Wow... Amazing how many typos can get through when you type in a hurry. :) Anyway, still no progress on this (other than getting the server back to square one). Looks like a rebuild is in my future. -----Original Message----- From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf Of Jay Moock Sent: Friday, January 13, 2006 11:21 AM To: thin@xxxxxxxxxxxxx Subject: [THIN] Re: SP1 Upgrade Problems That is a link to HRP01 for MPS 4.0. We are on MPS 3.0 with HRP04 across the board. Backing out SP1 did not help, so I restored the Software and System registry hives to known good copies and replaces lsass.exe with a known goog copy. After the the IMA service starts OK. The error that we are receiving is indicative of being infected with the Sasser worm, but Symantec's sasser removal tool found nothing. I found some info about a Virus Scanner called NOD causing a similar problem (something about the IMOD service), but we use McAfee, and disabling it did not help. Now that we are up and running and have a recovery procedure I am going to give the SP1 install one more try before giving up on it. Since this is the last server I really want to get this done... -----Original Message----- From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf Of Tom Howarth Sent: Friday, January 13, 2006 10:16 AM To: thin@xxxxxxxxxxxxx Subject: [THIN] Re: SP1 Upgrade Problems Try http://support.citrix.com/article/CTX107504 as a starting point. -----Original Message----- From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf Of Jay Moock Sent: 13 January 2006 14:56 To: thin@xxxxxxxxxxxxx Subject: [THIN] SP1 Upgrade Problems After upgrading my last Win2k3 server (out if 10 total) to SP1 (servers run MPS 3.0 with HRP04) it now throws the following errors shortly after booting and then reboots. Event Type: Information Event Source: USER32 Event Category: None Event ID: 1074 Date: 1/13/2006 Time: 7:26:54 AM User: NT AUTHORITY\SYSTEM Computer: LRTS03 Description: The process winlogon.exe has initiated the restart of computer LRTS03 on behalf of user for the following reason: No title for this reason could be found Reason Code: 0x50006 Shutdown Type: restart Comment: The system process 'M:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code -1073741819. The system will now shut down and restart. Event Type: Error Event Source: Application Error Event Category: (100) Event ID: 1000 Date: 1/13/2006 Time: 7:31:17 AM User: N/A Computer: LRTS03 Description: Faulting application lsass.exe, version 5.2.3790.0, faulting module samsrv.dll, version 5.2.3790.1830, fault address 0x0001061d. There are several RasMan errors logged after this. Setting the XML and IMA services to manual startup allows the server to boot OK. I cleared the LHC and attempted to restart the IMA service and the same thing happened. So, obviously the problem lies with the IMAService, but I have no idea where to go from here. The are not IMA related errors in the event log. Any ideas would be appreciated. Thanks, Jay ************************************************ For Archives, RSS, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link: //www.freelists.org/list/thin ************************************************ ************************************************ For Archives, RSS, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link: //www.freelists.org/list/thin ************************************************ ************************************************ For Archives, RSS, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link: //www.freelists.org/list/thin ************************************************ ************************************************ For Archives, RSS, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link: //www.freelists.org/list/thin ************************************************