I had a lsass.exe error yesterday on boot (SBS 2003), not virus related. After a few hours I realised i had a registry backup from a few weeks ago in the repair directory. I booted with Ultimate Boot CD, renamed the original SAM in the system32\config folder to SAM.bak and copied over the old SAM from the repair directory.
Worked great and before I knew it i was in Safe mode, but my Applying Computer Settings issue was still there in normal mode so I thought I'd try a Last Known Config, bad idea! I was back to the lsass.exe error once again.
No worries I thought, I'll just repeat the procedure as mentioned above and it will be fine. Hmmm, not the case, I still get the lsass.exe error.
I went back into the system32\config folder and saw that the date of my SAM file is still time stamped as being two weeks old. Strange I thought, I deleted it and booted with no SAM file. Once again i went back into system32\config and saw that a new SAM had been created with the correct date and time. I copied over this with my old SAM but still the same issue, it seems that SBS is grabbing the SAM info from somewhere else. Is this possible?
After I originally copied the SAM over at the beginning of this story (and it worked) I went back into system32\config and saw that the file date and time had changed to the present, so I know there must be an issue now with why the system is not picking up the SAM I copied over.
Any ideas anyone?