After restoring System State I see System error lsass.exe

After restoring System State I see System error lsass.exe

I restored C disk with a System State (Windows 2003 Enterprise SP1) and
after booting I see:

System error lsass.exe:
When trying to update a password the return status indicates that the
value provided as the current password is not correct.

and the system is going to reboot.

I tried to Repair Windows form the CD but the result is the same. How to do?

I think it is connected with security issues after replacing some
important files or registry keys.

I tried to repair instalation useing Windows Server CD but it is still
the same...

--
Ahtung crosspost...

Hello Customer,

Thank you for your post. This is George and I will be assisting you in this
post.

Firstly, I just want to let you know that this may be a complicated issue
and maybe you have to make a refresh installation on your machine. You need
to backup all the important data from the machine in case of unrecoverable
situation.

For us to narrow down this issue, I want to know if you have any
Symantec-related software installed on your computer. If you have, please
refer to the following article, this may help you,

BUG REPORT: Windows 2003 client does not start after disaster recovery
using "Shadow Copy Components" method:
http://seer.entsupport.symantec.com/docs/274353.htm

This error may also be encountered when the Registry is corrupted. You can
get more details and suggestions on the following location:

How to recover from a corrupted registry that prevents Windows XP from
starting:
http://support.microsoft.com/kb/307545/en-us

Please note, restore the backup to a test computer for the steps in this kb
first. Do not make these changes directly to the machine if possible.

Here is an additional article for your reference:

How to access the computer after you disable the administrator account:
http://support.microsoft.com/kb/814777/en-us

I hope this helps. If anything is unclear, please feel free to let me know.
I look forward to your reply.

Thank you!

Sincerely,
George Yin
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

> Firstly, I just want to let you know that this may be a complicated issue
> and maybe you have to make a refresh installation on your machine. You need
> to backup all the important data from the machine in case of unrecoverable
> situation.

Take it easy I am preparing Disaster Recovery Plans and I do it on my
test envioriment.


>
> For us to narrow down this issue, I want to know if you have any
> Symantec-related software installed on your computer. If you have, please
> refer to the following article, this may help you,


Yes! I am useing Symantec Antyvirus, but I am useing normal ntbackup -
(Backup Utility for Windows Microsoft and VERITAS Software Corporation)
so I have questions:

1. Is a patch avaible for standard ntbackup, if yes could you send me a
direct link to download this (Windows 2003 32 bit Enterprise)?

2. Is there any workaround for this problem (without installing fixes)
(for example backuping System C drive and System State in two sesions).
I read something there
http://seer.entsupport.symantec.com/docs/275931.htm but I am not sure?

3. Is Tivoli Storage manager Backup/Archive Client 5.3.5 affected to
this problem?

>
> BUG REPORT: Windows 2003 client does not start after disaster recovery
> using "Shadow Copy Components" method:
> http://seer.entsupport.symantec.com/docs/274353.htm
>
> This error may also be encountered when the Registry is corrupted. You can
> get more details and suggestions on the following location:
>
> How to recover from a corrupted registry that prevents Windows XP from
> starting:
> http://support.microsoft.com/kb/307545/en-us
>
> Please note, restore the backup to a test computer for the steps in this kb
> first. Do not make these changes directly to the machine if possible.
>
> Here is an additional article for your reference:
>
> How to access the computer after you disable the administrator account:
> http://support.microsoft.com/kb/814777/en-us
>
> I hope this helps. If anything is unclear, please feel free to let me know.
> I look forward to your reply.

Hello Customer,

Thank you for the reply.

I am a bit unclear about which tool you used. Did you use the NtBackup.exe
or the NetBackup to restore the system? If you used the NetBackup, I still
think the fix for NetBackup 5.0 and 5.1 will be the best choice. I suggest
you contact Veritas Corporation for more details. Please understand that I
don't intend to bounce you between different support services as I am fully
aware how time consuming this can be.

Based on some further research, I found some detail information and
workaround that may be helpful. You can access them by the following link:

https://forums.symantec.com/syment/b...essage.id=1605
3

For the first question, sorry I didn't find any related patch for
NtBackup.exe of Windows Server 2003 SP1.

For the third question, I am unclear about that did you mean the IBM Tivoli
Storage Manager client. If you did, I found a list for your reference:

http://www-1.ibm.com/support/docview...&dc=DB520&uid=
swg21248788&loc=en_US&cs=UTF-8&lang=en&rss=ct663tivoli

I also suggest you contact the manufacture company to see if they had any
information on this.

I look forward to your reply. If anything is unclear, please feel free to
let me know.

Thank you.

Sincerely,
George Yin
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

George Yin(MSFT) pisze:
> Hello Customer,
>
> Thank you for the reply.
>
> I am a bit unclear about which tool you used. Did you use the NtBackup.exe
> or the NetBackup to restore the system?

I am useing ntbackup.exe NOT NETBACKUP so I am looking for a solution on
MS gropups.

So is ntbackup.exe affected with this problem?

George Yin(MSFT) pisze:
> Hello Customer,
>
> Thank you for the reply.
>
> I am a bit unclear about which tool you used. Did you use the
NtBackup.exe
> or the NetBackup to restore the system?

I am useing ntbackup.exe NOT NETBACKUP so I am looking for a solution on
MS gropups.

So is ntbackup.exe affected with this problem?

Dear Customer,

Thank you for your reply.

George is out of office currently. This is Neo and I will continue to work
with you on this issue.

I don't think NTbackup could directly cause this problem. As your
description, repair installation did not work, which means system files are
also correct. We need more tests to detect the cause.

1. I'd like to know whether a full backup is available for this system. If
yes, please try to restore the whole system including all files in the
system partition as well as the system state. While processing full backup
restore, please make sure the date when the backup is created. All
documents modified after the creation of backup will be overwritten.

2. I suspect that the cause is the corrupted registry files that have been
restored. A manual registry restore is recommended to troubleshoot the
registry-related issue. Backup the current registry files first, and
replace them with the ones that is created during the initial installation
process of Windows. Please then boot the system again and check how it
works.

How to recover from a corrupted registry that prevents Windows XP from
starting:
http://support.microsoft.com/kb/307545/en-us

3. For this issue, I'd like to get more information in detail of your
environment to make further investigation.

1) Is your Windows Server 2003 Enterprise a domain controller, a member
server, or a standalone server?

2) Can you login with administrative credential onto recovery console?

How To Use the Recovery Console on a Windows Server 2003-Based Computer
That Does Not Start:
http://support.microsoft.com/kb/326215

3) Can you boot the system into Safe Mode?

Thanks for your time and efforts.

Sincerely,
Neo Zhu,
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Jian-Ping Zhu [MSFT] pisze:
> Dear Customer,
>
> Thank you for your reply.
> George is out of office currently. This is Neo and I will continue to
work with you on this issue.
>
> I don't think NTbackup could directly cause this problem. As your
description, repair installation did not work, which means system files
are also correct. We need more tests to detect the cause.
>
> 1. I'd like to know whether a full backup is available for this
system. If yes, please try to restore the whole system including all
files in the system partition as well as the system state. While
processing full backup restore, please make sure the date when the
backup is created. All documents modified after the creation of backup
will be overwritten.



I did it in Safe Mode. During doing this system is going to reboot and
after that I see "System error lsass.exe: ..."


>
> 2. I suspect that the cause is the corrupted registry files that have
been restored. A manual registry restore is recommended to troubleshoot
the registry-related issue. Backup the current registry files first, and
replace them with the ones that is created during the initial
installation process of Windows. Please then boot the system again and
check how it works.
>
> How to recover from a corrupted registry that prevents Windows XP
from starting:
> http://support.microsoft.com/kb/307545/en-us

I did Part One - and after that System is able to boot but I saw HAL
error so I make a repair of Windows and I will able to boot and log to
the system and I see all files. It seems that Oracle iAS (Forms Server)
started properly but when I open IE and forms application that uses
jinitiator, IE sudennly close and I see in event log:

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 2/5/2008
Time: 4:13:00 PM
User: N/A
Computer: PLWAWA0010
Description:
Faulting application IEXPLORE.EXE, version 6.0.3790.1830, faulting
module jvm.dll, version 0.0.0.0, fault address 0x000bc3a0.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 49 45 58 ure IEX
0018: 50 4c 4f 52 45 2e 45 58 PLORE.EX
0020: 45 20 36 2e 30 2e 33 37 E 6.0.37
0028: 39 30 2e 31 38 33 30 20 90.1830
0030: 69 6e 20 6a 76 6d 2e 64 in jvm.d
0038: 6c 6c 20 30 2e 30 2e 30 ll 0.0.0
0040: 2e 30 20 61 74 20 6f 66 .0 at of
0048: 66 73 65 74 20 30 30 30 fset 000
0050: 62 63 33 61 30 bc3a0



part Two (from http://support.microsoft.com/kb/307545/en-us) - C:\System
Volume Information contains only two files (tracking.log and
MountPointManagerwithout 0 bytes) there is no any _restore folder So I
didn't do it




>
> 3. For this issue, I'd like to get more information in detail of your
environment to make further investigation.
>
> 1) Is your Windows Server 2003 Enterprise a domain controller, a
member server, or a standalone server?

It is a member server.

>
> 2) Can you login with administrative credential onto recovery console?
>


yes I log to recovery console but useing a linux distribution to set not
to use password.

> How To Use the Recovery Console on a Windows Server 2003-Based
Computer That Does Not Start:
> http://support.microsoft.com/kb/326215
>
> 3) Can you boot the system into Safe Mode?


after restoring booting in Safe Mode has the same effect "System error
lsass.exe: ..."



Any idea what to do next? Is the system restore complette (I think no
because registry are very old - is it true?) How to cope with IE problem?

Hello,

Thank you for the reply.

As your description, it seems that there is missing data in the backup
media. As you can log on the system properly after replacing the corrupted
registry files and repairing installation, it indicates that some of the
restored registry file or system files are very likely corrupted.

1. System Restore is disabled by default in Windows Server 2003, which is
the reason why you can't find any restore folder in PART 2. You can skip
this part.

2. Internet Explorer crashed because the registry is old and does not
contain necessary information for some components such as add-ins. It
should be fixed by reinstalling "jinitiator".

For restoring the registry, I'd like to know whether there is any other
recent backups available. A good registry copy from these backups can make
the system get a partly up-to-date registry state.

Otherwise, all programs may need to be reinstalled and be reconfigured if
necessary.

Hope it works.

Sincerely,
Neo Zhu,
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

> As your description, it seems that there is missing data in the backup
> media. As you can log on the system properly after replacing the
corrupted
> registry files and repairing installation, it indicates that some of the
> restored registry file or system files are very likely corrupted.
>
> 1. System Restore is disabled by default in Windows Server 2003,
which is
> the reason why you can't find any restore folder in PART 2. You can skip
> this part.
>
> 2. Internet Explorer crashed because the registry is old and does not
> contain necessary information for some components such as add-ins. It
> should be fixed by reinstalling "jinitiator".

But it seems that the Oracle iAS is corrupted not IE or jinitiator
because if I log to the Forms Application from the other machine I see
the same event - IE sudenly close.


>
> For restoring the registry, I'd like to know whether there is any other
> recent backups available. A good registry copy from these backups can
make
> the system get a partly up-to-date registry state.


As I said We are preparing Disaster Recovery procedures so I can mak
System State backup now and try to recover it. I will do it in 3 days I
think.

Hello,

Yes. As you said, the client side access may be affected by the corruption
of server side service.

If anything is unclear with the information provided to you, please keep us
informed and let us know what we can do to be of further assistance.

Thanks.

Regards,

Sincerely,
Neo Zhu,
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

During restoring SYSTEM STATE I noticed that the restoring is finished
with blue screen "PAGE_FAULT_IN_NONPAGED_AREA" and the system is going
to reboot.


afterthat the system doesn't boot and I have to repair system (copying
registry).


What do you think about it?


Jian-Ping Zhu [MSFT] pisze:
> Hello,
>
> Yes. As you said, the client side access may be affected by the corruption
> of server side service.
>
> If anything is unclear with the information provided to you, please keep us
> informed and let us know what we can do to be of further assistance.
>
> Thanks.
>
> Regards,
>
> Sincerely,
> Neo Zhu,
> Microsoft Online Support
> Microsoft Global Technical Support Center
>
> Get Secure! - www.microsoft.com/security
> =====================================================
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> =====================================================
> This posting is provided "AS IS" with no warranties, and confers no rights.
>

Hello,

Thank you for your reply.

I have read all the posts between you and Neo. Based on our further
research, we still think that all the errors are caused by the corrupted
Backup files (including Registry and some other system files). If you have
any other intact backups, please use them to restore your system.
Otherwise, I think you have to perform a brand new installation as
corrupted backup files may cause many other potential problems.

You should backup all the important data and restore them after the fresh
installation.

About your last question, this error may be caused by:

1. An incompatible device driver or memory-resident program is being loaded.

2. The Windows swap file is damaged.

3. The tape driver or backup tape you are trying to use is damaged or
incompatible with Backup.

4. One or more Backup files may be damaged.

5. The memory in your computer is faulty.

Thank you for your effort and time. I will be always available for any
further assistance.

Sincerely,
George Yin
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Hello,

I am just writing to see how everything is going. If you have any updates
or need any further assistance on this issue, please feel free to let me
know. I am glad to be of assistance.

Sincerely,
George Yin
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.