Interesting Windows 2000 Server Problem: Windows server gurus, please help!

[Rainsford]

Long story short (sort of ), a Compaq 800 series server here at work running Windows 2000 server went south. Rebooted, came up with a problem with one of the 4 drives in the RAID 5 array attached to the RAID controller (not the onboard controller). Strange, considering we just replaced that exact drive. Rebooted again, no drive error message this time, but boot.ini was "invalid" and ntoskrnl.exe was damaged or missing, so windows wouldn't boot. Did a repair with our emergency rescue disk, but then upon starting Windows received a BSOD with a message about the SOFTWARE file in the \winnt\system32\config directory being invalid or damaged.

Looked up the error message online and found a way to fix it with backups made in the \winnt\restore folder. All good, restored a number of files (I don't remember all of them, but SECURITY, SAM and SOFTWARE are the ones that come to mind...sorry, notes are at work) and windows booted to the login prompt. Great! So I try to log in as the local admin to see if everything works...and I can't. Password that just worked in the recovery console no longer works, I tried rebooting to the recovery console as well, the password no longer works. So I decide to try a domain logon. Tried it and got the message that there was a problem with the computer account on the domain or the computer account password was incorrect (sorry if that's not exactly right, like I said, notes are at work).

So, essentialy this is where I'm stuck now. I can't log in to the machine at all, and it still does not appear to be working correctly. I can't figure out why except that maybe the "repair" copies of those system files were corrupt or "wrong" in some way. I'm kind of at a brick wall here. I do have backup copies of the files I replaced, but I obviously now have no way to get to them. Actually I have backups for the whole server, but it has some kind of tricky config stuff on it, and I'd rather not have to rebuild it if at all possible.

Any thoughts on this would be very greatly appreciated. Thanks in advance!

 

[NogginBoink]

The "repair" hives you used were likely created when the machine was first installed.

You restored a registry that is who-knows-how-old.

And was probably the wrong way to fix the computer. (But try the original admin password from when the machine was installed.)

If you've been doing regular system state backups with ntbackup, use recovery console to restore the files from c:\winnt\repair\regback. The files in regback are updated when you do a system state backup. The ones in repair are never updated.

And invalid boot.ini means the boot.ini is pointing to a nonexistent drive or partition, which can happen if the OS enumerates disks differently that it did in the past. Likely the SCSI ID of the disk changed somehow, or the LUN of the RAID array was different. The exact error text would help.

 

[Rainsford]

Hmm, I suspected as much with the repair hives since the admin password didn't work (either new or old), and I'll agree that that was maybe the wrong way to fix the system (although it seemed like a good idea at the time...). Unfortunitly this server was not set up to do system state backups (not my call), so that unfortunitly doesn't help me too much. The only newer system files I have are the ones that were giving me the BSODs, and even if they would help, I have no way to currently access the hard drive to copy them back over. And in any case, they prevent Windows from booting as well.

Here's an idea. We don't do a system state backup with ntbackup regularly, but we have a system that backs up all the files on every server on a central tape system. So, there is a backup of the hives I replaced. But that brings up the question, how exactly would I go about restoring them...

 

[MulLa]

Just an idea don't blame me if it doesn't work

Try deleting the computer account from your Domain and then re-join the Domain. Since you restored several system files which might have domain ID / Info on it.

As to unable to log in as local admin. I believe all the local accounts are stored in SAM so if you've replaced it I believe your local account / pw would have changed accordingly.

Hope that helps.

 

[Rainsford]

Originally posted by: MulLa
Just an idea don't blame me if it doesn't work

Try deleting the computer account from your Domain and then re-join the Domain. Since you restored several system files which might have domain ID / Info on it.

As to unable to log in as local admin. I believe all the local accounts are stored in SAM so if you've replaced it I believe your local account / pw would have changed accordingly.

Hope that helps.

We already tried the first idea, it's a good one, but the backup copy of those files was from before we made the switch to active directory when we were still using an NT4.0 domain. At least I assume that's what caused it to still not work correctly.

As for the second part, as far as I am aware, the password has not changed since install, yet it doesn't seem to work. Not really sure why, and the person who set up this server no longer works here and didn't keep very good documentation.

 

[NogginBoink]

Originally posted by: Rainsford
Hmm, I suspected as much with the repair hives since the admin password didn't work (either new or old), and I'll agree that that was maybe the wrong way to fix the system (although it seemed like a good idea at the time...). Unfortunitly this server was not set up to do system state backups (not my call), so that unfortunitly doesn't help me too much. The only newer system files I have are the ones that were giving me the BSODs, and even if they would help, I have no way to currently access the hard drive to copy them back over. And in any case, they prevent Windows from booting as well.

Here's an idea. We don't do a system state backup with ntbackup regularly, but we have a system that backs up all the files on every server on a central tape system. So, there is a backup of the hives I replaced. But that brings up the question, how exactly would I go about restoring them...

Well, the thing is, registry files can't be backed up like regular files.

But if you had them, you'd burn them to CD (cuz they're too big to fit on floppies), boot to the four W2K boot floppies to get into recovery console (cuz booting to the CD to get to recovery console locks the cd rom drive), and copy the files from your CD to c:\winnt\system32\config.

 

[Buddha Bart]

If you boot off something else (cdrom, floppy, whatever) is the data you need still on the RAID array? If so, why not just re-install around it? Personally even if all that tricky recovering stuff worked I'd never trust the machine again till a reformat.