Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

Question

XP doesn't boot to Login screen

by Apr 19, 2013 3:55AM PDT

I have an XP machine on an active directory domain. The box had been working fine until a week ago. Now, when it boots up, it goes to a login screen as if it were not in a domain. You have hit Ctrl-Alt-Del twice to get to the regular domain login screen. At that point you can login and ti works like it always has, with access to all domain resources.

So far I have:
Scanned for Malware
DIsjoined and rejoined the domain
Changed the Computer Name (then disjoined/rejoined the domain)
Confirmed all network settings.

Also checked the registry for Domainlogon which has the domain name. Also under user settings the box for "Require Ctrl-Alt-Del" is checked.

I'm stumped...any ideas??

Discussion is locked

6 Posts
- Collapse + Expand Details
- Collapse -
Answer
I cheat.
by Forum moderator Apr 19, 2013 4:25AM PDT

As the office will never pay for deep forensics we use system restore to when it worked or restore from it's image backup.

Yes, you can google this one for more ideas but I'm guessing your office is like ours and will not allow deep investigations.
Bob

- Collapse -
Answer
I'm googled out
by Apr 19, 2013 6:13AM PDT

I've googled for a week. That's why I bought it here. System restore is a good idea, I can try that.

The fact that I can still get them logged on to domain resources makes this a non-911, so I can take some slack time to try to work on this.

- Collapse -
What registry entry?
by r. proffitt Forum moderator Apr 19, 2013 6:26AM PDT

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
New String Value: DefaultDomainName
Enter your Domain Name

I could guess if the name was Local it may do as noted. But you wrote registry entry "Domainlogon" which isn't what I've used in the past.
Bob

- Collapse -
Answer
REgistry entry
by Apr 20, 2013 1:21AM PDT

The registry enter is in HKLM/Software/Microsoft/Windows NT/Winlogon.

The key is DefaultDomainName and it's value is the name of my domain, as it should be, or so I've read.

- Collapse -
At this point I'm thinking malware.
by r. proffitt Forum moderator Apr 20, 2013 1:29AM PDT

It takes hours to scan for such but if it's not following the policy and settings then malware becomes a real possibility. It was not funny last month to hear a client say it wasn't because "we have Norton."

Grif has a list of tools I use to scan with -> http://forums.cnet.com/7726-6132_102-5098912.html?tag=posts;msg5099421

At the office we don't do that today. I might run RKILL to see if some of the usual rootkits are there but given the time to repair versus the time to reload, we just reload.
Bob

- Collapse -
Answer
Thanks!
by Apr 21, 2013 11:29PM PDT

Yeah, this user is off on Fridays so I usually can use some of that day to work on it. Since she can log in to domain resources, I'd like to figure out what is causing this. I've scanned with Malwarebytes and Tsskiller and it comes up clean. I didn't think about rkill, but I'll try that next!

Back to Windows Legacy OS forum

CNET Forums

Operating Systems
Software
Electronics & Gadgets
Hardware
Tablets & Mobile Devices
General Help
Brand Forums
Roadshow Autos
Off Topic

Other Forums

Forum Info