Server 2000 -> ...could not start because the following file is missing or corrupt: ...ntoskrnl.exe

[spyordie007]

This weekend one of our servers went down for a reboot (windows updates) and never came back up. Upon boot it's giving us the good old:

Disk I/O error: Status = 00000001
Windows 2000 could not start because the following file is missing or corrupt:
<Windows 2000 root>\system32\ntoskrnl.exe
Please re-install a copy of the above file.

I'm able to get into the system using the recovery console.

The physical storage is 6xSCSI in a RAID-5 configuration; logically there is only one drive/partition. As far as I can tell the storage system is working correctly (all the drives come up, I can access the disk/files within the recovery console, etc.).

I've tried running chkdsk against the volume and it's coming back clean. I've already verified the boot.ini is correct. After renaming the existing ntoskrnl file I re-installed it off the windows CD from the recovery console (using expand) and I'm still not having any success booting it.

Can anyone think of any troubleshooting steps I'm missing here before I go and rebuild this server?

Thanks in advance,

-Erik

 

[mikecel79]

Do you know which patches were installed? I know one of the patches in the past few months patched the NTOSKRNL.EXE file and this may have caused your problem. I think it was MS04-011.

Also is this a Dell server?

 

[spyordie007]

MS04-011 would have been installed on this server months ago. The updates that would have been installed on this server over the weekend are:
MS04-032
MS04-037 and
MS04-038

BTW yes it is a Dell server; it's an (old) Power Edge 4300 w/ a Perc 2 controller.

 

[bsobel]

Weird.

1) Ok, did you already try last known good?.
2) Boot.ini, said you already checked it.
3) Definatley not an NT box eh?

Thinking, but nothing is jumping out yet...

Bill

 

[mikecel79]

Are you getting a STOP error at all?

I did find this in the MS Knowledgebase but it deals with STOP errors. Found another one but it deals with McAfee Groupshield and Exchange 2k.

I think your on the right track with ttroubleshooting the disk subsystem.

 

[djdrastic]

Does it display the same boot message even if your replce the ntoskrnl.exe from te cd ?

 

[bsobel]

What drivers are you using to support the raid config (is it hw or sw raid?). Any chance the driver file was updated during the update?
Bill

 

[spyordie007]

It wont let me get to the last known good config screen (dies before it even gets that far).
Boot.ini is dead simple since it only has one drive/partition.
And nope, this is a 2000 SP4 box

-Erik

 

[spyordie007]

Are you getting a STOP error at all?

Nope no stop errors. The only thing I've been able to get (even after re-installing ntoskrnl) is the message in my OP.

What drivers are you using to support the raid config (is it hw or sw raid?). Any chance the driver file was updated during the update?

I dont know the specific drivers that it's using; it would be the ones that came with Windows (since the controller is older Windows already has them). It's hardware RAID. And there were no drivers updated when the updates were applied.

It's always possible that this has nothing to do with the updates this weekend. I dont know for sure now since I cant get to the event log but it wouldnt surprise me if this box has been up for 2+ months (basically since we did the last round of updates).

Found another one but it deals with McAfee Groupshield and Exchange 2k.

Unfortunetly no; the only thing that this box is doing is acting as a mirror for our virus dats and client configs. The only thing it is (was) running is as a McAfee EPO server; not Groupshield or Exchange (I think EPO is just their own HTTP server + file shares used to host the dats).

 

[spyordie007]

Interesting, the boot.ini reads:

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[Operating Systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Server" /fastdetect

I would have expected it to be scsi(0) rather than multi(0) but I just verified with another 4300 that we've got and its boot.ini is identical so it must be correct.

 

[stash]

I seem to recall an issue with Dells and MS04-038 or -032. Have you tried uninstalling either of these from the recovery console?

 

[spyordie007]

how do you uninstall a hotfix from the recovery console?

 

[stash]

You should be able to drill down to %systemroot%\$NtUninstallKBxxxxxx$\spuninst folder and run spuninst.exe

032 is KB840987 and 038 is KB834707

 

[bsobel]

Originally posted by: spyordie007
how do you uninstall a hotfix from the recovery console?

Navigate to the correct uninstall folder (e.g. $NtUinstallKBXXXXXX$). In there you should find a spuints directory. Run the spuninst.bat file found within.

Bill

 

[spyordie007]

Wonderful...

Just for the hell of it I updated the controller's (AMI Perc2/sc) firmware. I'm getting far enough into the boot process where I can now get the advanced startup options screen however regardless of what I pick (last known good, safe mode, etc.) I'm now getting a stop error (0x0000007B; Inaccessable boot device). So far I've tried updating the driver (mraid35x.sys) from the recovery console but not having any luck.

Thanks for the link earlier Mike as that is now the stop error I have; I'm working through other suggestions in it now.

-Erik

 

[spyordie007]

thanks, I'll also try uninstalling 032 and 038 to see if they are the problem.

 

[spyordie007]

Okay; I've uninstalled both 032 and 038 from the recovery console.

In 822052 there are only a handfull of troubleshooting steps that really apply. I've already updated the firmware on the controller as well as updating/replacing the driver for the controller and I'm still getting the 0x0000007B stop error when I try and boot it.

Any other suggestions guys?

And thanks for the suggestions so far.

-Erik

 

[mikecel79]

Originally posted by: spyordie007
Wonderful...

Just for the hell of it I updated the controller's (AMI Perc2/sc) firmware. I'm getting far enough into the boot process where I can now get the advanced startup options screen however regardless of what I pick (last known good, safe mode, etc.) I'm now getting a stop error (0x0000007B; Inaccessable boot device). So far I've tried updating the driver (mraid35x.sys) from the recovery console but not having any luck.

Thanks for the link earlier Mike as that is now the stop error I have; I'm working through other suggestions in it now.

-Erik

We had a similar problem with a Compaq server a few years ago when doing the NT4 Post SP6 security roll-up patch. What happened was we had a very old version of the cpqarray.sys file on our server(pre-SP4) and the security patch did not play nice with it. Caused the machine to BSOD on boot every time. The KB article found here is partially because of us. Apparently we were the first ones to report the issue

 

[mikecel79]

Ever get anywhere with this Spy?

 

[spyordie007]

unfortunetly no; I plan on rebuilding it tomorrow

Thanks for all the suggestions.

-Erik

 

[groovin]

why is it that equipement likes to fail after/during a long weekend?

 

[spyordie007]

murphy :roll: