Windows Forum

Ask something
Discussion Locked

Win XP - Corrupt Group Policy DB

0 helpful
4 replies

by gmichaels

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I beleive I have a corrupt group policy/security db that is effecting all PCs on a peer-to-peer network. The manifestation of the problem is a pagefile error that is missing or too small after boot. When the user enters their password and tries to login they hang imeediately. CTRL-ALT-DEL gets them past the hang and XP starts up. Then the pagefile error messages begin to appear. Windows eventually creates a temp page file and life is good until the next boot. This error had me confused for a while until I looked at the event logs. The event log shows numerous errors (423) in the ESENT. This led me to a MS support doc on the corrupt security db. A complete reinstall of the OS will fix the problem. I was hoping to find a better fix. I have a doc that explains how to fix the corrupt db problem but it does not work. It involves renaming the security db in the windows system folder, runnning mmc and adding in a snap-in for security management. Then using the snap in to open/reload the db from a security inf file. This would have reinitialized the db. This all works until the final import of the security inf file. I get an access denied message. The doc I have said this message may appear and to ignore it. But in the end the db is never actually recreated. So the problem continues. How can I restore the security db without a reinstall of the OS? My other issue is how could the db have gotten corrupted in the first place. Yes, I have tried all the tricks related to the pagefile itself including some regediting, deleting/recreating, boot with no page file than add it back and boot again etc. I don't think it's simply the page file but is the corrupt security db leading to the pagefile problem. I say this because of how it happens right at login when security policy is usually checked. Also the fact that it impacts all PCs on the network makes sense given it is related to group security.

4 replies

by timwalsh

First, I need to correct your premise that a corrupt security database on one PC is affecting all PCs (except in one circumstance).

In a peer-to-peer network, there is NO centralized Group Policy administration/ management. Group Policy settings must be configured and applied on a computer by computer basis.

You will only have centralized application of Group Policy in a domain-based network, and then only in an Active Directory domain.

If ALL of computers are experiencing the exact same problem you describe, the only way I can think that it might have happened is if a security template was created on one XP computer and then copied and applied to all other computers in the network. If the template became corrupted before it was copied, then it might affect the security db on all computers.

Next, let's address the pagefile error. Go to Control Panel > System > Advanced tab > Performance settings > Advanced tab > Virtual memory. Virtual memory settings address the size and location of the pagefile. First make sure you have a pagefile defined, and that it is in a location that has sufficient room to hold it. Things that might cause the pagefile error you are getting:
1. Virtual memory is configured for NO page file. WinXP MUST have a pagefile of at LEAST 2 MB defined regardless of the amount of memory installed.
2. The pagefile is set to be be managed by the system, but is located on an almost full partition/drive.

Take a look at the MS Knowledge Base article 316528 to see if this addresses your particular situation. Another one to check is 315270.

I think it is very likely that the security db problem is being caused by the pagefile problem and not the other way around.

by gmichaels

I did not configure the original network so I do not know if a disk was created as the wizard allows and then used on each system. In any case would a network management disk even contain a security template? probably not. So I don't think there were any other disks being used across systems. I have been all over the virtual memory page file settings and tried all the suggestions you have made and then some, including registry edits to set min/max page file size, recreate pagefile on startup, no page file, custom page file settings, and system managed, nad temp page file. It would correct the problem for 1 warm restart. But on the next cold restart the page file error would reappear. I am really stumped. Perhaps I am reaching by thinking the ESENT errors are related.

by timwalsh

First, I need to correct your premise that a corrupt security database on one PC is affecting all your PCs (except in one circumstance).

In a peer-to-peer network, there is NO centralized Group Policy administration/ management. Group Policy settings must be configured and applied on a computer by computer basis.

You will only have centralized application of Group Policy in a domain-based network, and then only in an Active Directory domain.

If ALL of computers are experiencing the exact same problem you describe, the only way I can think that it might have happened is if a security template was created on one XP computer and then copied and applied to all other computers in the network. If the template became corrupted before it was copied, then it might affect the security db on all computers.

Next, let's address the pagefile error. Go to Control Panel > System > Advanced tab > Performance settings > Advanced tab > Virtual memory. Virtual memory settings address the size and location of the pagefile. First make sure you have a pagefile defined, and that it is in a location that has sufficient room to hold it. Things that might cause the pagefile error you are getting:
1. Virtual memory is configured for NO page file. WinXP MUST have a pagefile of at LEAST 2 MB defined regardless of the amount of memory installed.
2. The pagefile is set to be be managed by the system, but is located on an almost full partition/drive.

Take a look at the MS Knowledge Base article 316528 to see if this addresses your particular situation. Another one to check is 315270.

I think it is very likely that the security db problem is being caused by the pagefile problem and not the other way around.

Hope this helps.

This discussion is closed to new replies.