Start Free Trial
Come for the solution, stay for everything else.
Start Free Trial
Alerter Service LSASS.EXE will not start. EV ID 7009 Timeout
Having got rid of a virus on our server the following message dialogue appears on startup:
LSASS.exe - System Error
Object Name already exists
If I hit OK then the server reboots instantly. If I leave alone then the dialogue remains on screen on top of all the other windows and the server appears to boot normally.
However many services will not start. The failure to start starts at the Alerter Service (LSASS.EXE) and everything below it including workstation and netlogon. Hence the domain is unavailable.
I have tried to start the alerter service several times but the Service Control Manager reports a timeout waiting for a response from Alerter Service.
Netdiag and DCdiag give predictable results since the domain hasn't been established.
I am at my wits end. I have tried everything within my knowledge sphere to no avail. Any help greatly appreciated.
Windows Server 2003
8/22/2022 - Mon
Just a quick update. I have progressed since my first post. The alerter service (LSASS.EXE) wont start because there's another service which has started LSASS.EXE already with the context Win32_Own_Process instead of Win32_Shared_Process. That means that the Alerter service gets a "Duplicate Object" error when it tries to start it also.
Does anyone know how to find out which service has started LSASS.EXE in the Own_Process context rather than the "Shared_Process context?
Can anyone send me the exported key for the Alerter service from a working copy of SBS2003 registry?
Can anyone help with this? Being new here, how can I tell if anyone has even read my post?
Have you gone through following:
Exported Alerter Service registry key is attached (remove .txt)
Also check following link for fixup batch script:
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
OK we progress slightly. When the virus struck it updated the registry by changine the fiolename and path for the alerter service to c:\windows\system32\LSSAS.
exe which was the virus. So I edited the registry by searching for all the instances of LSSAS.EXE and changing them all to LSASS.EXE. However, I didn't know at that time that the proper file for the Alerter Service was svchost.exe. So now I've changed it. The "lssas.exe system error" has now gone. In its place is a very long logon period and events in the event viewer. The alerter service still cannot start but its now down to "Circular Dependencies". I've looked through the services.msc and I can see the dependencies of each of the services and I've found the circuolar reference.
THe Workstation service depends on the alerter service. The Alerter service does not say that it depends on the workstation service. However, one of the services which depends on the workstation service is called "Microsoft Exchange System Attendant". Under the MESA dependencies it says it relies on the workstation service in the top pane of the dependencies tab. However, there's a + sign in front of the workstation and if it is expanded then the alert service is listed below. I think this is the source of the circular dependency. However, because the virus changed so many registry entries I've lost the dependency structure ,or at least part of it.
Can anyone check a working SBS 2003 server and tell me what the dependency relationship is between the Workstation, Alerter and MESA services please?
I think I see light at the end of the tunnel. Thanks for your help thus far.
ASKER CERTIFIED SOLUTION
Log in or sign up to see answer
Become an EE member today
7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Plans and Pricing
Certified Expert Program
© 1996-2022 Experts Exchange, LLC. All rights reserved. Covered by US Patent