You are currently offline, waiting for your internet to reconnect

Repairing Windows NT After the Application of Service Pack 3

This article was previously published under Q146887
The following are recommended recovery options for Windows NT 4.0 computerswith Service Pack 3 installed:
  • Run an Emergency Repair with an Emergency Repair Disk that was created after installing Service Pack 3
  • Use the Uninstall feature available in the Update.exe in the Service Pack
  • Run an Emergency Repair with the Repair folder on the boot drive
The following methods can be modified to repair an installation:
  • Upgrade of Windows NT 4.0 over Windows NT 4.0 with Service Pack 3 installed. For example, when the system restarts after the text-mode portion of Setup is complete, choose the Upgrade option rather than the New or Repair options.
  • Emergency Repair using an Emergency Repair Disk created prior to Service Pack 3.
Due to changes in the Registry Security Hive, the Samsrv.dll, Samlib.dll,and Winlogon.exe have changed and previous versions of these files cannotaccess Windows NT system security information. If pre-Service Pack 3versions of these files are present, you receive a stop screen with thestop code 0xC00000DF. (IE: The specified domain name does not exist)

Using an ERD Created After Installing the Service Pack

Windows NT 4.0 Service Pack 3 contains a modified Setup.log file that letsyou recover a Windows NT Server or Workstation installation after softwarefailure. If the system is in an unbootable state, you must use an EmergencyRepair Disk created after installing Service Pack 3 with the RDISK command.For more information, please see the following article(s) in the MicrosoftKnowledge Base:
ARTICLE-ID: 156328
TITLE : Description of Windows NT Emergency Repair Disk

NOTE: To use the Emergency Repair Disk utility, you must have the updatedversion of Setupdd.sys. The updated version is contained in Service Pack 2(as well as this Service Pack.) To update your version of Setupdd.sys, youmust copy Setupdd.sys from the Service Pack to your installation disk 2.This replaces the previous version of Setupdd.sys with the updated version.For more information, please see the following article(s) in the MicrosoftKnowledge Base:
ARTICLE-ID: 168015
TITLE : Files Not Replaced When Running Emergency Repair

Repairing the Windows NT installation using this disk recovers the systemto a NO SERVICE PACK installation.

This ensures recoverability for users where the system has become unstableafter the application of the Service Pack. If a Service Pack is required,it must be reapplied when the Emergency Repair is completed and the systemhas rebooted.

This method should only be used if the system is in an unbootable state.The following Service Pack 3 files remain after the system has beenreturned to a basic Windows NT 4.0 state so that Windows NT can read andutilize the new Security hives:

Uninstalling the Service Pack

If an administrator can log onto the computer and run an application, thenrerun the Service Pack Update utility and uninstall the Service Pack. Thisis always the preferred method of recovery. When using the uninstallfeature, the computer is restored to the system configuration as it wasdirectly before applying the Service Pack. If the computer hangs duringstartup, this is not a viable option.

Repairing the System Files and the System and Security Hives

If the computer is unbootable and there is a pre-Service Pack 3 EmergencyRepair Disk, you must choose to repair the system files and the System andSecurity hives. An alternative method is to use the Repair folder byrunning Emergency Repair and selecting the option for no Emergency RepairDisk. If RDISK has not been run after the application of Service Pack 3,you must choose to repair the System and Security hives or follow theprocedure outlined below in order to alter the Setup.log file:

Modify the contents of the Emergency Repair Disk (ERD) by doing thefollowing:
  1. Remove the attributes from the Setup.log file by typing the following at the command prompt:

    attrib -r -h -s a:\SETUP.LOG
  2. Add the following lines under the [Files.WinNt] section of the Setup.log file:

    \Winnt\System32\Samsrv.dll = "samsrv.dll","30fde","\","nt40 repair disk","samsrv.dll"
    \Winnt\System32\Samlib.dll = "samlib.dll","18010","\","nt40 repair disk","samlib.dll"
    \Winnt\System32\Winlogon.exe = "winlogon.exe","2d0bb","\","nt40 repair disk","winlogon.exe"

    NOTE: \Winnt represents the folder where Windows NT is installed.
  3. Copy Samsrv.dll, Samlib.dll, and Winlogon.exe from the Windows NT 4.0 Service Pack 3 media to the root folder of the Emergency Repair Disk.
  4. Restart your computer with the three Windows NT 4.0 Setup disks.
  5. Select "R" to Repair your Windows NT installation.
  6. Select "Verify Windows NT System Files" and continue.
  7. If prompted to insert Windows NT setup disk 4, press ESC to continue with the Repair process.
  8. After you replace Samsrv.dll, Samlib.dll, and Winlogon.exe with the files from Windows NT 4.0 Service Pack 3, press F3 to exit Repair.
  9. Reboot the computer and restart Windows NT.

"Upgrading" Windows NT 4.0 Over Windows NT 4.0 with Service Pack

If the computer is unable to boot and the repair process fails or you donot have an Emergency Repair Disk or a CD-ROM drive, you must perform anupgrade of Windows NT 4.0 over Windows NT 4.0 Service Pack 3. Please followthese steps to do this:
  1. Copy the i386 folder from the original Windows NT 4.0 CD-ROM to the hard disk of the target system if FAT, or to a network share if NTFS. In this folder, rename the following files. Copy these same three files to the I386 directory from the Service Pack 3 source. The goal is for the upgrade to be done using these 3 files from Service Pack 3.

    Samsrv.dl_ to
    Samlib.dl_ to
    Winlogon.ex_ to
  2. Choose the correct procedure below based on your file system:
    • If the file system is FAT and the i386 folder is on the local hard disk, perform the following steps:
      1. Boot to MS-DOS and run WINNT /B from the i386 folder.
      2. Choose the Upgrade option during the on the first boot into GUI mode.
    • If the install source location is remote and the local file system is FAT, you must either install Windows with networking enabled, or create an installation boot disk off the Windows NT Server CD-ROM, connect to the modified i386 folder, and then run WINNT /B.
    • If the file system is NTFS, you must create a parallel install in a new folder and then run WINNT32 /B from the modified i386 folder.
When the Samsrv.dll, Samlib.dll, and Winlogon.exe files do not match duringlogon, users receive a stop screen with the stop code 0xC00000DF. This canbe seen after you upgrade Windows NT 4.0 over Windows NT 4.0 Service Pack 3or if the System and Security hives were not repaired when using anEmergency Repair Disk created prior to the application of Service Pack 3.In order to repair installations in this state, please see the followingarticle(s) in the Microsoft Knowledge Base:
ARTICLE-ID: 164471
TITLE : Replacing System Files Using a Modified Emergency Repair Disk
prodnt recovery trap C00000DF ntfaqset

Article ID: 146887 - Last Review: 10/31/2006 19:18:48 - Revision: 1.1

  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Server 4.0 Standard Edition
  • kbinfo kbsetup KB146887