ARGHH! Damned Win2k...loops indefinitely when attempting to log in - FIXED, details (more than you could want) inside

[Floyd]

About an hour ago I booted into Windows 2000, and upon entering my admin password, I was promptly greeted with the logon dialog again. I can put in my password until I am blue in the face and it will not let me in. It seems to accept it...I get the "Loading personal settings" message and disk thrashing, next thing I know I'm back at the logon dialog. If I enter a bogus password, I get the expected error message.

I've spent an hour searching the web and Microsoft's Knowledge Base to no avail. I'm going to try a repair run in a few minutes, but this is the sort of thing that just shouldn't happen, especially considering I haven't touched the profiles, group policies, or sharing.

For the love of God, what is it doing? :|

 

[bjb94]

Hi

It happened the same thing after changing may hard drive and restoring an image of my systme disk on my new drive.

No solution and reinstallation of 2000 needs.

Good luck

 

[kw7]

Do you have anti-virus program installed and running all the time?? I think this may because of virus, I have heard of a virus (don't know the name) do exactly what you described. If you have Norton Antirus or SystemWork 2001, boot directly from the CD-ROM and scan your computer.

 

[Magic30]

look in that mega Win2k tips&tricks thread ... there you should find an answer

 

[Useful0ne]

The same thing happen to me on 1 of my other machines. Do a search on this forum for lost password. There is a thread which has instructions for a fix for FAT32 (easy) & a link for a fix for NTFS.

Good Luck
U-1

 

[LocutusX]

Same thing happened to me in NT4 when I foolishly changed permissions on the system directory to deny access to everyone. That was smart. I had to reinstall a "secondary" copy of NT to get that working again.

 

[StuckMojo]

had this happen multiple times to me. changing drives and copying the image to a new one. it was caused by no page file. safe mode wont help either. repair *might* do it, i dont think it helped me if i recall. i tried the recovery console, but without a text mode registry editor, there was no way to fix it.

 

[Floyd]

Thanks guys for all the suggestions, sorry I've taken so long to respond. WIth regard to bjb94's suggestion, I found a thread from a few months ago which suggested it has something to do with Win2k's use of Globally Unique Identifiers (GUID) for the hard drives, see MS knowledgebase article. I have a dual-boot setup with Win98 on the primary partition and Win2k on the first logical partition. This has never changed, they have always been set up this way. I later noticed a Winnt\System32 folder had been created on one of my other partitions, so this seems to be what has happened (i.e. the Win2k boot process was looking for a file and created a path to it). But for the life of me I cannot figure out why, because the boot partition is the same as it has always been. Further still, none of the other partitions have been modified either (although they should be irrelevant to the boot process).

I did use BootPart a couple of days ago to add a floppy entry to the NT Boot Loader menu, and I don't recall if I had (sucessfully) booted into Win2k since then. Does anyone know if BootPart makes a change to the GUID or anything else that might cause this problem? I could understand if it completely FUBAR'ed the boot sector or the NT loader, but both of those work just fine...the whole Win2k boot proceeds normally until I enter the password.

kw7, I do use virus scan software...I scan everything before it is installed or run. And I don't use Outlook so I'm not susceptible its "autorun" (preview) or scripting vulnerabilities. I did receive a copy of the Matrix virus in email a few days ago and deleted it without ever opening it. This is a nasty little bastard, apparently will modify any executable that is run after the machine has been infected installing a virus scanner after the fact will not help, has to be done from DOS). Anyway, I was in Win98 when I received the email and deleted it, and haven't seen any curious behavior or ill effects since (and my virus scanner's executable still shows its original file date).

Magic30, I've read through the tips and tricks thread and don't recall seeing anything related, but I'll need to go check it again.

Useful0ne, I'm quite sure the problem is not an invalid password. It's the same password I've always used, and since this is my home machine, no one is around to modify it. Again, when I enter it, it accepts and gives me the "Loading Personal Settings" message, but then loops back to the logon prompt. Thanks for mentioning the thread, though...that will be good information to know.

Thanks again for all the suggestions. At this point I'm pretty sure it's a screwed up partition pointer or something similar. Doesn't make a lick of sense. Looks like I'm going to have to install Win2k onto another partition so I can access my registry and edit it so it can find the correct \Winnt\System32\userinit.exe file. That's going to take a lot of time, and I still cannot rationalize why this has happened in the first place.

If you guys haven't lost interest, I would really appreciate it if you would look over this information and see if you notice anything amiss. Especially those with knowledge of BootPart, that's the only thing with even the remotest possibility of causing this problem...and yet people speak highly of it here almost every day.

Best regards,
Floyd

 

[Useful0ne]

Floyd

Try to get a hold of AndyHui. See if he can give you some suggestions or help.

Good Luck

U-1

 

[StuckMojo]

[edit] i HIGHLY doubt its bootpart anyway[/edit]
its not bootpart. bootpart just reads the boot sector from a partition and creates a file, then adds a pointer to that file in the boot.ini file. doesnt actually change anything. i use bootpart.

its the GUID thing. try repair or reinstall overtop (like 98, NT5 saves the software hive, so you dont have to reinstall proggys...it just redetects all the hardware.

ooh, ooh, ooh! i just remembered. if you have access to another machine that runs NT, you can start regedt32 and edit the registry remotely! try that if possible.

oh yeah, i remembered how i was able to fix it before. i booted linux from a different drive, and used cfdisk to re-write the partition table (just did a write, without making any changes) and this got rid of the NT disk signature (but not any of the partitions), so it redetected the drive and put the system partition/page file back where it was supposed to be. you might be able to use a linux boot disk to run its fdisk to do the same thing. BE AWARE YOU COULD BLOW THE WHOLE THING! of course. so take a backup if possible.

 

[StuckMojo]

aha! from that knowledgebase article, my procedure is validated i suggest theirs instead of messing with linux boot stuff. this fixed it for me, so should be the easy way out for you.

-------

5. With only the system/boot drive in the system, or powered on, boot to a DOS or Windows 9X Start-up diskette that contains fdisk.exe and run the following command:
FDISK /MBR
This re-writes the Master Boot Record and erase the disk signature associated with volume GUID. Windows 2000 should assign default drive letters and allow you logon. Click the article number below for more information about FDISK:
Q69013 FDISK /MBR Rewrites the Master Boot Record

 

[Floyd]

> &quot;Its not bootpart. bootpart just reads the boot sector from a partition and creates a file, then adds a pointer to that file in the boot.ini file.&quot; <

StuckMojo, thanks for the confirmation on BootPart. That was my understanding as well, but wasn't going to knock any possibility until I was sure.

Here's an update. I restored a known good image of Win2k onto the partition and tried to boot, and the same thing happened. So clearly it is related to the GUID. I figured what the hell, I would see if I could apply the changes suggested in the MS Knowledgebase article. I copied userinit.exe to the WINNT\System32\ folder that Win2k had created as it was trying to initialize from the wrong partition. I then rebooted and it finally booted to the desktop after accepting my password.

Opening the Explorer shortcut on my desktop brought it up with the F:\ drive highlighted (indicating %SystemRoot%), but it should have been drive K:\. So I opened the registry and changed

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit:Reg_SZ:F:\WINNT\system32\userinit.exe

to the following, (removing the path to userinit)

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit:Reg_SZ:userinit.exe

I then navigated to the HKLM\SYSTEM\MountedDevices key and swapped the GUID's for &quot;\DosDevices\F:&quot; and &quot;\DosDevices\K:&quot;

Finally rebooted and everything was finally working again. Paths were correct and applications would start properly. Great, I though, I figured it out. Since the partition image I had restored was a couple of weeks old, I decided to restore the backup from yesterday and just go through the changes again to get everything up and going. Big F'n mistake! Now I'm back at square one. For some cosmic, mystical reason, repeating the steps will not let me into Win2k, even after blowing away the MBR on all my disks.

Looks like I'll get to reinstall Win2k onto another partition after all. [Ben Stein voice] Yay. [/Ben Stein voice] Unless someone can tell me how I can edit my Win2k registry from within Win98. I have access to it via WinInternals NTFS for Win98. I'm sure if I could get those keys straightened out there would be no problem booting up...tried hexedit but it was a wash. Or maybe I could sucker one of you guys into editing the keys for me and sending it back (~800k zipped)

Oh, one other possibility. StuckMojo, you mentioned something about the paging file. I had moved it to another partition, so no I don't have one on the Win2k partition itself. I can copy it over to the Win2k partition, but I don't remember the correct path...is it on the root or somewhere under \WINNT\? Don't think that could cause the login to loop, though...

Anybody want to hire me as a sysadmin? :Q

Best regards,
Floyd

 

[StuckMojo]

bummmmmer

2 ideas:

1) you could again roll back to the 2 week old image.

2) i think that you have to have ONLY the win2k drive (the one with the system partition) plugged in (unplugging power to drives should be sufficient...hmm..unless its a slave), clear its MBR, then boot. this gives win2k no choice but to use a partition on that drive as the system partition. seems like now its trying to use yet another partition as the system partition, perhaps this time one it cant read (like a linux partition or something).

how may partitions and of what format do you have on that particular drive?


also, how will sending your registry out help? im not aware of a way to edit a registry thats in a file without merging it with the active one (not what i would want to do in this case )

lastly, if you computer is on the net, cant you have a friend use regedt32 to edit your registry remotely? (i *think* you can even do this from 98, but some high level keys will be missing...but HKLM should be there so...)

 

[Floyd]

I disconnected all other drives and tried again, no dice. For the bastard who designed this behavior, may he become infested with the fleas of a thousand camels. I have to admit the idea is good, because it allows for some higher-level disk management. But if in the process, it has the potential to make a machine inaccessible, then fvck it. :| I have never had to deal with this crap with Win9x. Sure, sometimes you need to use a little ingenuity when installing a new drive, getting DOS letters to be what you want...but at least it works! I have now tried every &quot;solution&quot; proposed in the Knowledgebase article and none have worked. I should mention that the old HD image (whose recovery was successful) was of the original Win2k distribution, whereas the newer image has SP1 applied... Ack! Could it be...a...bug?

Haha, I even tried hex editing the registry to swap the DosDevices keys, no luck.

> &quot;how may partitions and of what format do you have on that particular drive?&quot;

Only two, the primary is FAT32 with Win98, the second is NTFS with Win2k. Couldn't get much simpler.

> &quot;also, how will sending your registry out help? im not aware of a way to edit a registry thats in a file without merging it with the active one (not what i would want to do in this case)&quot;

Well, frankly I don't know if it would help either. But it's possible to mount an external hive, modify it, and export it back out. Never needed to do it, but now might be a good time to learn.

> &quot;lastly, if you computer is on the net, cant you have a friend use regedt32 to edit your registry remotely?&quot;

That's a possibility, I have an extra machine I can set up here and try accessing the registry. I haven't decided yet if it would be better to do that, or try installing Win2k onto another partition and use it to modify the registry. Hmm, a remote edit does sound easier...

I now realize it would have been easier to just reinstall the OS, hindsight being what it is. But dammit, I hate doing that when there should be some way to fix it...something which would be beneficial to know. StuckMojo and to all others who have helped here, my sincerest appreciation goes out to you. If anybody thinks of something I haven't tried, please let me know.

I'm exhausted. Time for a cup of coffee.

Best regards,
Floyd

 

[Zach]

I had this problem, if I have time tonight I'll give you links to two KB articles my MS to fix it. I don't use win2000 anymore though, so I may be a bit rusty.

You should be able to restore login by making the path to the login file relative, and you may have done it.. I thought it was somehting like userlogin.exe but you have userinit or somehting (the new fusetak doesn't show me the thread when I reply!), and then you have to swap around the names of the registry entires for your partitions..... which is fun. Once you get your 2000 partition back to the lettar it was before you'll be usable.

It will continue login cycling if you can't run off of a 20 (or something) meg swap though, so you might have problems there if you've gotten the relative path for that file in place.

 

[Floyd]

FIXED IT!!

Here's what I did:

1. opened the registry in a hex editor and found the DosDevice keys
2. swapped the F:\ and K:\ keys (based on the prior successful fix).
3. tried booting into Win2k...if the DosDevice swap were correct, the machine should boot up successfully. It didn't, but it caused Win2k to create an empty \WINNT\System32 directory on the F: drive (while looking for userinit.exe).
4. booted back into Win98 and copied the userinit.exe into the directory
5. tried booting into Win2k again, and it made it all the way to the desktop.
6. opened regedit and made the necessary corrections to the DosDevice keys, which was apparent by opening Explorer and viewing the drive letters (Win2k was now somehow on D:, so I changed it back to K: as it was in the original installation). Rebooted and now everything is working again.

Wow, that was painful. This little nugget of information is getting pasted into a text file and saved to my archive of tips, tweaks, and fixes.

Best regards,
Floyd

 

[macssuck]

The same thing happened when I was creating a partion in partition magic the fix is to edit the boot.ini file and point win2k to the right partition or disk
in my case i moved my win2k partition down farther on the drive and created a new partition in front of it so i had bump the partition number up one

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT=&quot;Microsoft Windows 2000 Professional&quot; /fastdetect
C:\=&quot;Microsoft Windows&quot;

edit: my system would boot just fine but when I logged on it would load the profile then save it and return me to the logon screen

 

[Floyd]

Sorry, that's a totally unrelated problem. The system had no problem booting, it simply would not initialize the user profile.