message that says something about a "hive" and that it was corrupted but fixed, and then I get the same BSOD. "page fault in non-pages area".

Any suggestions?

Small steps...

I figured that the page fault error might be due to faulty RAM. So I went ahead and got 2 new sticks and put them into the PC. This brought a small improvement:

When I boot into safe mode (with networking) now, the boot process actually runs through and I can log in. I get 2 error messages:

1) Something about Sharepoint having been updated and that I need to run something else to finish the process

2) A message that says I am running Windows in safe mode and that not everything might work.

Both messages only have an OK button. Pressing the button on message 1 simply makes that go away. Pressing the button on message 2 makes it go away, but then the system crashes with a "page fault" stop:0x000000050 message.

I am not sure what happens if I leave the message up. Will try that next.

Booting normally results in the same BSOD without the messages showing up after login.

I am curently running hardware tests to see if anything else might be wrong. I have already disabled the second HD, but no change.

I waited a few minutes with the "Windows is now in safe mode" message on the screen, then clicked it away. The desktop showed up, and I was able to open IE and do a few things, but after a minute or so I got the same page fault BSOD. What could this be? BTW, I loggeed on with a different UserID I had just created on the DC.

Are there any recent minidumps for me to examine?

Please zip up the 10 most recent minidumps and attach the resultant zip file to your next reply so I can have a closer look. There's a chance I might get some more useful info from them.

• Navigate to C:\Windows\Minidump <<< folder
• Click on the first minidump file to select it.
• Hold down the <Shift> key, and click on the last minidump file to select all of the files.
• Release the <Shift> key.
• Now, right-click on any one of the selected files > Send to ... > Compressed (zipped) Folder.
  The zip file will be located in the same place (the Minidump folder).
• Attach the zip file to your next reply.
  When you click on More Reply Options, you will see the facility to attach a file just below the box where you type your message.

Hi AustrAlian,

thank you very much for your efforts and your help. Appreciate it.

I have enclosed the last dozen or so minidumps.  Mini020713-09.zip   108.07K   1 downloads

• The following can be done in Safe Mode with networking.

• Download the GSmartControl installer application:
  • Go to the GSmartControl - Downloads page.
  • Scroll part way down the page to where the current version available for download will be displayed.
    
  • Click on the link to download the installer file to your computer.
    (There may be a mirror link there also which will enable you download the file if the main download link does not work for some reason.)
• Double-click the downloaded application to run it and install GSmartControl on the computer.
  Note: Vista/Win7 users, right-click > Run as Administrator
• When installation is complete, run GSmartControl:
  • Start GSmartControl from the Start > Programs menu.
• When the interface has loaded and scanning for hard drives is complete, click on the hard drive icon to select the device.
• Go to Device on the top menu > View Details, and a new Device Information window will open.
• Click on the Attributes tab to display the S.M.A.R.T data values.
• Near the bottom of the window, click on View Output and a new Smartctl Output window will open.
• Right-click anywhere inside that window > Select All.
• Again right-click in that selected area > Copy.
• Now paste that in a reply to your topic.
  Note: Please enclose the pasted report in CODE tags so that the spacing/formatting is preserved (to make it easier for all to read).
  • Firstly, click on the "Insert code snippet" button
    You will then see the "start" and "end" code tags (highlighted in dark blue/selected in the image) in the text box.
  • Click between the two tags to insert the cursor between the tags and then press <Ctrl+V> to paste the report there.

Thanks. I will do this tomorrow.

Sorry, no go. I can boot into safe mode, but then I can hardly do anything. I have virtually no permission to do anything. In particular can I not run the software that I downloaded. Is there a way to boot a version of Windows from a CD that would at least allow me to read a memory stick and perhaps run the software from there?

Hello mike_bo

I suggest that you download and burn a bootable Lucid Puppy CD (since PartedMagic seems to have a compatibility problem?).

Booting the problematic computer from this CD should enable us to check out the hardware to a certain extent.

Boot to the Lucid Puppy CD.

• Does Puppy load successfully to the Desktop?
• If not, what happens?

Let me know the result.

If booting to Puppy is successful, then I will post instruction for you to do the following which will enable us to view the available S.M.A.R.T. data for the HDD.

1. Configure an internet connection.
2. Download and install the GSmartControl package to Lucid.
3. Run GSmartControl and save the results.
4. Post the GSmartControl results (report) to the forums.

Do you have a USB flashdrive that we can use to save changes (eg installing the GSmartControl package) that you make to the Lucid installation?

I will try that next.

I had decided to bite the bullet and re-install the OS, but then it offered me the option to repair the existing installation. Took a long time, but eventually it went through, and it seems as if a lot was reinstalled, but I have kept the major parts of the old system (log ins, domains, etc), so I am hopeful that it also kept the old information. The software now boot through to the login screen (in normal mode). Along the way I get an error message that something could not be written by "w3dbsmgr". When I click "OK" (stop the program), it continues booting and I then get a message that "at least one driver failed during startup". At this point I look at my startup screen. When I then log in, I get another message that "mscorwks" could not be loaded, and then it goes to the BSOD. And I have it pared down to the minimum at this point: 1 memory stick (1 GB) which I moved to another DIMM slot, one HD, the CD drive, and the video card. That's it.

I tried to boot into safe mode to look at the events, but it crashed on me before I could get there.

I will simply let the computer run tonight, there seems to be a lot of disk activity going on right now (sitting at the login screen), and then try the Puppy thing tomorrow.

Thanks.

Ok, This is where I am now:

computer boots into Win2003 and gives the error messages above. It runs stable (at least 2 days) at the login prompt, but crashes with the page fault error when I log in (either normal mode or safe mode). I have donwloaded the Puppy Linux and loaded it and I am staring at the desktop now. the PC is now pretty much bare bones (Motherboard, 1 memory stick, HD, video card)

You said we could use this to run some hardware tests to see if anything is broken. Can you help me with that? Thanks.

Sorry. Saw that you posted some further instructions above. Will get gsmartcontrol and post results.

Ok, so I downloaded gsmartcontrol (which is a test utility for the hard disk, right?) and ran the short self test. Result: "Completed without error."

Then I ran the extended self test: "Completed without error"

What's next?

Ok. MAJOR developments: As I had mentioned, I can run the server without logging in and it runs stable. It crashes when I either log in from the screen, or when I use remote desktop to log in. Same in safe mode. So I thought, let's have someone else try. I got one of my users, who is remote to VPN into the system and try to log in, expecting the PC to crash. Lo and behold, it did NOT! So I set up yet another alias user for me and had my user use those login credentials. And it held!! After than I could log in with those new credentials also. So, it looks as if something was corrupt with my old login. So, it seems we're back in business and I can try to hunt down the problems reported in the event viewer.

But here's the next thing: So I thought I put in another hard disk that I can use as a backup medium. I put in the disk, and connected ti to the SATA connection #3. Then started the computer. It went into the chkdsk routine, and has been working on this for the last 3 hours. I am wondering if that is normal (the new HD it 2 TB, but it's not even formatted). Should I wait at this point, or should I do a hard reset (power button), remove the hard disk, and try again?