G
Greg
For those who have gotten the lsass.exe error which reboots their
machine, or blue screen errors which tell or file corruption, or
possibly other errors which prevent Windows from booting, AND you
can't boot using SAFEMODE to do a system restore, there is another
option.
Do this at your own risk. But you really have nothing to lose since
you can't get into to XP anyway. You are already hosed. This has
worked for me on my machine and others I have repaired. But again, you
are responsible for your own actions. All risks belong to the
risktaker, which is you.
There is a way to recover, but it will take some work. Your goal is to
get the system files from a previous restore point and/or from the
\windows\repair folder. The files of concern are (1) System, (2)
Software, (3) Sam, (4) Security, and (5) Default. A good copy of the
files will need to be copied into your "\windows\system32\config"
folder, replacing the corrupted ones that are there now.
Do the following: Boot with the Windows XP install CD (don't have one?
see the last two paragraphs). Get to the point of Windows asking to do
a repair, repair console or an install. Choose the console. You'll
need the administrator password. When you get to the console (looks
like DOS), got to the windows\repair folder and copy the five files
listed above, one at a time to the \windows\system32\config folder.
You may need to delete those five files from the config folder first.
The console is picky about what it will do, but maybe I'm
inexperienced with it. Exit the console.
Turn off or disconnect all external components (modems, scanners,
printers, readers, etc.). Take out the CD and reboot your machine,
starting XP normally. Your machine is now back to the point it was
when XP was first installed. The reason for turning off external
devices is to keep XP from wasting time installing new devices. If any
internal (or external) devices attempt to install, cancel if you are
asked for drivers.
At this point, you cannot restore your computer using System Restore.
The system files you are using don't know about any restore points
except those created when XP was installed.
Open Explorer (not My Computer...Get to Explorer by right clicking
START and choose Explore). Look for the "System Volume Information"
folder on the drive where Windows is installed. If you don't see it,
then click on Tools/Folder Options, and the View tab. Check "Show
hidden files and folders". Deselect "Hide Protected Operating System
Files". If you still don't see a "System Volume Information" folder,
then you are either not on the right drive, or you had System Restore
turned off. If the latter is the case, then you are SOL, and the
system files you are now using is all you have. You'll have to
reinstall all your third party software and drivers for any devices
connected after XP was first installed. You can quit reading this
message at this point.
If you see the "System Volume Information" folder, then go to it.
You'll see one, possibly many folders named "restore{xxxxxxx}". Choose
one with a date before you encountered the error. Inside that folder
you will see one, possibly many folders named "RPxx". Go to one of
those with a date before your problems. Inside the "RPxx" folder, go
into the "snapshot" folder. There you will see your five badly needed
files, "_REGISTRY_MACHINE_SECURITY", "_REGISTRY_USER_.DEFAULT",
"_REGISTRY_USER_SAM", etc. Select these five files and copy them to a
folder that is easy to get to on your hard drive. For example, create
a folder at the root of C named "myrepair". Paste these five files
into your new folder.
Rename the five files, leaving only the short names I listed above.
For example, rename "_REGISTRY_USER_SAM" to "SAM"
Side Note: Take some time and explore all the "RPxx" and snapshot
folders in the "System Volume Information" folder. Your main goal is
to find the latest system files before your crash occured. If you
installed some new software three days ago, you may want to go a day
before you did so. Look at the file dates and times.
Restart the computer using the XP Install CD. Go to the Recovery
Console, like before. Copy the five files in the "myrepair" folder to
the "\Windows\System32\Config" folder the same way you did earlier.
Exit the console, take out the CD, and reboot the machine into XP
normally. Your system should be restored to the date that restore
point was created.
Conclusion: For the more experienced, IF your drive is formatted to
FAT32 and not NTFS, you can boot with a floppy and do this work. Most
machines which come with XP (or 2000) installed are NTFS. Also, if you
boot with a floppy, remember that you won't be able to distinguish
files in the "RPxx/snapshot" folders becuase the name will be
truncated (for example, "_REGISTRY_USER_SAM" will show up as
"_REGIS~1"). Also, for some reason, the System Recovery Console won't
let me in the restore folders. So, either way, it's a two copy
process, or at least for me it is.
If you don't have an XP install CD and you are on an NTFS format, then
you will have to do a full XP install with the Dell, Compaq, Gateway
recovery CD, or think of a way to get your hands on a copy of a full
XP install CD.
P.S. I "think" there may be Microsoft knowledge base article
explaining the process I described above, but I don't know where it is
located.
machine, or blue screen errors which tell or file corruption, or
possibly other errors which prevent Windows from booting, AND you
can't boot using SAFEMODE to do a system restore, there is another
option.
Do this at your own risk. But you really have nothing to lose since
you can't get into to XP anyway. You are already hosed. This has
worked for me on my machine and others I have repaired. But again, you
are responsible for your own actions. All risks belong to the
risktaker, which is you.
There is a way to recover, but it will take some work. Your goal is to
get the system files from a previous restore point and/or from the
\windows\repair folder. The files of concern are (1) System, (2)
Software, (3) Sam, (4) Security, and (5) Default. A good copy of the
files will need to be copied into your "\windows\system32\config"
folder, replacing the corrupted ones that are there now.
Do the following: Boot with the Windows XP install CD (don't have one?
see the last two paragraphs). Get to the point of Windows asking to do
a repair, repair console or an install. Choose the console. You'll
need the administrator password. When you get to the console (looks
like DOS), got to the windows\repair folder and copy the five files
listed above, one at a time to the \windows\system32\config folder.
You may need to delete those five files from the config folder first.
The console is picky about what it will do, but maybe I'm
inexperienced with it. Exit the console.
Turn off or disconnect all external components (modems, scanners,
printers, readers, etc.). Take out the CD and reboot your machine,
starting XP normally. Your machine is now back to the point it was
when XP was first installed. The reason for turning off external
devices is to keep XP from wasting time installing new devices. If any
internal (or external) devices attempt to install, cancel if you are
asked for drivers.
At this point, you cannot restore your computer using System Restore.
The system files you are using don't know about any restore points
except those created when XP was installed.
Open Explorer (not My Computer...Get to Explorer by right clicking
START and choose Explore). Look for the "System Volume Information"
folder on the drive where Windows is installed. If you don't see it,
then click on Tools/Folder Options, and the View tab. Check "Show
hidden files and folders". Deselect "Hide Protected Operating System
Files". If you still don't see a "System Volume Information" folder,
then you are either not on the right drive, or you had System Restore
turned off. If the latter is the case, then you are SOL, and the
system files you are now using is all you have. You'll have to
reinstall all your third party software and drivers for any devices
connected after XP was first installed. You can quit reading this
message at this point.
If you see the "System Volume Information" folder, then go to it.
You'll see one, possibly many folders named "restore{xxxxxxx}". Choose
one with a date before you encountered the error. Inside that folder
you will see one, possibly many folders named "RPxx". Go to one of
those with a date before your problems. Inside the "RPxx" folder, go
into the "snapshot" folder. There you will see your five badly needed
files, "_REGISTRY_MACHINE_SECURITY", "_REGISTRY_USER_.DEFAULT",
"_REGISTRY_USER_SAM", etc. Select these five files and copy them to a
folder that is easy to get to on your hard drive. For example, create
a folder at the root of C named "myrepair". Paste these five files
into your new folder.
Rename the five files, leaving only the short names I listed above.
For example, rename "_REGISTRY_USER_SAM" to "SAM"
Side Note: Take some time and explore all the "RPxx" and snapshot
folders in the "System Volume Information" folder. Your main goal is
to find the latest system files before your crash occured. If you
installed some new software three days ago, you may want to go a day
before you did so. Look at the file dates and times.
Restart the computer using the XP Install CD. Go to the Recovery
Console, like before. Copy the five files in the "myrepair" folder to
the "\Windows\System32\Config" folder the same way you did earlier.
Exit the console, take out the CD, and reboot the machine into XP
normally. Your system should be restored to the date that restore
point was created.
Conclusion: For the more experienced, IF your drive is formatted to
FAT32 and not NTFS, you can boot with a floppy and do this work. Most
machines which come with XP (or 2000) installed are NTFS. Also, if you
boot with a floppy, remember that you won't be able to distinguish
files in the "RPxx/snapshot" folders becuase the name will be
truncated (for example, "_REGISTRY_USER_SAM" will show up as
"_REGIS~1"). Also, for some reason, the System Recovery Console won't
let me in the restore folders. So, either way, it's a two copy
process, or at least for me it is.
If you don't have an XP install CD and you are on an NTFS format, then
you will have to do a full XP install with the Dell, Compaq, Gateway
recovery CD, or think of a way to get your hands on a copy of a full
XP install CD.
P.S. I "think" there may be Microsoft knowledge base article
explaining the process I described above, but I don't know where it is
located.