Windows Forum

Ask something
Discussion Locked

No "BEGIN LOGON" Prompt

0 helpful
36 replies

by chuckab

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I cannot get a logon dialog on an NT 4-SP6a machine.
POST - OK
Boot Menu - OK
Black screen boot - OK
Blue screen boot - OK
GUI starts - OK
Default Wallpaper loads - OK
Mouse pointer - OK
Now - where's the "Begin Logon" box where I can press Ctrl-Alt-Del to logon?
Tried the following:
VGA Mode - same as above.
Access from network - NoGo
PING (from network) - NoGo
(slaved drive to working machine)
Deleted swap file - recreated
Renamed SAM - New SAM created (I put old SAM back)
Replaced the following files from identical working machine:
winlogon.exe
services.exe
alrsvc.dll
browser.dll
eventlog.dll
msgsvc.dll
netlogon.dll
ntlmssps.dll
srvsvc.dll
lmhsvc.dll
wkssvc.dll
lsass.exe
lsasrv.dll
comctl32.dll
comctl32.ocx
comdlg16.ocx
comdlg32.dll
comdlg32.ocx
Once the default wallpaper appears, I can hear the hard drive make about 2 more accesses, then nothing.
Dug out the event logs - nothing showing since last successful boot (9 days ago - user is on vacation - found problem by accident)
Reviewed what I could of the registry and saw nothing particular out of the ordinary.
I repeat: Where's the 'Begin Logon' dialog?

36 replies

by tamj123

I think this system is set to auto logon:
check registor

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"AutoAdminLogon"="1"
"DefaultPassword"=""

if you see this two line, delete and restart the computer.

hopethis will help.

by chuckab

Two problems:
1. Machine doesn't log on - only default wallpaper shows - no desktop, no logon prompt.
2. "AutoAdminLogon" = 0
I have the drive slaved to a working system so I can get to the files. I can get to some of the registry by loading "hives" from the files in %systemroot%\system32\config directory while booted up on the working system.

by dmiles

This may appear if the AutoLogon appears in the registry key
Open Registry and look under
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Network
Now find the find the AutoLogon Entry and delete the key,restart the computer nad the login box should appear

by chuckab

\...\Windows\CurrentVersion\Network doesn't exist.
\...\Windows NT\CurrentVersion\Network DOES exist, but the AutoLogon entry does not.
Machine does not build desktop, nor does it attach to the network. None of these services start. It gets asfar as the default wallpaper that is supposed to be behind the "Begin Logon" box and that's it. I'm getting to the registry by loading hives while the drive is slaved to a working machine.

by raymond.caldwell

I hope this helps you out, I've seen this happen to one of the LAN Adimns at work and this is what he told me to try......
when NT boots up hold down the left shift key, this will force NT to ask for username/password/domain. Logon with Admin rights and navigate to :
HKEY_LOCAL_MACHINE
\SOFTWARE
\Microsoft
\WindowsNT
\CurrentVersion
\WinLogon
and set AutoAdminLogon to 0 and default password to XXXXXXXXXX

by chuckab

This assumes that the machine will come all the way up. It DOESN'T come all the way up. I was able to check the SOFTWARE hive and the AutoAdminLogon is already set to "0"

by chuckab

All the answers so far assume that the machine comes all the way up. It does NOT. There is NO DESKTOP. I can NOT run any programs. There are NO network services (for remote access). The only things that work are the mouse pointer and CAPS Lock/Scrl Lock/Num Lock keys. I removed the hard drive and slaved it to another machine so I could get to the files. I am loading the various registry keys by loading hives in REGEDT32 and operating on them that way. I can test solutions having modified the BOOT.INI to boot from the other hard drive. There is something stopping the OS just before it displays the "Begin Logon" box.

by tamj123

some idea for you:

did you change the system variable recently, if does, change back. If Winlogon gets an error when trying to set an environment variable, the logon will fail.
Make sure that all the environment variable are valid and do not contain an = in the name

also remove all the application from start fold and registry run value.

hope this will help and good luck

by chuckab

System PATH variable valid. Checked all "ControlSet" entries. User variables not checked because we don't get that far.
All applications removed from Startup folder. - NoGo
All items removed from "Run" key (nothing in RunOnce or RunOnceEx). - NoGo
Checked WIN.INI and SYSTEM.INI just for grins since this response made me think of that - no "Run" entries found.

by chuckab

I now have another machine with the identical symptom. Therefore I'm raising the points in hope of attracting the person that knows what's going on.

by kdrungilas

Have you tried the "Last Known Good" command at boot up? That should bring you back to when the last time an actual logon occurred.

With all your subsequent registry changes, you may not be successful.

by chuckab

Should have mentioned it, but yes, I did try 'Last Known Good' early on with no luck. Machine stops at same point. Thanks for suggestion.

by parbo

Sounds to me like a service is not working properly. Since you also start experiencing this on another system you should ask yourself how these systems were loaded (network, handload, image etc).
What I suggest in this case is to use the regmon untility (from this links http://www.sysinternals.com/ntw2k/info/regboot.shtml). it enables you to monitor the start up. do this on a known good system and perform the same on one of the systems in question. That should give you a good indication of what's going wrong.

by parbo

I came across a autologon utility on the resource kit cd. Is it possible to set the system to autologon and change the shell to something else (like a 3rd party shell program or just any executable like regedit). Personally I give it a small change since it seem that the winlogon is not working right or another service which it depends on.

by shanghai sam

Still no resolution and this attempt didn't help either. Raised the points today in hopes of finding someone else who might give me a clue.

by Member 35711908

While not a full answer, at least a direction for inquiry: check the system policies for the domain and see if there's anything there that could be causing it. Another key would be to figure out what similarities there are between the two machines both having the issue, and what differentiates them from all others. Sorry that's all I can suggest, good luck!

by chuckab

Thanks for your comments, but, I have 39 other identical machines that were all loaded the same way (Power Quest's Drive Image). The users of these machines are of the same class (smart enough to run the machine, but not interested in anything that doesn't help them do their work) and the network control folks don't intrude on our lives (too much) with system policies. I even re-imaged their machines using the same master image I used the first time.
You're right, it's not a full answer.

by chuckab

"bijnaarp",
Working on getting the utility into the offending machine's registry to start as a boot device. Interesting utility - should give me what I need if I can get it to run!
More later...

by vh_s

It seems that you have a corrupt EXPLORER.EXE, which is the main shell of NT (and WINDOWS).

Try reinstalling this, and it should be fine.

Good luck.

by chuckab

Nope - didn't work. Nice thought, though. I don't believe the machine is getting that far. According to what I've read about the boot process the machine stops right when WINLOGON.EXE is supposed to display the "Press Ctrl-Alt-Del ..." dialog. I don't believe that EXPLORER.EXE runs until a user actually logs in.
Thanks for the suggestion. Some day, we just might bang this enough to find the solution!

by vh_s

It seems that you have a corrupt EXPLORER.EXE, which is the main shell of NT (and WINDOWS).

Try reinstalling this, and it should be fine.

Good luck.

by chuckab

"bijnaarp"
I can boot the machine with the "/sos" switch and see the REGMON driver in the list of drivers, but it doesn't seem to run. At least there is no message at the blue-screen boot indicating that it's running and there is no log file on the disk. I have a question in to the author of the utility and am waiting for an answer. Anyone else have a clue?

by spn

OK, its a real bugger of a problem .
You've done quite a lot so,I need to make quick review ,you are 100% certain that the eventlogs and there is noting there?OK Good
Now next you are running a virus scan with the most recent update? Good.
OK nowI have 3 things for you to try:

1:Have you tried to invocke the last known good?

2:From the boot sequence youve described
it seems the its when the kennal is accesed that something goes(or in this case dosent)
Try replace the "Ntoskrnl.exe" and "Hal.dll" located in (i see you tried the /sos in the Boot.ini ,if it loads the drivers the there might be a deeper problem ie the registory)

3:Or to run NTHQ
When running Windows NT, insert a blank 3.5-inch floppy diskin the drive.
Run Makedisk.bat from the \Support\Hqtool directory on the Windows NT Workstation product CD.
Using the floppy disk start your computer.(
When your computer starts, you are running NTHQ.
The file Readme.txt on the floppy disk contains details about NTHQ. You can see the same information by clicking the Help button on the NTHQ screen.(read extract below)

If you cannot start Windows NT, or have installed new hardware and cannot access it, NTHQ might help you troubleshoot the problem. Because NTHQ enables you to view the hardware that it detects, you can find out if any devices are not being detected.

I real hope that helps if it does'nt well
?'ll look around and see what i can find.
(also check if any new software has been added ie sreensavers or an application)
SPiNner

by chuckab

SPiNner,
The machine is virus free.
The event logs show nothing (not even that the service starts) since the last successful login on the 18th (or so) of December last year.
I tried "Last Known Good" early on with no luck
NTHQ won't get past trying to detect a Future Domain SCSI controller that doesn't exist in the machine. (Hmmm... something new!) The last thing it successfully detects is a communications port (step [14] - 31%). I tried both the 'Safe' and 'Extensive' test options.
Replaced both the hal.dll and ntoskrnl.exe files with no change. Still stops in the same spot. (Yes, just one at a time...)
No new hardware or software (including screen savers) have been installed.

by chuckab

Still no resolution. Several questions put to others have not yet been answered. I'll update this thread when I get more answers.
This frustrating because it HAS to have a small fix. I have long since rebuilt the two machines it has affected so far, but, I have 40 more of these machines and I don't want them all blowing up in my face! I had an off-line conversation with someone who had a similar problem, but his turned out to be a video card driver. Clue: Boots into safe (VGA) mode, but not in normal mode. Mine won't boot into either!
How am I testing solutions? I have the WINNT directories from both affected machines on a third identical FUNCTIONING machine and have configured the machine to multi-boot between the environments.

by chuckab

Here's another 500 points just to ensure that no one thinks I've forgotten about this.

by chuckab

Well, I just had another machine start exhibiting the same symptoms.
Here's another 1000 points to sweeten up the pot.

by duwaned

This may sound like something stupid, but have you checked the permissions on the WINNT, and SYSTEM32 folders? Have you re-set these permissions back to the defaults using FIXACLS.EXE? This util comes with the NT resource kit supplement 4.

The reason I ask this is I had some really weird problems on machines where the deafult permissions on these folders had been altered. Try re-setting these permissions to the defaults.

I hope this helps.
Regards.
Duwane

by duwaned

Oh yes, one more thing... if you decide to reset the permissions by hand, then dont forget to apply these changes to the sub-folders as well using the check box on the permissions screen!

by mark phelan

I cant seen any comment about this,

Have you tried removing physical devices one a t a time, i'e' removing the NIC, Sound Card, Modem etc.

Are these machines using Logitech Input Devices?

I would be interested in seing a full breakdown of the system build, and all attached devices.

by chuckab

No Logitech devices. No modems. Put drive in other identical machine with no change.
I've given up. This problem is over 6 months old.

This discussion is closed to new replies.