WINSRV.DLL missing on certain workstations.

I've been working with a support team for a week now, and a perculiar problem arose this morning, for 6 different users. When they booted up, they had a blue screen, stating "winsrv.dll" is missing. I checked this via recovery console, and it wasn't missing at all.

These users all have somthing in common:
Windows 2000 Professional
Service Pack 2
IBM Laptops

We have since solved this issue via restore, but I am searching high and low for the cause of it. I am suspecting an auto-update that was applied to the network recently, but I cannot be certain.

If anyone has had the same problem, or know the cause of this enigma, could you please post a description and your hypothesis?

Many thanks in advance.

David Price
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Your assumption about the auto-update is probably correct.  winsrv.dll is one of those files that sometimes chokes on an update.  Usually I've seen winsrv.dll cause problems with hardware no longer working after an update (such as a second processor or even and EIDE controller!!) But I have not seen it create a BSOD.  

Unfortunately it's hard to reproduce, since you could run the same update, and it may not get corrupted.  Also the error "winsrv.dll is missing" is misleading.  The error is actually winsrv.dll being misconfigured, therefore unable to be properly recognized by the OS.  You can see it's settings in "C:\WINNT\repair\setup.log"  Look for the line with winsrv.dll in it.

In reality though, it's more work trying to chase down the cause than to just fix the result.  It's not the best way to go about things, but with errors like this that are so imbedded into Windows, there's not much else you can do.

By the way W2K SP2, was the last time I personally saw this praticular file get corrupted.  W2K SP3, W2K SP4, WinXp, and WinXP SP1, have not yet shown this problem. (to me anyway)

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Yes u are right this is surely a problem with update.

This problem happens when u have not uptodate %SystemRoot%\Repair\Setup.log file. if u done some update in past which involve winsrv.dl file and did not update this file properely and then after that u did this windows update, which did not go properly since it has repair.log file.

modify the %SystemRoot%\Repair\Setup.log file and then reapplying update will solve the problem.

This is the example for WinNT, but this may work for Windows 2000 too.
1) attrib -r -h %SystemRoot%\Repair\Setup.log
2) Make a backup copy of the %SystemRoot%\Repair\Setup.log.

NOTE: check this file on system where u did not have problem and system who did not do this last update. get the following correct string. and compare that with this string on these 6 system.

3) Edit Setup.log, search for  line, correct this line: this line should look like this one here(which u got from other system).

    \System32\Winsrv.dll ="WINSRV.DLL","<some number>"

4) Save the modified Setup.log to the %SystemRoot%\Repair directory and attrib +r +h %SystemRoot%\Repair\Setup.log

5) Re-apply the update.

m0rtAuthor Commented:
Many thanks to you both for your swift answers.

You are right about the solution being quicker than eliminating the cause... I just hope that the other 350 users dont decide to have the same problem. Unfortunately, this problem HAS to be explained, and the cause identified... it's the drawback of working for a large company.

I've looked for some sort of pattern and 9 of the 10 computers effected, are Tseries IBM laptops (the other being an IBM NetVista workstation)... I'm hoping that microsoft will identify a problem with one of their updates, and IBM laptops running win2k sp2... but then again, i hope I win the lottery too.

Thanks again guys.

CompTIA Security+

Learn the essential functions of CompTIA Security+, which establishes the core knowledge required of any cybersecurity role and leads professionals into intermediate-level cybersecurity jobs.

We've been having the same problem at my company of 800+ workstations.

It's crashed a ton of PC's.. Luckily we've been able to repair them successfully.  Basically what we've managed to do is cut down the auto daily SP4 updates from 25 a day to 10 - which to date seems to have resolved the problem without a single PC BSOD'n with the WINSRV.DLL error.  We are also at a loss of what the heck is causing the problem!  We've figured the end user was the root cause but at this point is doubtful.  It's a serious problem since some of the PC's needed to be totally re-imaged and data restored.
Ok Here's my problem, all of our machines are current with sp4 except for this machine that is giving the same error.  It wil not boot at all I am able to access the setup.log file and edit it but I don't have a pre sp2 machine to look up the correct entry.
To fix this, mount the hard drive from the failing system as a slave drive in a working system. Then browse to the slave drive using Windows Explorer and navigate into the C:\WINNT$NtServicePackUninstall$\spuninst folder. Right-click spuninst.bat and select Edit. Click Edit / Replace and change all instances of C: to the drive letter of the slave drive. (In the screen shown below it is F: but yours may be some other letter.) Then click Replace All.

After the replace function is complete, close the replace dialog and close and save the batch file. Then launch the batch file to uninstall SP4 on the slave drive. When complete, shutdown and return the drive to its original system and you should be able to boot normally. Reapply SP4 on the machine.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Operating Systems

From novice to tech pro — start learning today.