I had the same isass.exe problem; it started with windows blue screen, and then escalated to the error message. I needed to fix my computer, and while researching the problem I ended up here. Earlier in the thread, I saw a link for a site that someone (I forgot who) said would fix the problem. The link didn't work, so I searched the internet for the article "Windows xp crashed? Here’s help" he was talking about and I found it, at this site:
http://www.digitalwebcast.com/articles/viewarticle.jsp?id=8658
It looked very complicated, but in fact it was a simple way of fixing the problem that took about 2 to 3 hours. I didn't even have to reinstall windows xp or anything. I'm no computer expert, but I can say I can do know a lot about how to navigate, I can pretty much do anything that doesn't involve messing with computer code or hacking or anything like that (then again I am a teen-ager and its in my blood to know how to use computers), but all you need to have to use this method of fixing the computer is an xp cd. Essentially, what you do is delete the start-up files containing the worm, and replace them with backup files stored on your computer. Then you copy the restore point files of whatever time you want to some other file that allows you to access all of your old files. You don’t have to delete any important files like pictures, essays, etc. The reason you need the windows cd is because you can’t access your computer, with the cd, you can run repair and manually delete and replace the files. It did get a little confusing, but luckily I had another xp computer (my parents) because one of the files that I was supposed to copy didn’t have the same name as the one in the article, so I looked it up on the other computer and everything was fine. Thanks for all the help; I wouldn’t have been able to fix my computer without all you guys.

i had the lsass object not found error
i downloade the ""ubcd4win"" bootable cd image creator
it booted beautifuly 2 win xp
using a registry utility on the disk i quickly solved the problem
i strongly recomend this cd, image maker is free and includes many utes

search for ubcd4win you will find it

Could you tell me please what did you fix in registry to resolve this problem?

First of all, many thanks to everyone for the invaluable info here. I've read all the posts on the lsass.exe issue, and feel much more confident that I can fix my daughter's notebook armed with the info I've found here.

This week she was running a Norton update, and it resulted in the lsass error! Her computer goes round and round in an endless loop, with no way to get past the error message, similar to what others here have experienced. I feel bad because I had stressed to her how important it is to do regular Microsoft and virus updates. Oh well, Norton is junk, and if we ever get this fixed I'll remove it completely and replace with something not so, well, useless

Fortunately, I made a copy of her Documents and Settings to an external hard drive a few weeks ago when I was doing some cleanup, so we have all her necessary files. I'd like to use the recovery discs that came with the computer and restore to factory settings. But my question is, do you just pop in the recovery discs? Do they go in any certain order? Do they start automatically, and are there any responses needed? I'd like to get these answers now, because the computer is totally unusable at this point. Once I start the process I won't have access to any online help.

Thanks again to everyone for all the help, support and great tips you've shared here. I'll let you know how it goes.

Is it just a Windows CD or is it a Windows cd and 6 floppy disks? If they are floppy disks, insert disk 1 during boot up. If the floppy drive is set as the first device to boot, POST will detect it and you will go from there. Then it will ask you for disk 2, 3, etc. During this process, just keep the Windows CD in the drive so setup can read the cd when needed. Then just follow the instructions from there.

If its just a Windows CD, insert the CD into the drive and when it asks you to press a key to boot from cd, press any key on the keyboard. If it does not, reboot the computer and look to see if there is a button to press to access a boot option. If so, select that button and then choose the cd drive in which the Windows CD is located. Then just follow the steps it provides you with.

You are right in telling your daughter that keeping Windows updated and her anti-virus is a good thing. So dont let this experience drive you away form that thought. Norton is a resource hog and is junk. I recommend AVG Free. It updates daily, uses less resources, and is a lot better than Norton. You can find the download here: http://free.grisoft.com/softw/70free/setup/avg75free_428a818.exe

I also recommed getting a software firewall for her computer if she does not have one already. You can find it here and is completely free: http://www.zonelabs.com/store/content/company/products/znalm/f...mp;lang=en

I also recommend putting an anti-spyware app on her computer. Keep this updated daily as well. http://free.grisoft.com/softw/70free/setup/avgas-setup-7.5.0.50.exe

Good luck. If you need more help, post back and we will try and help. But make a seperate thread that is dedicated to the problem you are having.

*If you do not have a way to post back due to the computer you are working on being down and you have no other computer in a house, if you can, use a friends computer or even the local library.*

EDIT: Here is a guide that can walk you through the (what Im assuming is) XP install. http://www.petri.co.il/install_windows_xp_pro.htm

Thanks for the tips! If I can get her operating system back up and running, I'll set things up the way they should be. I'm headed over there after work today. She has 5 or 6 CD's that came with the laptop - one is the operating system (thank goodness) and the others are something else....not sure until I see them. I just hope this process doesn't get too messy. I'm so glad we saved the Files & Settings when we did.

Thanks again. I'll post results as soon I have them

Pam

Hi all, I see I am not alone in this computer virus/problem! I have been reading the posts people have offered and just have a few questions. I am posting from a laptop.

I am running Microsoft Windows XP Home Edition, and before this morning the computer was running perfect. I have anti spyware, AGV, virus protection and have not had a problem with the computer since purchase.

For each person, there seems to be different variations on the problem. Mine is:
"Isass.exe - Unable to Locate Component"
"This application failed to start because DNSAPI.dll was not found. Re-installing the application might fix this problem"

The computer then simply waits there, with my only option to press OK, where it just waits on a black screen.

I have tried running it in safe mode with command prompt, under someone's (Martin's?) advice, yet it did not make a difference. I do not really want to lose the data on my computer, and furthermore, I have just moved internationally, I need to look in boxes for the windows recovery disks!

Im not a programmer but I can play around with computers, If necessary, should I install a formatted hard drive from another computer and set it as the master? But still the problem is I cannot access any data on the broken computer, so WHAT DO I DO!>!?!?!? AH! waaaaaaa. I wanna be a virus protection software.

If you can, please help. lol

I was able to determine that this error can happen just by making certain hardware setting changes. I found a way that does restore the system that was mentioned here on another page. The directions were awful so I will rewrite them so anybody could do this. It took me about an hour the first time but my system is perfectly restored. I did not lose anyhting! This is much better than a rebuild or a bad fix. My main point is many of you may have a virus but I had this error and it looked like the virus but wasn't. I even reproduced it on purpose just to see and the error returned. Feel free to contact me if you need to. Later!

I got the "lsass.exe - System Error" box after a reboot. In the error box it said "Object Name not found" and only offered a "OK" button. When I clicked OK the PC reboots and this thing starts doing the same thing over and over.

This particular computer is in my garage (old hobby computer that I built myself), and connects to the Internet wirelessly. It is a ABIT KT7A motherboard version 1.0 with Windows XP Pro SP2. It has a AMD 950mhz Thunderbird processor in it with 384mb of Crucial PC1333 CAS2 SDRAM.

I mention all of this for a few reasons: 1. This PC is behind a firewall and was patched all the way up with the most recent updates including Microsoft patches, Anti-Virus software, Spy-ware detection and removal tools and everything that a responsible PC user should have to enjoy safe Internet surfing. 2. Many people think this issue is from a virus and that may be true but not in my case.

This error happened to me after I had made a few changes in my BIOS in order to speed up my computer to run as a 1,000mhz machine instead of the 950mhz that it defaults to with this processor. The practice of making a processor run faster than it is actually designed for is called overclocking and I have been very successful doing it for many years. I am a computer professional with an abundance of experience.

Now that I have said all of that, I'd like to offer many of you help. Note that I too had already tried to boot into safe mode and/or use the last known good configuration and many other things that were listed here. None of them worked. Actually, one did! Read on. I have read the Internet up and down about this error and finally found something that sounded like it might work. Note also that some of you may very well have the virus mentioned by so many people here. I found that there appear to be many variations of how this happened to each of us and based on how people said to identify the virus, I determined their efforts were flawed and untrue. My PC did not have a virus and I knew it.

Like I said above, I read something that sounded like it might work so I gave it a shot. I struggled at first to follow the directions because they were very poorly written. Luckily, I knew what they were trying to say and made workarounds to the problems I encountered and I was able to complete the task and fully restore my computer as if the issue never happened.

My intention now is to re-write them properly and post them here. I have to say that the fix will take about 20-45 minutes depending on how fast you can follow directions and type. I think the neat thing about this fix is that it should work on all versions of Windows XP and for all sorts of issues people may run into where fixing their PC in 20-45 minutes sounds better than losing all data (including email and pictures etc. etc.), reformatting, reinstalling a new operating system and then completely rebuilding their computer again.

A special note before you get too excited: You must know the "Administrator" password to your computer or you won't be able to use this fix. Also, so you'll know, once I fixed my PC I again tested for viruses and I had none. I then re-overclocked my PC again on purpose and caused the error again to make sure it was strictly hardware related. No problem now since I am sure what I have to do in order to resolve the issue. Let me know if there is interest in me writing up the fix which I plan to post anyway.

OK! It took forever to write and test but I think it's good to go now. Here it is:

Hey all! I ran into some trouble while overclocking my PC. I came across a fix that I'm sure will help someone here someday so I'm posting it. I hope if it saves you like it saved me and that you will mention it here. This works a whole lot better than having to do a full reinstall and takes less than a quarter of the time. Here is a huge document I made that pretty much says it all but I want to be clear. This is a last ditch effort to recover a system that boots but won't even let you log in before it makes you reboot or just simply crashes. The actual time it takes to do this should be between 45 minutes and a hour and a half which is still way better than losing data and having to reinstall everything from scratch. Here it is:

Before you read anymore PRINT THIS NOW. To use these instructions you must have the following at your fingertips or you will fail:

1. A Windows XP CD that matches the version on your computer meaning if you run XP Pro, then have an XP Pro CD on hand. If it is XP Home then have an XP Home CD on hand. I don’t think it matters if you have upgraded to SP2 since you initially installed your CD that may have been a pre SP1 version or even an SP1 version. Just make sure that Pro is for Pro and Home is for Home.

2. You MUST know the “Administrator” password for your computer. Normally you either know it by heart or it is blank meaning no administrator password was set or it is simply the word administrator. Here is a link that can help you to determine what it is though I’m just adding this link and have never used it before so I don’t even know if the link is still valid. Here is the link which I have no association to other than showing you where it is:

http://www.petri.co.il/forgot_admini...r_password.htm

3. Make sure your computer is set to boot from the CD-ROM first and then from the hard drive.

4. (Optional) If you have a friend that you know is pretty good with computers please let them do this instead of you. Make sure to tell them that you won’t hold them accountable if it fails and completely crashes and becomes unrecoverable data but hey, what choice do you have at this point?

Here is just a little history of why I made this document:
I made some hardware changes to my computer and after a standard reboot to save changes the computer restarted but between the screens were it normally says starting Windows XP and the next screen which would normally have been the user login screen, a small box appeared. The box itself was titled “lsass.exe – System Error” and in the box itself it said “Object not found” and just beneath that line in the same box there was a button that simply said “OK”. My only option was the button so I clicked it and my PC rebooted again and did the exact same thing over and over and over etc. etc.

I looked up this error on the Internet and found several different reasons as to why it might occur. The most common was from a virus but I knew that I had already had protection from this virus long before it ever seemed to show up on my machine. I kept reading about the several different ways that this happened to others and the multitude of solutions that were offered though often under each solution the next post would be about how someone tried the solution and it failed.

One of the solutions caught my eye though. The problem that was described sounded exactly like my error and they (the author), said they were able to restore their system fully. I reviewed the process and unlike all of the other solutions, it didn’t seem too complex nor was it more cumbersome that actually reinstalling the entire operating system and trying to restore all of my additional programs so I printed out the directions and sat down ready to go to war against my computer in order to make it work again!!!

There were numerous errors in the directions from beginning to end but because I have lots of experience in the computer field I was able to tell what they meant to say and I worked around the faulty directions and completed the task which did in fact restore my PC to a restore point just 1 day prior to when I made some change that apparently broke my computer’s
operating system. I found the original document that was written by a guy named “Charlie White” to be very helpful and felt it should be shared with others since it helped me and could (hopefully), help resolve so many other computer user’s problems if they were at their last straw.

If you have a PC running Windows XP that can at least start up before it errors to the point of not being useable, then this may be of great use to you. Windows XP by default takes a snap-shot of itself each day. That snapshot is called a restore point and usually Windows XP keeps about the last 30 days worth of restore points saved on the hard drive. The concept is
that in the event that you add a program or make some sort of a change that messes up your computer so badly that you simply can’t work with it under those conditions that if the PC still functions enough to start up, you can go to a point sometime in the last 30 days when your PC still functioned properly and select for the PC to load that snapshot over it’s current bad configuration thus making your PC run as if you never made the mistake that may have caused your PC to mess up in the first place. Yes, just like going back in time to when your computer was still working well! This does work pretty well normally but for me the computer wasn’t even able to get to the login screen so selecting a restore point wasn’t an option.

I had also already tried to start up in “Safe Mode” which gave me the same error and I tried to start up using the “Last known good configuration”. It failed as well giving me the same error. At that point, I had already exhausted every other little trick I knew to get into my computer so I thought why not give one of the resolutions I read about a try. I had nothing to lose since at this point a full system rebuild seemed like the only fix. The method I describe is the only one I found where it worked and it didn’t install XP over itself again making duplicate files and all of that stuff that takes forever to straighten out.

This process simply does this: It allows you to manually start up your computer with a restore point already installed as if you were able to do this the normal way in the first place. You can’t restore your PC to a previous restore point without getting into Windows XP first or at least you can’t unless you follow these directions! Just in case you don’t trust me, here is a link to the original document that I modeled my instructions from:

http://www.digitalwebcast.com/articl...le.jsp?id=8658 . If you choose to trust me, it’s time to get your PC
running. Something to consider here is this: If you just installed a new piece of hardware in your computer, you might remove it and or put back what you replaced and then try to reboot one more time before trying this. If there was no new hardware installed that may have caused this problem then get ready to start here! Be ready because this should take about 45 minutes which is still way shorter than completely reinstalling XP and all of your programs not to mention doing it like this won’t make you lose anything you had before on this computer!

Note that this procedure assumes that Windows XP is installed to the C:\Windows folder. If you installed Windows to a different location, make sure to change C:\Windows in the following directions to the appropriate windows folder if it's at a different location. Copy commands will show you they completed successfully by showing you a message saying "file copied".
The delete commands just move on to the next line but won’t say that they happened or not. Just assume they did provided you type each command I give you exactly as I have them listed. I've separated each command by an empty line. Type the whole command in one line and when you've finished typing that command hit the Enter key.

Start Here!

Get the Windows XP CD you used to install your operating system. Put the XP CD in your CD drive and restart the computer once you have confirmed it will boot from the CD-ROM first and then from the hard drive. When it says "press any key to boot from CD," press any key. At first it will look like you are reinstalling but you aren’t at all. XP is simply loading enough files for it to be able to function since the original files are still corrupt that are on the hard drive. Wait during this process. Don’t select anything until it stops loading files and a screen will come up asking you if you want to Setup Windows or Repair Windows XP. Press R to Repair which will launch the Recovery Console which looks like this:

_________________________________________________________________
Microsoft Windows XP<TM> Recovery Console

The Recovery Console provides system repair and recovery functionality.
Type EXIT to quit the Recovery Console and restart the computer.

1: C:\WINDOWS

Which Windows Installation would you like to log onto
(To cancel, press ENTER)?

_________________________________________________________________

(Make sure your Num Lock is on if you use the number key pad on the right of your keyboard) Select the number which corresponds to the operating system location you were using which broke and then hit enter, (Usually this is the number 1). Now it asks you for your administrator password. Enter your administrator password, and then hit enter. If you entered the correct password then you will get a C:\Windows prompt on the screen. That means you’re in! By the way, if you don't know your administrator password, just try hitting the Enter key. If that doesn't work either then go to the following site and get the necessary tools to get you in:

http://www.petri.co.il/forgot_admini...r_password.htm

(In my case, even though I knew and entered my administrator password it still said it was wrong because the file that kept that information was now corrupt. I used my own program that allowed me to reset my admin password then I continued)

In this step, we are going make a new directory on your hard drive and store some files there as back-ups in case this process doesn’t work for you. That way you’ll still have all of the original files and can at least restore your computer to its exact current BROKEN status as if you never tried this!
On your monitor you should be looking at a prompt that looks like this:
c:\windows>
Add md tmp to the prompt to make it look exactly like this and then hit enter: (Remember to hit enter at the end of each command line below)
c:\windows>md tmp
cd c:\windows\system32\config (now your prompt on the screen should look like this: c:\windows\system32\config>

copy default c:\windows\tmp\default

copy sam c:\windows\tmp\sam

copy security c:\windows\tmp\security

copy software c:\windows\tmp\software

copy system c:\windows\tmp\system

ren default default.her

ren sam sam.her

ren security security.her

ren software software.her

ren system system.her

OK! So far you have copied the last original (broken) copies of the startup files to a back up location and you then renamed
the originals to have new names so Windows won’t touch them anymore. Now we want to go and get a fresh set of original start up files from a place on your hard drive that they were put when XP was originally installed. They were put here for exactly what you are doing now. Here we go…

cd ..\ ( Note that this is typed out as cd space dot dot backslash )

cd ..\ ( Note that this is typed out as cd space dot dot backslash again )


So now your prompt should look like this: C:\windows>


cd c:\windows\repair (Now your prompt should look like this: c:\windows\repair )

copy c:\windows\repair\system c:\windows\system32\config\system

copy c:\windows\repair\system\software c:\windows\system32\config\software

copy c:\windows\repair\system\sam c:\windows\system32\config\sam

copy c:\windows\repair\system\security c:\windows\system32\config\security

copy c:\windows\repair\system\default c:\windows\system32\config\default

exit ( Yes, type in the word exit )

The computer should reboot now and yes it will ask again for you to press any key to boot from the CD. Don’t press anything yet. Let the PC start up normally but understand that we aren’t done yet which is why it will look very strange. Just keep following the directions. You are getting very close to seeing your PC work again like it did before it broke. Wait for a while and give the computer some time to start up all of the way. Usually a couple of minutes are good to let it boot up.

Now we are going to copy the saved repair files you copied earlier into the right spot so the computer will use them properly. We will be using the actual System Restore from within windows now that you are in. The Restore folder is usually made to be very hard to find but I’ll tell you how to find it now. Note that at this point I was forced to use a program I had again that allowed me to reset my administrator password because no matter what I put in, it said it was wrong. If a bubble pops up talking about your video settings being awful say OK to let it auto configure your video settings. Say yes again to confirm the settings work and are OK to keep.

Right click on the start button in the task bar and then when the menu of options appears select Explore. Now, click on tools in the file menu then folder options and then select the view tab.

Under Hidden files and folders, select “Show hidden files and folders”.
Now scroll down some and put a check in the box that says “Show contents of system folders”. Click to clear the "Hide protected operating system files (Recommended)" check box. (Take the check out of the box)

Click “Yes” when the box pops up asking you to confirm that you want to display these files. Click Apply and then click OK.

Double-click the drive where you installed Windows XP to view the list of the folders inside of it.

Locate the “System Volume Information folder. This folder appears faded because it is normally set as a hidden folder.

Double click the “System Volume Information” folder. If the folder opens for you, skip down to the paragraph that starts with “The System Volume Information” folder is now opened. If you got an error saying access is denied, do the following:

Right click on the “System Volume Information” folder and select the Sharing and Security option. Then click the Security tab if there is one. (If there is no security tab available to select then skip down to the paragraph that starts with “But what if no security tab is available to select?” If you do see a security tab then click Add, and then in the box that says "Enter the object names to select," type the name of the user that's at the top of the Start menu which is probably you. Make sure you type the name the way it's listed on the Start Menu. I made the mistake of typing my first name only and it wouldn't let me in. Type first and last name if that's how it's written on the top of the Start menu. After you've typed that in, click OK until you are back to looking at the folder that wouldn’t let you in and double click it again to open it.

You should be in it now. If not then you didn’t type the name exactly as it is listed on top of the start menu. It has to be the same for the folder to open for you.

“But what if no security tab is available to select?” Do this: Click to put checks in BOTH checkboxes in the "Network sharing and security" area. One of them is labeled "Share this folder on the network" and the other is labeled "Allow network users to change my files." Change the share name from “System Volume Information to something short, like SysVolInf as in only the first three letters of the words “System and Volume and Information. Click Apply and you will get an error possibly. If you get the error then just do it again and it will let you in the second time. Put a star next to this section on your print out because you’ll want to come back after you are restored and make sure to put this back to the way it was if the restore doesn’t do it for you. Just double check this when you’re running again is all I’m saying. Double click the folder now to get in it.

“The System Volume Information folder is now opened.” This folder may contain one or more folders with names like this”

_restore{F4EB0E83-91FF-4B7D-ABC2-287358719EAE}”

Right click on each of them and note the date they were created. You DON’T want the one created with today’s date and time.

Open the one that doesn’t have today’s date and time but is closest to the latest date before the problems happened. Inside are several folders with names like RP37, RP38, and RP39 etc. These are each a separate restore point. Go up to the file menu and select view. When the drop down menu opens select “Details”. Now you can see the dates of when each of these was created listed next to them. Double click on the one that has the date
that was one day before you started having trouble with your computer. So as an example if your computer died last Saturday on June 18 of 2006 then you would most likely want to open the folder that was created on Friday, June 17, 2006 which as you see was the day before the computer broke.

Now that you have opened the RP******* folder: Find and open the “Snapshot” folder. Select view from the file menu again and select details from the drop down menu so you can read the file names more easily. Copy the following files from this “Snapshot” folder to the C:Windows\Tmp folder using the copy/paste process or however you know how to do this to get them copied from here to there. Here is the list of files to copy:

_registry_user_.default
_registry_machine_sam
_registry_machine_security
_registry_machine_software
_registry_machine_system

You are getting very close to being done so hang in there! Make sure your Windows XP CD is still in the drive and restart

Windows making sure to hit any key this time when it tells you to do that to boot from the CD. Once it finishes with that long start up process again you’ll have those same options again like before. Press R to select Repair using the Recovery Console. Again, make sure your num lock is on if you use the number keypad on the right of your keyboard and then select the number that best describes the location of where you installed Windows XP to. Enter your admin password when prompted to do so. Now, you are again looking at a c:\windows> prompt.

Type in cd c:\windows\system32\config and hit enter so that your prompt should now look like c:\windows\system32\config>

From within Recovery Console, type the following commands:
del default
del sam
del security
del software
del system

cd ..\
cd ..\
cd tmp ( now your prompt should look like this: c:\windows\tmp> )

copy _registry_user_.default c:\windows\system32\config\default (Notice the period (".") before the word default in the first parameter)

copy _registry_machine_sam c:\windows\system32\config\sam
copy _registry_machine_security c:\windows\system32\config\security
copy _registry_machine_software c:\windows\system32\config\software
copy _registry_machine_system c:\windows\system32\config\system

If you can, remove the Windows XP CD from the CD-ROM now.

Type exit and your computer will reboot into whichever restore point you chose. Now you're done except that you may want to reset your current time and go back up to where I told you to mark that spot where you will make sure that the sharing isn’t still turned on for the System Volume Information folder. I hope this saved your butt. Always help others when you get a chance. If this helped and you are really-really grateful, please tell us about it on the forum at http://www.Hermskii.com and if you find an error in this please let me know.

Thank you,

Hermskii

Snowy Winter said:

If you have system restore turned on the fix is fairly simple.

Boot from a utility such as UltimateBootCd which can be downloaded from the site of same name.

On that CD after booting into X there is a registry restore tool. Restore your registry to when it worked last.

Thanks for that explanation, it really helped me.

I had the same lsass.exe problem on a Compaq Notebook two days ago. I followed the instructions in that article (there are some errors where he gives the wrong path for some of the repair files, adding "system" into the path where it shouldn't be there) and it worked well.

I had the problem when I booted from the floppy disks (thank you Microsoft for providing these for free) that it asked for my administrator password, but it wouldn't actually take it. I used one of the Unix based password crackers, but now I don't remember which one. One had an option for disabling the password request for recovery boot, and I did that and when I rebooted again from the floppies it didn't ask for a password, it went right to the C: prompt.

I didn't try it, but I think that another way of recovery would be to put the affected drive on another system as a secondary drive and copy the repair files into the c:\windows\system32\config folder, or even copy the snapshot files directly into the c:\windows\system32\config folder and bypass the repair file step entirely (the repair files let you boot a non-booting system, but if you can get the drive onto another system it may be easier). Of course you have to have another PC running an OS that can read NTFS drives, and a way to hook it up. I have a USB hard drive case for notebook drives, so this would work for me.

I ordered the recovery CD from HP, as the floppies were a pain. Thank g-d I had a USB floppy drive around. I had to scrounge up some old floppies as I got rid of most of my floppies ages ago.

I also had the original 60GB notebook drive which I had replaced with a 100GB drive a few months earlier. I may buy a second 100GB drive and do weekly drive cloning over USB to a backup drive.

I'd love to know what caused the problem in the first place!

Did you try my solution?

Right, those were the Charlie White instructions, though what you posted still has some of the errors from the original. Specifically, the path for ther repair files is incorrect, there is no "system" in the path.

It should read:

cd c:\windows\repair (Now your prompt should look like this: c:\windows\repair )
copy c:\windows\repair\system c:\windows\system32\config\system
copy c:\windows\repair\software c:\windows\system32\config\software
copy c:\windows\repair\sam c:\windows\system32\config\sam
copy c:\windows\repair\security c:\windows\system32\config\security
copy c:\windows\repair\default c:\windows\system32\config\default

Thanks! I will edit that. I'm glad it helped. Later!

You were right and thank you for identifying that. Iwant this to work as smoothly as possible for anyone who uses it. I also noticed that in the direction set at the point you found the error that I had told the user to change the directory to be in the one copying files from so that means they wouldn't have to type out the whole line as Ihad it so I've edited it again to reflect the following. Iwill post the entire corrected document again after this post. Here was the section I made your corrections too and then added my easier lines:

So now your prompt should look like this: C:\windows>


cd c:\windows\repair (Now your prompt should look like this: c:\windows\repair )

copy system c:\windows\system32\config\system

copy software c:\windows\system32\config\software

copy sam c:\windows\system32\config\sam

copy security c:\windows\system32\config\security

copy default c:\windows\system32\config\default

exit (Yes, type the word exit and hit enter)

Before you read anymore PRINT THIS NOW. To use these instructions you must have the following at your fingertips or you will fail:

1. A Windows XP CD that matches the version on your computer meaning if you run XP Pro, then have an XP Pro CD on hand. If it is XP Home then have an XP Home CD on hand. I don’t think it matters if you have upgraded to SP2 since you initially installed your CD that may have been a pre SP1 version or even an SP1 version. Just make sure that Pro is for Pro and Home is for Home.
2. You MUST know the “Administrator” password for your computer. Normally you either know it by heart or it is blank meaning no administrator password was set or it is simply the word administrator. Here is a link that can help you to determine what it is though I’m just adding this link and have never used it before so I don’t even know if the link is still valid. Here is the link which I have no association to other than showing you where it is: http://www.petri.co.il/forgot_administrator_password.htm
3. Make sure your computer is set to boot from the CD-ROM first and then from the hard drive.
4. (Optional) If you have a friend that you know is pretty good with computers please let them do this instead of you. Make sure to tell them that you won’t hold them accountable if it fails and completely crashes and becomes unrecoverable data but hey, what choice do you have at this point?

Here is just a little history of why I made this document:
I made some hardware changes to my computer and after a standard reboot to save changes the computer restarted but between the screens were it normally says starting Windows XP and the next screen which would normally have been the user login screen, a small box appeared. The box itself was titled “lsass.exe – System Error” and in the box itself it said “Object not found” and just beneath that line in the same box there was a button that simply said “OK”. My only option was the button so I clicked it and my PC rebooted again and did the exact same thing over and over and over etc. etc.

I looked up this error on the Internet and found several different reasons as to why it might occur. The most common was from a virus but I knew that I had already had protection from this virus long before it ever seemed to show up on my machine. I kept reading about the several different ways that this happened to others and the multitude of solutions that were offered though often under each solution the next post would be about how someone tried the solution and it failed.

One of the solutions caught my eye though. The problem that was described sounded exactly like my error and they (the author), said they were able to restore their system fully. I reviewed the process and unlike all of the other solutions, it didn’t seem too complex nor was it more cumbersome that actually reinstalling the entire operating system and trying to restore all of my additional programs so I printed out the directions and sat down ready to go to war against my computer in order to make it work again!!!

There were numerous errors in the directions from beginning to end but because I have lots of experience in the computer field I was able to tell what they meant to say and I worked around the faulty directions and completed the task which did in fact restore my PC to a restore point just 1 day prior to when I made some change that apparently broke my computer’s operating system. I found the original document that was written by a guy named “Charlie White” to be very helpful and felt it should be shared with others since it helped me and could (hopefully), help resolve so many other computer user’s problems if they were at their last straw.

If you have a PC running Windows XP that can at least start up before it errors to the point of not being useable, then this may be of great use to you. Windows XP by default takes a snap-shot of itself each day. That snapshot is called a restore point and usually Windows XP keeps about the last 30 days worth of restore points saved on the hard drive. The concept is that in the event that you add a program or make some sort of a change that messes up your computer so badly that you simply can’t work with it under those conditions that if the PC still functions enough to start up, you can go to a point sometime in the last 30 days when your PC still functioned properly and select for the PC to load that snapshot over it’s current bad configuration thus making your PC run as if you never made the mistake that may have caused your PC to mess up in the first place. Yes, just like going back in time to when your computer was still working well! This does work pretty well normally but for me the computer wasn’t even able to get to the login screen so selecting a restore point wasn’t an option.

I had also already tried to start up in “Safe Mode” which gave me the same error and I tried to start up using the “Last known good configuration”. It failed as well giving me the same error. At that point, I had already exhausted every other little trick I knew to get into my computer so I thought why not give one of the resolutions I read about a try. I had nothing to lose since at this point a full system rebuild seemed like the only fix. The method I describe is the only one I found where it worked and it didn’t install XP over itself again making duplicate files and all of that stuff that takes forever to straighten out.

This process simply does this: It allows you to manually start up your computer with a restore point already installed as if you were able to do this the normal way in the first place. You can’t restore your PC to a previous restore point without getting into Windows XP first or at least you can’t unless you follow these directions! Just in case you don’t trust me, here is a link to the original document that I modeled my instructions from: http://www.digitalwebcast.com/articles/viewarticle.jsp?id=8658 . If you choose to trust me, it’s time to get your PC running. Something to consider here is this: If you just installed a new piece of hardware in your computer, you might remove it and or put back what you replaced and then try to reboot one more time before trying this. If there was no new hardware installed that may have caused this problem then get ready to start here! Be ready because this should take about 45 minutes which is still way shorter than completely reinstalling XP and all of your programs not to mention doing it like this won’t make you lose anything you had before on this computer!

Note that this procedure assumes that Windows XP is installed to the C:\Windows folder. If you installed Windows to a different location, make sure to change C:\Windows in the following directions to the appropriate windows folder if it's at a different location. Copy commands will show you they completed successfully by showing you a message saying "file copied". The delete commands just move on to the next line but won’t say that they happened or not. Just assume they did provided you type each command I give you exactly as I have them listed. I've separated each command by an empty line. Type the whole command in one line and when you've finished typing that command hit the Enter key.

Start Here!

Get the Windows XP CD you used to install your operating system.
Put the XP CD in your CD drive and restart the computer once you have confirmed it will boot from the CD-ROM first and then from the hard drive.

When it says "press any key to boot from CD," press any key.
At first it will look like you are reinstalling but you aren’t at all. XP is simply loading enough files for it to be able to function since the original files are still corrupt that are on the hard drive. Wait during this process. Don’t select anything until it stops loading files and a screen will come up asking you if you want to Setup Windows or Repair Windows XP.
Press R to Repair which will launch the Recovery Console which looks like this:

Microsoft Windows XP<TM> Recovery Console

The Recovery Console provides system repair and recovery functionality.
Type EXIT to quit the Recovery Console and restart the computer.

1: C:\WINDOWS

Which Windows Installation would you like to log onto
(To cancel, press ENTER)?

(Make sure your Num Lock is on if you use the number key pad on the right of your keyboard) Select the number which corresponds to the operating system location you were using which broke and then hit enter, (Usually this is the number 1).
Now it asks you for your administrator password. Enter your administrator password, and then hit enter.
If you entered the correct password then you will get a C:\Windows prompt on the screen. That means you’re in! By the way, if you don't know your administrator password, just try hitting the Enter key. If that doesn't work either then go to the following site and get the necessary tools to get you in:
http://www.petri.co.il/forgot_administrator_password.htm. (In my case, even though I knew and entered my administrator password it still said it was wrong because the file that kept that information was now corrupt. I used my own program that allowed me to reset my admin password then I continued)

In this step, we are going make a new directory on your hard drive and store some files there as back-ups in case this process doesn’t work for you. That way you’ll still have all of the original files and can at least restore your computer to its exact current BROKEN status as if you never tried this!
On your monitor you should be looking at a prompt that looks like this:
c:\windows>
Add md tmp to the prompt to make it look exactly like this and then hit enter: (Remember to hit enter at the end of each command line below)
c:\windows>md tmp
cd c:\windows\system32\config (now your prompt on the screen should look like this: c:\windows\system32\config>

copy default c:\windows\tmp\default

copy sam c:\windows\tmp\sam

copy security c:\windows\tmp\security

copy software c:\windows\tmp\software

copy system c:\windows\tmp\system

ren default default.her

ren sam sam.her

ren security security.her

ren software software.her

ren system system.her

OK! So far you have copied the last original (broken) copies of the startup files to a back up location and you then renamed the originals to have new names so Windows won’t touch them anymore. Now we want to go and get a fresh set of original start up files from a place on your hard drive that they were put when XP was originally installed. They were put here for exactly what you are doing now. Here we go…

cd ..\ ( Note that this is typed out as cd space dot dot backslash )

cd ..\ ( Note that this is typed out as cd space dot dot backslash again )


So now your prompt should look like this: C:\windows>


cd c:\windows\repair (Now your prompt should look like this: c:\windows\repair )

copy system c:\windows\system32\config\system

copy software c:\windows\system32\config\software

copy sam c:\windows\system32\config\sam

copy security c:\windows\system32\config\security

copy default c:\windows\system32\config\default

exit (Yes, type the word exit and hit enter)

The computer should reboot now and yes it will ask again for you to press any key to boot from the CD. Don’t press anything yet. Let the PC start up normally but understand that we aren’t done yet which is why it will look very strange. Just keep following the directions. You are getting very close to seeing your PC work again like it did before it broke. Wait for a while and give the computer some time to start up all of the way. Usually a couple of minutes are good to let it boot up.

Now we are going to copy the saved repair files you copied earlier into the right spot so the computer will use them properly. We will be using the actual System Restore from within windows now that you are in. The Restore folder is usually made to be very hard to find but I’ll tell you how to find it now. Note that at this point I was forced to use a program I had again that allowed me to reset my administrator password because no matter what I put in, it said it was wrong. If a bubble pops up talking about your video settings being awful say OK to let it auto configure your video settings. Say yes again to confirm the settings work and are OK to keep.

Right click on the start button in the task bar and then when the menu of options appears select Explore.
Now, clicks on tools in the file menu then folder options and then select the view tab.

Under Hidden files and folders, select “Show hidden files and folders”.
Now scroll down some and put a check in the box that says “Show contents of system folders”. Click to clear the "Hide protected operating system files (Recommended)" check box. (Take the check out of the box)

Click “Yes” when the box pops up asking you to confirm that you want to display these files. Click Apply and then click OK.

Double-click the drive where you installed Windows XP to view the list of the folders inside of it.

Locate the “System Volume Information folder. This folder appears faded because it is normally set as a hidden folder. Double click the “System Volume Information” folder. If the folder opens for you, skip down to the paragraph that starts with “The System Volume Information” folder is now opened. If you got an error saying access is denied, do the following: Right click on the “System Volume Information” folder and select the Sharing and Security option. Then click the Security tab if there is one. (If there is no security tab available to select then skip down to the paragraph that starts with “But what if no security tab is available to select?” If you do see a security tab then click Add, and then in the box that says "Enter the object names to select," type the name of the user that's at the top of the Start menu which is probably you. Make sure you type the name the way it's listed on the Start Menu. I made the mistake of typing my first name only and it wouldn't let me in. Type first and last name if that's how it's written on the top of the Start menu. After you've typed that in, click OK until you are back to looking at the folder that wouldn’t let you in and double click it again to open it. You should be in it now. If not then you didn’t type the name exactly as it is listed on top of the start menu. It has to be the same for the folder to open for you.

“But what if no security tab is available to select?” Do this: Click to put checks in BOTH checkboxes in the "Network sharing and security" area. One of them is labeled "Share this folder on the network" and the other is labeled "Allow network users to change my files." Change the share name from “System Volume Information to something short, like SysVolInf as in only the first three letters of the words “System and Volume and Information. Click Apply and you will get an error possibly. If you get the error then just do it again and it will let you in the second time. Put a star next to this section on your print out because you’ll want to come back after you are restored and make sure to put this back to the way it was if the restore doesn’t do it for you. Just double check this when you’re running again is all I’m saying. Double click the folder now to get in it.

“The System Volume Information folder is now opened.” This folder may contain one or more folders with names like this”_restore{F4EB0E83-91FF-4B7D-ABC2-287358719EAE}”
Right click on each of them and note the date they were created. You DON’T want the one created with today’s date and time. Open the one that doesn’t have today’s date and time but is closest to the latest date before the problems happened.
Inside are several folders with names like RP37, RP38, and RP39 etc. These are each a separate restore point.
Go up to the file menu and select view. When the drop down menu opens select “Details”.
Now you can see the dates of when each of these was created listed next to them. Double click on the one that has the date that was one day before you started having trouble with your computer. So as an example if your computer died last Saturday on June 18 of 2006 then you would most likely want to open the folder that was created on Friday, June 17, 2006 which as you see was the day before the computer broke.

Now that you have opened the RP******* folder:

Find and open the “Snapshot” folder. Select view from the file menu again and select details from the drop down menu so you can read the file names more easily. Copy the following files from this “Snapshot” folder to the C:Windows\Tmp folder using the copy/paste process or however you know how to do this to get them copied from here to there. Here is the list of files to copy:
_registry_user_.default
_registry_machine_sam
_registry_machine_security
_registry_machine_software
_registry_machine_system

You are getting very close to being done so hang in there! Make sure your Windows XP CD is still in the drive and restart Windows making sure to hit any key this time when it tells you to do that to boot from the CD. Once it finishes with that long start up process again you’ll have those same options again like before. Press R to select Repair using the Recovery Console. Again, make sure your num lock is on if you use the number keypad on the right of your keyboard and then select the number that best describes the location of where you installed Windows XP to. Enter your admin password when prompted to do so. Now, you are again looking at a c:\windows> prompt.

Type in cd c:\windows\system32\config and hit enter so that your prompt should now look like c:\windows\system32\config>

From within Recovery Console, type the following commands:
del default
del sam
del security
del software
del system

cd ..\
cd ..\
cd tmp ( now your prompt should look like this: c:\windows\tmp> )

copy _registry_user_.default c:\windows\system32\config\default (Notice the period (".") before the word default in the first parameter)
copy _registry_machine_sam c:\windows\system32\config\sam
copy _registry_machine_security c:\windows\system32\config\security
copy _registry_machine_software c:\windows\system32\config\software
copy _registry_machine_system c:\windows\system32\config\system

If you can, remove the Windows XP CD from the CD-ROM now.

Type exit and your computer will reboot into whichever restore point you chose. Now you're done except that you may want to reset your current time and go back up to where I told you to mark that spot where you will make sure that the sharing isn’t still turned on for the System Volume Information folder. I hope this saved your butt. Always help others when you get a chance. If this helped and you are really-really grateful, please tell us about it on the forum at http://www.Hermskii.com

Thank you,

Hermskii

hi, I apologise in advance if this is long winded.

I was having a few problems with my PC. It wouldn't boot to windows at all. It was able to load it in Safe Mode, so I then did a system restore to a point long before the problems started. That worked, but after loading up windows, using the pc for a day or two, and shutting it down, it wouldn't boot again.

This time, when booting, it would show the WinXPPro logo (with the loading bar), and then after a few seconds the screen went blank, and nothing at all would happen (left it for over an hour). So the next time round i tried loading it in Safe Mode, which also failed, it would get so far in loading up the system files and then stop doing anything. Note: in both safe mode and normal mode, just before the screen went blank/stopped loading system files, all the keyboard lights would light up and then all go off, and everything becomes unresponsive - caps locks, num lock etc...nothing.

after that I tried the windows repair function from the original XPPro disk. This ran okay, but on reboot it would go as far as showing a light blue screen (not the blue error screens) and then an error message would appear saying "lsass.exe - System Error An invalid parameter was passed to a service or function". When I click on close, or "okay", the message closes, and the system procedes to reboot. I tried running the repair feature again, to no avail, and now I can't even access the recovery console, because my password has been changed (which was originally blank) but obviously isn't now, evne though I have not changed any passwords since this problem began.

I know a quick way of fixing this is just to reformat and do a fresh install of windows, but I'd prefer not to lose all the data I had. Any help at all folks?

I can't access safe mode, I can't get to the desktop, and recovery console is now out of business too.

1. is there anyway I can reset the admistrator password in my situation, and if I can access the recovery console, is there any point?
2. Am I best just using Maui's method, of installing a new windows directory to recover my files, and the FDisk it for a a fresh start. If I am, I've got about 50gb worth of stuff i need to back up, and thats a lot of dvd's, will I just be able to fire the files onto the computer I have it networked with via the shared folders? thanks

I'd appreciate any help on this, as its driving me spare! thanks

If you have received an lsass.exe error, then it's likely that your SAM file is hosed, and your administrator password is no good.

There are tools to get around the administrator password, either by displaying it, setting it to something else, blanking it, or not asking for it. You've got to download an ISO CD image, burn it to a CD, and boot from that CD.

See "http://www.petri.co.il/forgot_administrator_password.htm"

It might also be possible to stick the problem drive on another system as a secondary drive and get to the five recovery files that way (I haven't tried copying the files into the x:\windows\system32\config directory but I can get to both the System Volume Information folder and to the x:\windows\system32\config folder when I attach my old notebook drive into a USB enclosure and I can put things into the x:\windows\system32\config folder, so I think that it might work to do it this way (remember, you're not using the c: drive in this case, it's whatever letter Windows assigns to the USB drive). I don't think Windows cares how those files get into that folder. I'd advise putting the drive into a USB enclosure that can be hot-plugged after the good system is booted.

You've got to find a way to replace the five files in c:\windows\system32\config with good ones that you retrieve from the System Volume Information folder.

See "http://nordicgroup.us/xprecovery/recoveryxp.pdf"