Avatar of NorrieC
NorrieC asked on

Alerter Service LSASS.EXE will not start. EV ID 7009 Timeout

Hi all,
Having got rid of a virus on our server the following message dialogue appears on startup:
LSASS.exe - System Error
Object Name already exists
"OK" button

If I hit OK then the server reboots instantly. If I leave alone then the dialogue remains on screen on top of all the other windows and the server appears to boot normally.

However many services will not start. The failure to start starts at the Alerter Service (LSASS.EXE) and everything below it including workstation and netlogon. Hence the domain is unavailable.

I have tried to start the alerter service several times but the Service Control Manager reports a timeout waiting for a response from Alerter Service.

Netdiag and DCdiag give predictable results since the domain hasn't been established.

I am at my wits end. I have tried everything within my knowledge sphere to no avail. Any help greatly appreciated.

Norrie
SBSWindows Server 2003

Avatar of undefined
Last Comment
NorrieC

8/22/2022 - Mon
ASKER
NorrieC

Hi all,

Just a quick update. I have progressed since my first post. The alerter service (LSASS.EXE) wont start because there's another service which has started LSASS.EXE already with the context Win32_Own_Process instead of Win32_Shared_Process. That means that the Alerter service gets a "Duplicate Object" error when it tries to start it also.

Does anyone know how to find out which service has started LSASS.EXE in the Own_Process context rather than the "Shared_Process context?

Can anyone send me the exported key for the Alerter service from a working copy of SBS2003 registry?

Can anyone help with this? Being new here, how can I tell if anyone has even read my post?

Cheers
Norrie
Farhan Kazi

Have you gone through following:
http://support.microsoft.com/kb/883268

Exported Alerter Service registry key is attached (remove .txt)
Alerter.reg.txt
Farhan Kazi

This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
ASKER
NorrieC

OK we progress slightly. When the virus struck it updated the registry by changine the fiolename and path for the alerter service to c:\windows\system32\LSSAS.exe which was the virus. So I edited the registry by searching for all the instances of LSSAS.EXE and changing them all to LSASS.EXE. However, I didn't know at that time that the proper file for the Alerter Service was svchost.exe. So now I've changed it. The "lssas.exe system error" has now gone. In its place is a very long logon period and events in the event viewer. The alerter service still cannot start but its now down to "Circular Dependencies". I've looked through the services.msc and I can see the dependencies of each of the services and I've found the circuolar reference.

THe Workstation service depends on the alerter service. The Alerter service does not say that it depends on the workstation service. However, one of the services which depends on the workstation service is called "Microsoft Exchange System Attendant". Under the MESA dependencies it says it relies on the workstation service in the top pane of the dependencies tab. However, there's a + sign in front of the workstation and if it is expanded then the alert service is listed below. I think this is the source of the  circular dependency. However, because the virus changed so many registry entries I've lost the dependency structure ,or at least part of it.

Can anyone check a working SBS 2003 server and tell me what the dependency relationship is between the Workstation, Alerter and MESA services please?

I think I see light at the end of the tunnel. Thanks for your help thus far.
Cheers
Norrie
ASKER CERTIFIED SOLUTION
NorrieC

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question