Lsass.exe – system error Indicates a revision number.... Server 2003
Posted on 2011-05-08
I just had a Server dropped off with some interesting problems.
The Raid5 volume had a bad disk so I unplugged it. The volume is degraded but still shows as bootable.
When I tried to reboot I received a grocery list of errors so I did a repair install of Server 2003 standard.
Upon rebooting I received the following message:
“ Lsass.exe – system error Indicates a revision number encountered or specified is not one known by the service. It may be a more recent revision than the service is aware of. “
This happens in safe as well as normal mode. As soon as I hit the OK in the dialog box it reboots.
There was some unused space on the volume so I made a new partition and loaded Server 2003 into that partition. After all that I downloaded malwarebytes and ran it against the bad partition. It comes up clean but still gets the same error (above) when I boot from the bad partition. I also tried replacing lsass.exe. The bad partition is C:\ and the good partition is F:\
I booted into the F partition and then renamed security and security.sav to oldsecurity and oldsecirity.sav (on the C partition). I tried to boot to the C partition again but then I get:
“ Security Accounts Manager initialization failed because `of the following error. The security ID structure is invalid. Error Status: 0xc0000078. Please click OK to shutdown this system and reboot into safe mode, check the event log for more detailed information.”
Can’t get into safe mode either. Boot into BartPE and copy over security from f:\windows\system32\config to c:\windows\system32\config. When I try a boot to C partition I get the Security Accounts Manager error.
Boot back to the F partition, del security and security.sav, ren oldsecurity and oldsecurity.sav to security and security.sav (on c:\windows\system32\config) and I’m back to the Lsass.exe – system error Indicates a revision number error.
I have access to all the data so I suppose I could do a clean install but I’m unsure if I have access to the EMR and other apps to reinstall.