Page 1 of 2 12 LastLast
Results 1 to 10 of 17
  1. #1
    Member
    Join Date
    Aug 2007
    Posts
    14
    Points
    2

    Default system32\config\system corrupt and now lsass.exe error

    Hi there, sorry this is so long but hopefully someone can please help me.

    I have an Advent T9100 PC with Windows XP Home Edition. I think it's OEM-installed, and the system hive on OEM installation creates passwords and user accounts that did not exist previously. Before the problem I was running on SP2, system restore was on by default. My PC did not come with an XP setup disk, just an Advent recovery disk, therefore I am using the 6 Windows XP Home SP2 setup floppy disks to get into the recovery console. If I run a non-destructive recovery from my Advent system recovery CD it does not solve the problem.

    Here are the details of my PC:
    http://www.uktsupport.co.uk/advent/pc/t9100.htm

    While logging in/loading into a user account on Windows, I shut down my PC via the power button. When I restarted the PC I received the following error:

    Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM

    I then followed this Microsoft Support article:
    http://support.microsoft.com/kb/307545
    However, I didn't read the following:
    "Warning - Do not use the procedure that is described in this article if your computer has an OEM-installed operating system. The system hive on OEM installations creates passwords and user accounts that did not exist previously. If you use the procedure that is described in this article, you may not be able to log back into the recovery console to restore the original registry hives."

    Fortunately I can still log back into the recovery console, so I copied a system.bak file from my Compaq PC and placed it in the config folder. I then read that this would not work. Now whenever I turn on my Advent PC, the Windows XP Home Editon screen appears with the loading bar, but then it continues to a black screen showing the following:

    lsass.exe
    When trying to update a password the return status indicates that the value provided as the current password is not correct.

    I assume this is due to me following the Microsoft article when I shouldn't have done, plus using a system.bak file from another PC. I also assume it is because of the OEM installation creating passwords that differ from normal XP installations.

    I then followed the help2go article here:

    http://www.help2go.com/Tutorials/Win...r_corrupt.html

    Option 1 results -
    I have backed up the files I want to another PC using Linux.
    I think my Advent T9100 has Western Digital Hard Drives from the spec website I found, when I used the diagnostic tool it said no Western Digital drive was found. Plus no drive manufacturer is shown when the side of my PC is opened up.

    Option 2 results -
    Running chkdsk \p said there is one or more problems. Running chkdsk did not help the problem.

    Option 3 results -
    I tried doing this solution and I get the "access denied" error when typing in
    C:\Windows>CD C:\system~1\_resto~1

    typing C:\>dir brings up the following in the list:

    0 System Volume Information

    I can't get around the "acces denied" error though, so this option isn't working for me.

    Before I try option 4 and 5 I have tried looking for other solutions to fix the lsass.exe password error. A similar forum thread to my problem is shown below, although I do not fully understand the first reply post. How would I type that into the recovery console?
    http://phorums.com.au/showthread.php?t=196063

    Can anyone please help me with this problem I'm having?
    I'm not sure how to get rid of the system.bak file I copied into the config folder from another PC.
    I also don't know how to restore the original 5 registery hives to get rid of the error: "lsass.exe When trying to update a password the return status indicates that the value provided as the current password is not correct."

    Thank you very much for reading I'll look forward to a reply.

    Airborne

  2. #2
    Member
    Join Date
    Aug 2007
    Posts
    14
    Points
    2

    Default

    Ok I followed these instructions at http://www.myfixes.com/articles/system

    I managed to get hold of a Windows XP Professional SP2 Operating System CD to work from instead of the 6 floppy disks.

    In the recovery console I typed:

    cd \
    cd windows
    cd system32
    cd config
    copy c:\windows\repair\system system

    I then got a file not found error so I tried:

    copy c:\windows\repair\system.bak system

    Then I typed the following :

    copy c:\windows\repair\security security
    copy c:\windows\repair\software software
    copy c:\windows\repair\sam sam
    copy c:\windows\repair\default default
    exit

    I was able to boot into an altered version of the operating system. Although the following error came up again:

    "Lsass.exe - system error: When trying to update a password the return status indicates that the value provided as the current password is not correct."

    I went back in to the recovery console only to discover that the administrative password is no longer blank, it has changed (eg. I can't just leave it blank and press enter anymore). Therefore I am now locked out of system restore as well and cannot gain access to it.

    Is a reformat and complete reinstall the only thing left to do to fix this?
    Thanks

  3. #3
    Member Spyware Fighter zep516's Avatar
    Join Date
    Dec 2005
    Location
    Pittsburgh, Pa
    Posts
    7,157
    Points
    1301

    Default

    Airborne,

    Read the WARNING as it pertains to oem software on the link below,

    see if it pertains to you.

    http://support.microsoft.com/kb/307545


    Zep

  4. #4
    Member
    Join Date
    Aug 2007
    Posts
    14
    Points
    2

    Default

    Hi Zep, thanks very much for the reply.

    Yes I mentioned that in my first post. I should not have used that solution, I read that warning when I first went to that page, although I did not know what an OEM installation was at the time, so I continued thinking that the solution was safe for me to use. I should have researched it further. Is there any way of confirming your PC is OEM?

    I'll do what this part of the warning suggests:
    "You can repair a corrupted registry in Windows XP. Corrupted registry files can cause a variety of different error messages. See the Microsoft Knowledge Base for articles about error messages that are related to registry issues."

    This could apply to me not being able to gain access to the recovery console password and my lsass.exe error? Anything else possible as a solution? I'll post back later with what I find out from the Windows Knowledge Base.

  5. #5
    Member Spyware Fighter zep516's Avatar
    Join Date
    Dec 2005
    Location
    Pittsburgh, Pa
    Posts
    7,157
    Points
    1301

    Default

    Airborne,

    "How do I know if I have a genuine Original Equipment Manufacturer (OEM) license for my operating system?"

    Every new PC manufactured and sold should include a Certificate of Authenticity label. This label should be affixed to the PC chassis. For tablet PC's and other small devices, the label may be affixed under the battery.

    That is the only way I know of, I did not read the first post I don't respond to the system/32 problem don't know enough about it let alone instruct someone through the repair----But I do know what (lsass.exe) is and it led me to the link i gave you.

    Zep

  6. #6
    Member Help2Go Moderator
    Join Date
    May 2003
    Location
    Boston, MA USA
    Posts
    2,994
    Points
    931

    Default

    the C:\windows\repair folder is not to be used. It doesn't contain updated information about your registry. Check the difference in file sizes, it sometimes is a difference of MB of data.

    Since you have another computer do you fell comfortable taking out your hard drive from the problem pc and hooking it up to your other working pc and then you can follow step 5 in the tutorial.

    Partie

  7. #7
    Member Help2Go Moderator
    Join Date
    May 2003
    Location
    Boston, MA USA
    Posts
    2,994
    Points
    931

    Default

    Also, I had the LSASS error randomly (not after trying to restore my registry) on my laptop after restarting one day. I tried following my own tutorial and actually had to try 3 different restore points before it works (The rpXX folders). I also had to hook my laptop hard drive up to my desktop as a lave so I could access the system volume information (C:\system~1) folder.

    Partie

  8. #8
    Member
    Join Date
    Aug 2007
    Posts
    14
    Points
    2

    Default

    Thanks again for your replies guys

    Zep cheers for pointing out the link, I've found the Certificate of Authenticity on the chassis, it got all the product keys etc. and says Windows XP Home Edition DSG Retail Limited.

    Hi PartieHoneteuse, thanks for the reply.

    I wouldn't know how to go about putting my hard drive into my other PC, I don't know wheather there is a possibility of altering it through firewire cable or something. I have an Apple MacBook and you can turn them on with the option to make it become an external hard drive for you to access all the files from another Mac (not sure about another PC). But do PC's have anything like this?

    I downloaded the following version of Linux onto CD from your tutorial, it seems to be the latest version:

    KNOPPIX_V5.1.1CD-2007-01-04-EN.iso 04-Jan-2007 00:58 696M

    However when I booted with this it said:
    "Can't find KNOPPIX filesystem, sorry. Dropping you to a very limited) shell.
    Press reset button to quit."

    I downloaded this version instead, because that's what the article mentioned and it worked.

    KNOPPIX_V3.9-2005-05-27-EN.iso 01-Jun-2005 08:17 696M

    However with this version I cannot change the "read write mode" of the C drive (hard disk partition...) due to it not allowing me to do risky things with it.

    I shall try downloading and burning version 5.1 and see if that boots up.

    KNOPPIX_V5.1.0CD-2006-12-30-EN.iso 30-Dec-2006 22:28 698M

    I'll then follow option 5 from your tutorial if it allows me to edit the "read write mode", and then I'll report back here on how it goes

    If I do copy the __registry_machine_system file and renaming it to SYSTEM etc. (mentioned in option 4), then will this restore my files as well, such as "My Documents" and "My Music"?
    If not then I may spend some time transfering the music to a flash drive to back up (I've backed up everything else I want already before), although it's taking a while to do the music.

    Thank you,

    Airborne

  9. #9
    Member
    Join Date
    Aug 2007
    Posts
    14
    Points
    2

    Default

    Hi again, here’s how I got on, please could you read the following.

    I’ve backed up the remaining files I want and went through option 5 of the tutorial. During the process when I got to the snapshot folder to view the restore points there were only five RPXX folder's labelled “RP1113” to “RP1117”.
    It was weird that there were no folders labelled “RP1” to “RP1112”. I don’t know why these folders weren’t there.

    Firstly, I tried copying and renaming the system file from the RP1116, folder but I still got the lsass.exe error.
    Next I tried the RP1115 folder, and the lsass.exe error occurred again on startup.
    I then replaced the remaining 4 files: default, security, software and sam (from folder RP115), into the config folder.
    This worked and got me to the user login page, although it takes ages for the screen to come up compared to before the problem occured.

    When the desktop loads it seems some programs don’t work but I can just reinstall them, all the desktop icons are there, however there is no “Start” button or blue bar at the bottom of the desktop. Therefore I can’t get to the start menu to access “Program Files” etc.
    I thought that “System Restore” could fix this problem but I can’t get to it because there’s no “Start” button, and the shortcut for opening the start menu (CTRL + ESC) isn’t working for some reason, I’ll try again tomorrow.
    I tried using the Advent recovery CD to do a non-destructive install, but that didn’t bring back the start bar.
    I also tried clicking and dragging upwards around the desktop bar area, still nothing. Therefore I went back and edited the 5 config folder files again, this time by using folder “RP114” instead of “RP115”. The same problem occurs with the start button and bar. Tomorrow I will try the last folder “RP113”.

    Anything else I can do to fix the “start” button bar? Otherwise I might do a destructive restore (reformat), what do you think?

    Thank you very much for reading, I’ll look forward to a reply.

    Airborne

  10. #10
    Member MrDarn's Avatar
    Join Date
    Jul 2007
    Location
    South East Northumberland
    Posts
    2,949
    Points
    557

    Default

    I'm really not that sure about your full problem, but i do know this:

    the taskbar and start button run from a file named 'explorer.exe'
    Now, since you have no start button, try this:

    hold down 'ctrl' and 'alt' and press delete. this should bring up your task manager, or at least an option to start task manager. from there, along the top should be the usual 'file' 'options' 'view' etc.
    click 'file' and their should be a 'run'(new task)' option.
    click that, and in the box, type explorer.exe

    This should find the right file, and load up your desktop with the task bar and start button.

    If not, Sorry i could not help!

    I know this does not solve your problem, but may help you get there!
    Always remember you're unique.


    ...Just like everyone else!
    If your problem is solved, here's how to say thanks!

    Windows XP
    Windows Vista
    Windows 7

Page 1 of 2 12 LastLast