Isass.exe system error--XP won't boot

**McGuireV10** · September 14th, 2003, 09:58 PM

Actually I'm a Senior Architect for a Fortune 50 corporation. I know quite a lot about Windows 2003, and was even a beta tester for both it and the .NET Framework and Visual Studio .NET. My current orientation towards MS is a love/hate relationship, and I only mentioned DOS 1.xx to point out that this relationship goes back to dealing with MS at the very, very beginning. I have 24 years of computers under my belt, and I hate to say that my opinion of MS has declined steadily for the past 7 or 8 years.

However, I must agree, I don't have a lot of hope for Linux. I don't actually LIKE using Linux at all (I've installed it and used it here and there) -- I'm just sick and tired of running into dead ends like this lsass error. It's merely the ONLY half-viable alternative out there (you couldn't GIVE me a Mac... at least, not one that I wouldn't turn around and sell as quickly as possible). I've spent a LOT of personal money with Microsoft in my life, and I've spent literally millions through various employers on various projects, and I just don't feel like MS is holding up their end of the deal any more.

I have plenty of options for backing up -- a network, lots of other machines, and so on -- I just didn't have anything convenient.

I run XP because I have to write software for several thousand users running XP, and long experience has taught me it's a lot easier if my daily-use system is the same as my primary target system. I run Tiny because I *know* what it does, and it gives me a lot of control. The XP firewall is largely undocumented, and I simply don't trust MS to do a good job. It might actually be better. It could be amazingly fantastic -- but I don't trust it, whereas TPFW is well-known, small, reliable, and highly configurable.

DOS 6.22 -- agreed.

Mainly I just dropped in to add my two cents about what seems to have fixed the problem with lsass (which, by the way, I found stands for Local Security Administration System Service, just in case anybody was wondering).

**Kinslayer** · September 14th, 2003, 10:08 PM

I wouldn't sell the Mac, because it would surely end up as some idiot asking me how to use it or, why they can't upgrade it or somthing. ..I would probably put it on the network, and lean it up against a door, to prop it open..if someone asks, I would simply say "It's my Doorstop server".

Ok, your XP excuse is probably the only one that I would accept.

..And as for the firewall, I would really expect you to have a hardware solution, they are so cheap these days.

**McGuireV10** · September 15th, 2003, 04:25 AM

Originally posted by Kinslayer
..And as for the firewall, I would really expect you to have a hardware solution, they are so cheap these days.

I use LinkSys stuff to wire up the network -- amazing how cheap little 8-port switches are now, and the BEFSR41 is ok. I like the NetGear stuff better, but I had a LinkSys already.

I like Tiny because it lets me block net access per application. I don't like things like Media Player going out and doing who-knows-what without my approval... again, I just don't trust MS that much any more. Used to be, I wouldn't have cared, but not any more.

**demnos** · September 24th, 2003, 08:08 PM

So, back to the lsass.exe errors. Any other suggestions for fixes/workarounds?

I have a computer here that is giving me the "Endpoint format is invalid" error. It comes up in safe-mode as well as in normal boot. I'm going to try disabling IPSEC to see if that works but I was just wondering if anyone has had any more luck with this.

**McGuireV10** · September 24th, 2003, 09:52 PM

I had this happen on a second machine four days ago. Out of curiosity I tried disabling IPSEC again, and once again it didn't fix it. So then I uninstalled the MS RPC exploit patch (Q817606), and just like before, that fixed it.

**demnos** · September 25th, 2003, 02:46 PM

Yes, but how do you install this if you can't login to windows. I cannot get into windows by either safe mode or by regular startup. The only thing that I can get anywhere with is the Recovery Console. Is it possible to install that update via the Recovery Console?

**McGuireV10** · September 25th, 2003, 03:38 PM

In both cases, if I just kept rebooting, eventually Windows would start. Probably 1 out of every 10-15 tries. Networking didn't work, but everything else did. I was also able to start by choosing safe mode with networking -- oddly, safe mode without networking didn't work.

I don't think you could remove the update (that's what fixed it, not installing) from the Recovery Console, sorry.

**demnos** · September 25th, 2003, 04:33 PM

I'm glad you had some luck with Safe Mode. I tried Safe Mode, Safe Mode with Networking, VGA Mode, etc... and nothing works other then the repair console.

**alcantar** · October 7th, 2003, 07:19 PM

Not ISASS but LSASS hope somebody takes this information and can finally solve this problem...

LSASS=Local Security Authority Subsystem
has something to do with RPC maybe some patch or hot fix has come up lately??

Good luck!

**demnos** · October 7th, 2003, 07:38 PM

I ended up solving the problem by running a Windows XP repair.

WinXP Repair:
1) Boot computer using Windows XP CD
2) A menu should come up asking if you want to install windows xp or enter the recovery mode. Choose Install.
3) The next menu should give you several options and one of them should be Repair (Press R). If you select Repair you shouldn't lose any of your programs or their settings. Just make sure you don't choose to install over your current XP installation, that will erase your settings. Make sure you choose the Repair option.
4) After Windows XP goes through its whole Repair process (looks a lot like a new install), you should be able to log back in to your computer. That is, if you were having the same lsass.exe error that I was.

Hope this helps someone. I did this and it worked fine and I didn't lose anything.

**McGuireV10** · October 7th, 2003, 07:43 PM

Unfortunately Repair also overwrites updated files ... and I believe it doesn't remove any of the info about which updates were applied, so now you're out of synch with Windows Update. Permanently...

It just amazes me MS still hasn't addressed this. I now personally know five people who have lost their systems to this problem.

**DARKSEID007** · October 8th, 2003, 11:37 AM

this is what i did to fix it.

i used the boot disk and installed a new windows folder hence leaving the old one but making a new dir of windows.001
after i got into the xp with the new copy i took the repair folder and copyed the sam,software,system,security,default.

i placed them into the /system32/config folder where the orginals were at.after i had messed with it for 5 hours that was how i got the orginal xp to get booted back up.no loss of files (but cant rememeber if u keep all your install programs).that is y i back all my installers up on my second hd.but hey least u keep the files.

as for the other version u have installed just go to the c drive and del the windows.001 and go to the boot.ini and remove the extra boot xp which will be the bottom one.(notice the boot to windows or boot to windows.001) just make sure u get the windows.001 removed.

change the timeout to 0 and u got it all back.

hope this will help ya'll fix some of your xp's and as for people that do know how to use recovery console it is a little different than ms-dos but use help and u can do it simply without having to install a seperate new windows.

DARK

**prskill1** · October 24th, 2003, 09:25 AM

i am on the phone with microsoft for the lsass error i will find out the answer to this hazord we have ran into// 1 hour so far on phone

my computer as well wont start

**jmvella** · October 24th, 2003, 06:59 PM

Hoping to be a little helpful:

I successfully recovered from this egregious problem. It took a few hours. Doing it, and reading all kinds of posts on many boards and tech sites, it seems clear that the Lsass.exe can be a problem for many various reasons simply because of its placement in the startup process. If it fails, and there can be various reasons, one apparently can't get past that. This is a serious problem that MS has simply failed to address. Shame on it. I could name some other ones, but won't be sidetracked here.

In my case, the problem was that directory services could not be started. The reason was that the file ntdsapi.dll was not there. Why it wasn't there is anyone's guess. Obviously it was there up to the point where it failed. Could be a disk error, a directory error, overwritten by some bad code, ...

To fix the problem, I simply copied the missing file from another XP Pro computer by putting it on a floppy disk and copying it onto the failing computer which I had booted with a Win 98 System Disk. I could have extracted it from the Win XP distribution CD, but it would have taken a little more effort.

I then rebooted to the last good configuration and was in business.

Obviously this is not a general solution for all those having problems, because some have a different missing component, bad parameter, or lack of buffer space, or whatever... But the point is, that if you can fix whatever Lsass.exe is stumbling over, that seems to be all that is required.

I did try renaming Lsass.exe to simply get it out of the picture, and that didn't work. But I'm not sure that it couldn't be made to work by substituting another executable in its place.

Now that it works, I intend to disable all the dependencies on Lsass.exe that I don't need.

**Pollo-Diablo** · October 30th, 2003, 05:28 PM

Help same error
lSASS.exe system error
indicates a revision # encountered specified is not one known by this service
It may be more receint revision than service is aware of

WTH
no new downloads except norton virus updates newest 10/25/03
msi kt266a pro 2ru Moth board
ati radeon 9000 pro 128 mb
120 gig IBM hd
256 mem

help!

**Pollo-Diablo** · November 3rd, 2003, 04:52 PM

Ok i got this same LSASS.exe error
so I go ok i have a 20 gig HD lyin around
so I scan disk it and nortonize it looking for errors
then I format it
when loading Windows xp the first time i got 3 errors
problem with cd rom
problem with "system"
probledm with 3.5 drive
hmmm
so re format try again
this time during install i get a region error in a non region place

or there abouts
(description may not be exact im at work seeing as my comp is down

What should i be formating as
IE: which partitionversion
I have a 120 gig HD trying to fix
I have a 20 gig trying to put xp on to back up to

**JohnS323** · November 6th, 2003, 12:42 PM

First off just let me say that My_Word and Frak are GODS! The solution below fixed my lsass.exe error too (the one that pertained to a “password problem”)

While this worked perfectly, I’ll add a little more detail to some of the things I had to do in my case. I’ll preface my interjections with <js>

<js> Before you can actually do what MY_Word suggests, you need to be able to bypass the winxp login script and get to a command prompt. I didn’t have any bootable floppies, so what I did was go to this website: http://www.ntfs.com/boot-disk.htm and download a utility that allowed me to create one. After I created my bootable floppy (which was in NT format, but didn’t seem to hurt anything) I booted up my PC. The utility on the floppy gave a number of different boot options. I went with “0” and then hit escape to leave whatever program it was running (some viewer thing that I wasn’t interested in). After hitting escape I got to the a:\ prompt. From there I was able to follow the instructions below.

Quote:
Anyway after fooling around for a bit i came across a folder that i had never really taken much notice of. Its:
c:\System Volume Information

<js> in order to see this file I had to type “dir *. /a” to get a directory list INCLUDING hidden directories. Since the command prompt doesn’t recognize long names, it came up as “System~1”

This is a hidden and protected folder that amazingly enough keeps what are known as system restore points for you. Basically it takes note of nearly everything you do.
In this folder there will be some wierd looking folders like:
_restore{87BD3667-3246-476B-923F-F86E30B3E7F8}

<js> again, due to short file names, you’ll see “_resto~1”

SEE NEXT POST FOR BALANCE OF INSTRUCTIONS

**JohnS323** · November 6th, 2003, 12:42 PM

CONTINUED FROM ABOVE

if you browse through these you will find other files named something like RP01 or RP35, etc...
Basically find the one with the highest number and in it will be another folder named snapshot, and in this folder are the files which you need to recover your system:
_registry_user_.default
_registry_machine_security
_registry_machine_software
_registry_machine_system
_registry_machine_sam

<js> in my case, the short file names here completely killed me! I had to go to another PC and find the same directory. Fortunately, there appeared to be some rationale in naming these files and I was able to pull together a file name conversion chart. Here are the short names you’ll see and what they need to be renamed to (or copied to a temp directory as)

_R25B6~1 = SAM
_R7E5D~1 = SECURITY
_R017D~1 = SOFTWARE
_R62E7~1 = SYSTEM
_REGIS~1.DEF = DEFAULT

copy these files to a temp directory and rename them to:
default
security
software
system
sam
now you will need to delete the offending files in c:\windows\system32\config and replace them with the new files.

<js> After doing all of this, I pulled out the floppy disk and rebooted my PC. I got back into Windows (whew!) and went to “programs, accessories, system tools, restore” and picked a date from a week or so ago (when the PC was working well) and followed the restore procedure. During the reboot process, scandisk launched. I let that go and when it was all done MY PC WAS BACK AND NORMAL! I didn’t need to do the step below, but that was just me . . .

If you get the same error go back and choose another folder (the RP01 etc) to restore from.
After doing so you will be able to boot up and use your PC again.

<js> Once again many many many thanks to My_Word for coming up with this gem! I hope this helps anyone else confronted with this horrifying situation.

**Pickle6** · November 23rd, 2003, 01:50 PM

Greetings.

Looks like that viewer program you weren't interested in on that NTFS Boot disk would have allowed you to see the long file names.

**joeserna** · December 12th, 2003, 12:08 AM

I get the same error after I installed a new RAM stick, I removed it and worked again, then I installed this RAM on another computer and then moved it back to the old one, it worked for about 2 weeks and crashed back again. I removed it and worked fine again.

Please help me.

Thanks a lot