Lost Aminin and all accounts

OS is XP Pro SP2, or it was until yesterday. I did a hard shut-down 2 days ago and when I rebooted, I got the Welcome screen with no users listed. Tried to boot into administrator account in safe mode, no go. I get the login screen and when I try to enter Administrator, it gives me "The local policy of this system does not allow you to logon interactively." Okay, so the only way I found to actually access the desktop in any way was to try a repair/reinstall from the CD-ROM. The CD-ROM is SP1. The problem did not go away, however. I can get into the desktop by using the new account formed, but that user still does not show up in User Accounts. If I try to make a new user, I get the error message that the admin group does not exist. So to all intents and purposes, I have no administrator privileges at all, and cannot even standby, only log off, which I won't do because then I wouldn't be able to get back into the files. After a lot of searching, I found this fix and wondered if this might help. Is it even possible to fully lose the Administrator Account? The groups do show up in permissions but I don't know if that is just a fluke and they aren't really there. Could I import a new file frm the CD-ROM, and if so, how and where? Or, since I can get into the previous files, could I copy a file from one profile back into user accounts? Might these instructions work? THis sounds like a possibility of recovering the Administrator account. Right now, the closest thing I have is "Default." No defined value set for that one. SOLUTION 4: Editing the registry to see all accounts This step is optional. Use the following steps to edit the registry to make Windows XP display the Administrator account on the logon (Welcome) screen along with all other accounts that were added: NOTE: Editing the registry in the wrong manner can cause Windows to stop functioning. Be careful when editing the registry and make a backup as shown in the following steps. Click Start, Run, and type regedit into the Open field. Click OK, and then backup the registry: In the Registry Editor, click File, and then Export. Type in a filename that is easy to remember and describes the backup file, like backup. Make sure that All is selected under Export Range, and click OK to save the file to the My Documents folder. In the Registry Editor, click the plus sign (+) next to each item in the following path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Select the UserList key (folder) from the left side of the window. Click Edit, New, and click DWORD Value. Select the new value in the right window and rename the value from New Value #1 to Administrator. Right click on the new Administrator value and select Modify. Type 1 into the value data field and click OK. Click the minus sign (-) next to HKEY_LOCAL_MACHINE in the left window. Close Registry Editor and restart your computer. The logon screen now displays the original Administrator logon with the other logon entries. ———————————————————————————————————————– I hope this is not too confusing. If I export the registry is it like Copy and Paste - I'm not actually moving the registry itself but making a copy, right? I can make a copy but have become fearful of moving files in case I get completely locked up. Thanks for any help you can give me. I don't really want to wipe everything out unless it's the only thing I can do. Oh, and System restore has been broken for a long time now, and Last Good Config didn't work either. Juliane

Hi Juliane,

This is a fairly significant change in the way a machine runs and would ordinarily be accompanied by other indicators/symptoms of system failure or malware infection.
Please describe what you were doing just prior to this condition appearing.

For instance:
Downloading from "____ source"?
Running a particular application?
Installing new Hardware?
Installing/Reinstalling a device driver?
Updating Windows from MS Updates?
_________

I'd need to walk through the suggestions that you've posted once more for verification before recommending or denying those suggestions in your post.

However, before you use such aggressive steps, please try these "known-safe" steps:

Use you XP CD to enter Recovery Console
In Recovery console run CHECKDISK – (type)chkdsk /f /r

The above takes about 20 minutes and displays a running progress.
It does not, however, give a summary log of files repaired.
You would have to watch the progress to determine if items were repaired.

You should repeat the procedure until no files (none) are identified and repaired.
________

Next:
Log into Normal Mode with whatever User Account is available to you.
Run Windows File Protection - System File Checker

Start - Run - (type)sfc /scannow <— notice the space between "c" and "/"
Have your XP CD available since SFC will call for it if it needs to replace any missing or corrupt files.
________

Next:
If you are unable to describe the precipitating event prior to this problem, you'll benefit by running all of your onboard AntiVirus and AntiSpyware utilities
Then run at least one OnLine Malware Scan, for instance:
Panda online scan, here: http://www.pandasoftware.com/products/ActiveScan.htm

Keep us posted with your progress.

Best Regards

Okay. I will try those steps. I did run chkdsk from the recovery console but not more than once. I have run Norton and Adaware - nothing from Norton but Adaware had the Alexa toolbar or whatever - cleaned that out. The actual difficulty began months ago, with a random message at bootup "One of the system's registry files had to be recovered by use of a log file. The recovery was successful." I never found a solution to this. The latest problems happened as my husband was copying files from one external hard disk to another, through Windows. Something hung and I closed down the operation too quickly, probably corrupting a file at that time. The next thing that happened was a message about lsass.exe, and I couldn't access my desktop. It wasn't the sasser worm, though. Axe has helped me through that. And then I tried to access the User Rights permissions and lockd up the computer. That has been a problem since the beginning. So I had to hard shut down and voila! No users! Thanks and i will get back to you later. Juliane

I ran chkdsk from command prompt, because i cannot shut down computer and get back to successful log on. Can I use /x to run the repair function while I am logged on, per the Annoyances book, and if so, how do I return to normal use after the repair is done? I did scannow yesterday and nothing changed. I still see no Administrator accounts in Group settings. I added one to Users, but I don't know how to add that Administrator group back in, or if I even can. The User Policy Assignments section of the registry is what causes lock-up, every time, just by clicking on it. The computer hangs, I have no access to ctrl-alt-del, and then I get a message that my virtual memory is low and windows is increasing the pagefile size. Then it just locks up again, never to emerge into functioning again. Can I copy files from the CD-ROM into my C drive system files? If something is screwed up, can't I just go and get another file somewhere??? Who writes this stuff anyway…grumble, grumble… Juliane

Juliane, I've walked through the "Regedit Fix" that you posted above. It is "safe" and you can give it a try. However, I'm not 100% that it will solve your problem, specifically because I'm thinking that the Registry instructions that are causing you this problem are occurring "earlier" in the sequence. Nevertheless, keep us posted with your progress. It it works, I'll be the first to celebrate your success! In the meantime, I'm researching other possibilities. Best Regards

Are you able to use your Run command line?

Try the reverse of the solution in this linked article:
http://www.mvps.org/marksxp/WindowsXP/welskip.php

Essentially, they are assisting people who want to get rid of the Welcome login screen.

Whereas, you want it back.

Therefore, be sure that there "is" a checkmark in the following line, as displayed in that above link.
"users must enter a username and password to use the computer"

Thanks a lot for helping! I tried to look for some kind of tech guide at the bookstore but nothing addressed what the heck to do when something has wiped out your Administrator group and you can't logon. It sort of sounds like a virus, but nothing turns up on any scan I try. Is there any way to add the Administrator group back in? Is there any way I could have or the computer itself could have erased its own Administrator account? I sure didn't do it on purpose. Does that account still exist somewhere, and if so, can I copy the profile back into user accounts somehow? If I create a group and name it administrator, does it gain rights that way? One thing a book recommended is a way to access the System rights and use that as an account. Evidently there is a program or script to do that. That might at least get me back into Safe mode or a way to re-create the Administrator group and put myself back into it. The only place I see Adminisrator is in the User Profiles section of management when I right-click on C. So perhaps all is not lost, eh? Juliane

What appears in your C:\documents and settings\ Ordinarily, you would see your familiar username accounts.

The Administrator folder is there, as are the other accounts, and almost all of them are duplicated. The users I have created since the problem started are not duplicated, but the basic ones like Default User. I have Default User and Default UserWINXPPRO. I have LocalService and LocalService.NTAUTHORITY. I can add my current account as having authority on these folders, if it will help. How can I copy those back into the groups they belong? I can change the properties of most if not all of these files, and give myself permissions to them, and share them on the computer. Will that help, and if so, how? I'm running Panda ActiveScan and although it's found a small number of spyware apps, I don't think it's going to find a virus/worm. I wish it would! Then there would be a quick fix. Thanks for the help. I really want to crack this, I really do. Juliane p.s. You know, I'm not sure that the Administrator folder is the old one, though, because I created another user called "Administrator," from the instructions I posted previously. I guess I can check when the folder was altered. But anyway, maybe it will work.

If you are able to create New Accounts, and have them "appear" in your Welcome Screen, then you may benefit from simply doing so, and Saving your valuable Documents, tunes, pictures, media, files, etc. to your new account. You may also have to reinstall some of your application software, or change configurations such that they can be operated from your New Account. I realize that the "new account" strategy is "tedious". but if it works for you…….. On the other hand, the 'new account' may be no more available to you during logon, than the old accounts. Are they?

I don't think any new account will show up on the welcome screen, but I'm afraid to try and logoff! My own user name doesn't show up as a user in the management console, so why would it show up on the welcome screen? And when I try to create an account, only the administrator option is clickable, but when I click on next, I get "That group does not exist."

Hi Juliane, You may already have explored this option, but if not, here it is: Right-Click on My Computer - Select - Manage Select - "Local users and groups" Select - Users Double click the User Account that you wish to have available actively Remove - the checkmark/tick in front of the "Account is disabled" item. Remove - the checkmark/tick in front of the "account is locked" item. If any of the other options are presently checkmarked/ticked, please list which ones they are. Best Regards

See, this is where there are NO users listed, and the Groups setting gives back 2 errors and then shows up a few groups, which do not include Administrator, or Power User, or the previous users at all. So I have no users to un-tick or tick. That is what I mean when I say I have no User Accounts, even though I am logged in at the moment as MyName1. Is there a way to re-start the Admin group or get it back? If there is no way to import this, then I am going to have to give up, I guess. I didn't think one could permanently delelte the Admin account let alone the entire group, but somehow my computer has managed it. Whoopee. p.s. I went ahead and added the previous account name, with the value of 1, which means show on welcome screen, but I have no idea of that will work. If I try to add that account name from User Accounts, I do get the message "account already exists." So how to get the Admin group back? p.s.s. I think there is a utility to log on as System. What do you think of that idea?

I've "googled" a bit to try to find a solution to your problem. there are several recommendations for Windows Server 2003 But none for Windows XP. Is your version of XP (Home) or (Pro) I'm afraid that if it is (Home) that your options are even more severely limited. Try reading some of the articles found by googling: Deleted User Account Recover User Account and similar. Sorry that I haven't been any use in solving this. Perhaps a more knowledgeable Member will have a fix. I'll ask around to have others look in on your thread here.

Dough, thanks for your help anyway. I have XP Pro. If I could even find a fix for server 2003 I'd try it with XP and cross my fingers. I'm googling like mad and can't find anyone who cannot at least get into Safe mode and become the administrator. You're really nice to try and help. It may be a lost cause.