Active Directory restore

[aquila125]

Hi all,

I have a SBS2003 server that is the only server in the domain. Due to some Sophos Antivirus problems I can't get into this server anymore (lsass.exe: "object name not found", reboot-loop). I checked for virusses and stuff, nothing helped.
So now I'm considering a reinstallation.

Is there a way I can recover my AD? I got all the files.
Besides the AD, I also need te recover Exchange. I've also got these files (edb, stm), but I can only use these files if I can restore AD (else I'll some tool like PowerControls I guess).

Thanks!

 

[IllogicallyLogical]

Have you checked this out?

- You cannot log on or you experience a long delay on a domain controller or on a member computer that is running Windows 2000, Windows XP, or Windows Server 2003

http://support.microsoft.com/kb/883268

Joey
A+, Network+, MCP

 

[aquila125]

When the server boots I get a popup with the message lsass.exe object name not found. I click the OK button and the system reboots...

 

[HalComps]

Your computer is infected with the Sasser Virus. Here's a removal tool you can put on a floppy disk and run from there:

http://www.sophos.com/support/disinfection/sasser.html

After that you should follow the instructions in this Microsoft article:

http://www.microsoft.com/security/incident/sasser.asp

 

[IllogicallyLogical]

When the server boots I get a popup with the message lsass.exe object name not found. I click the OK button and the system reboots...

....as is described in the KB article I linked. Have you tried pressing F8 during bootup and selecting the 'Last Known Good Configuration' option from the menu? If 'Last Known Good Configuration' doesn't work, try booting the computer into Safe Mode w/ Command Prompt and follow the steps in the Microsoft KB link. Other than that you could try a Repair Install of the OS. If worse comes to worse and you must format and reinstall you will need a critical-volume backup or a full server backup to perform a Nonauthoritative Restore of AD.

Joey
A+, Network+, MCP

 

[aquila125]

I get the same error message when I boot into safe mode (all types)... I'll try the last know good config, but I don't have high hopes..

It's not the sasser virus, I ran de mcafee stinger from a boot disk and it didn't find anything

 

[HalComps]

ok try this

This problem may occur if one or more services that run in the Lsass.exe process or in the Services.exe process are no longer configured to run as shared service processes. By default, services that run in these processes are configured to run as shared service processes.

Restart the computer.
Press the F8 key before the Windows logo page is displayed.
Use the arrow keys to select Safe Mode with Command Prompt, and then press ENTER.
You can use the Sc.exe tool to determine what service is incorrectly configured. To do this, follow these steps.

Sc.exe is included with Windows XP and with Windows Server 2003. Sc.exe is also available in the Windows 2000 Server resource kit.
Click Start, click Run, type cmd, and then click OK.
Type the following commands. Press ENTER after you type each command:
Sc query HTTPFilter
Sc query KDC
Sc query Netlogon
Sc query NTLMssp
Sc query PolicyAgent
Sc query ProtectedStorage
Sc query SamSs
Sc query Eventlog
Sc query PlugPlay
The TYPE value must be 20 WIN32_SHARE_PROCESS for the services that are listed in the "More Information" section to be correctly configured. This value configures the services to run in shared service processes.

For example, if you type SC query Netlogon, you receive output that is similar to the following:

C:\>sc query Netlogon

SERVICE_NAME: Netlogon
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE,PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

Note Services that are configured to run in separate memory processes have a TYPE value of 10 WIN32_OWN_PROCESS.

After you determine what services are incorrectly configured, follow these steps to change the TYPE value:
Click Start, click Run, type cmd, and then click OK.
Type sc config Service Name type= share, and then press ENTER.

Note In this step, Service Name is one of the services that are listed in the "More Information" section.
Repeat step 1 for each service that is incorrectly configured.

Even if you received activation notification before you followed these steps, you must reactivate your copy of Windows.

hope this is of more help to u

 

[IllogicallyLogical]

HalComps everything you just posted was provided in the KB article I had already linked. Aquila125 has already stated that none of the "Safe Modes" work.

Joey
A+, Network+, MCP

 

[HalComps]

my apologies, have u tried doing a repair from the cd? if not try replacing the file and seeing if that will work. i hope u get it sorted soon

 

[HalComps]

also see

http://www.techzonez.com/forums/archive/index.php/t-5871.html

http://support.microsoft.com/kb/325879

 

[aquila125]

I replaced the file -> didn't work
I can't do a repair, option is not available on the OEM cd's...

We reinstalled the server... thanks for all the advice!

 

[HalComps]

Glad you've got it all back and running even if u did have to reinstall