2000 & XP PC's lock up, force restart, and fail due to missing files on restart.

Over the last two days we have seen the following issue repeat itself on 6 workstations (either 2000 or XP). The machine suddenly locks up, forcing the user to reboot. Upon restarting the machine the user recieves either on of these error message:

cannot find \windows\system32\hal.dll
Please reinstall

cannot find \windows\system32\ntoskrnl.exe
please reinstall

It's hard to reload, as most of these machines are not equiped with a floppy drive. We've tried windows repair option, but a windows repair disc is required. We created a windows repair disc off of a similar machine. The machine gets further along in the boot process (to the windows display), and then the infamous blue screen of death appears. I'm assuming since we don't have a repair disk made from these specific machines...with reg files, etc not matching up?

As it stands it appears that our only option is to complete a full reinstall of the OS, but there HAS to be an easier way. More importantly, we need to identify what is causing the issue?

Instantly, most people look at the possibility of a Virus. We have not been able to find any reason to believe this is the case. We run a symantec managed enterprise, with updates automatically recieved via ftp from symantec. these updates come out once a day, as opposed to the "basic" every thursday "automatic" release from symantec. We check for the update evevy two hours. We have not had a virus oubreak since implementing this technology. Our exchange server is protected in the same way.

Where we are more focused on in regards to the issue is a recent change to our network. We are preparing for the migration from 2000 to 2003, and had to add a new DNS, DHCP, & Terminal Services Licensing server, while taking the other one/s offline. This was done at night, and the next day is when the problems began. There are no errors in the event logs indicating a problem with DNS, DHCP, and AD seems to be replicating just fine.

Our goal is to find a solution to the problem once it has occured, and prevent the solution from occuring again. Thanks for your help everyone!
Who is Participating?
sfc cant be used from a command line looked it up in win2k pro resource kit ,
We really need to know what was done , a script is a good start if one exists look it over very carefully for any extra spaces typos invalid paths etc.
if you can get a recovery console type drwatson inthe winnt directory and use that to tell whats not right. I dont know if this utilility comes in xp
those are the basic windows 2k files , thats the kern type sfc /enable /scanboot on the runline , are you sure domain permissions and profiles were propigated correctly could try a commandline copy of the files off of the cd but i dont think it will work
make sure all clients are configured correctly, whats the last thing that happens before this problem occurs also look for a memory.dmp file and use drwatson to make a snapshot off of the command line , make another one off of a good box and compare whats different. once you hav these snapshots format the hdd and redo it from their
Something is corrupting the files and if you have a logon script that runs upon boot, I would check that area as well.  The blue screen is probably happening because the HAL does not match between the Repair Disks and problem pc's. You can replace those files from any bootable CD in its respective OS.

Cloud Class® Course: Microsoft Windows 7 Basic

This introductory course to Windows 7 environment will teach you about working with the Windows operating system. You will learn about basic functions including start menu; the desktop; managing files, folders, and libraries.

You could do a repair installation.

I am not one to hack on AV programs but we use F-Secure at our shop. We found that F-Secure has found viruses that Norton didn't pickup.
More information would be useful on this.  Like someone else said what was the last thing that was being done when the computer froze.  Since it doesn't seem to be OS specific, you mentioned that it does this in Win 2k and XP then you could have gotten some bad spyware/malware that is freezing your computer.  Is there a common person using these machines.  Could be that he is going to a website that has some of this stuff or something was installed by this person that caused the problem.

The repair option when doing it with XP or WIN 2k can be done without a repair disk.  You just have to read the menu correctly.  One option is to do a repair with a disk and another option is to go to the recovery console.  In there you should be able to run "sfc /scannow" and have a disk handy as it will replace any files that were corrupted/destroyed or replaced by another program.

I am pretty sure you can run this from command line but not real sure.

You could also try and do a "chkdsk /R" which recovers bad sectors and recovers them.

Good Luck.

mray77Author Commented:
It turned out to be an issue with a recent change to the login script. It didn't dawn on me that this change was made until it was mentioned to start by examining the scripts. Thank you to everyone for your input, and knowledge!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.