Upgrade to XP fails for windows 2000 sp4

Hi,

Change the overwrite behavior. The error occurs because the event log is
full and you are not set to overwrite old events. Run eventvwr.msc, right
click the security log and select properties. Either increase the maximum
size or enable it to overwrite when it has reached the maximum capacity.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP
http://mvp.support.microsoft.com/
Windows help - www.rickrogers.org

"jmp13" <jmp13 DeleteThis @discussions.microsoft.com> wrote in message
news:1028CE02-A7E3-4112-9350-3321DA7ACF7E@microsoft.com...
>I get the blue screen error code c0000244 - security audit won't generate.
> How do you get past this?

I read all those articles. My problem is it is in the middle of the upgrade.
So after the files are copied it reboots to start the install and gets this
errror. I need to know how to fix this via the recovery console or some other
command line tool. I do not have access to Windows GUI.

"Rick "Nutcase" Rogers" wrote:

> Hi,
>
> Change the overwrite behavior. The error occurs because the event log is
> full and you are not set to overwrite old events. Run eventvwr.msc, right
> click the security log and select properties. Either increase the maximum
> size or enable it to overwrite when it has reached the maximum capacity.
>
> --
> Best of Luck,
>
> Rick Rogers, aka "Nutcase" - Microsoft MVP
> http://mvp.support.microsoft.com/
> Windows help - www.rickrogers.org
>
> "jmp13" <jmp13 RemoveThis @discussions.microsoft.com> wrote in message
> news:1028CE02-A7E3-4112-9350-3321DA7ACF7E@microsoft.com...
> >I get the blue screen error code c0000244 - security audit won't generate.
> > How do you get past this?
>
>
>

Have you tried cancelling out of installation during the file copy process?
Tried safe mode with command prompt? I don't know of a way to do this from a
command line tool or the Recovery console, as you are trying to change the
behavior of a program.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP
http://mvp.support.microsoft.com/
Windows help - www.rickrogers.org

"jmp13" <jmp13.TakeThisOut@discussions.microsoft.com> wrote in message
news:DCBA3B66-AE1D-4FC4-8952-239CD1724E3F@microsoft.com...
>I read all those articles. My problem is it is in the middle of the
>upgrade.
> So after the files are copied it reboots to start the install and gets
> this
> errror. I need to know how to fix this via the recovery console or some
> other
> command line tool. I do not have access to Windows GUI.
>
> "Rick "Nutcase" Rogers" wrote:
>
>> Hi,
>>
>> Change the overwrite behavior. The error occurs because the event log is
>> full and you are not set to overwrite old events. Run eventvwr.msc, right
>> click the security log and select properties. Either increase the maximum
>> size or enable it to overwrite when it has reached the maximum capacity.
>>
>> --
>> Best of Luck,
>>
>> Rick Rogers, aka "Nutcase" - Microsoft MVP
>> http://mvp.support.microsoft.com/
>> Windows help - www.rickrogers.org
>>
>> "jmp13" <jmp13.TakeThisOut@discussions.microsoft.com> wrote in message
>> news:1028CE02-A7E3-4112-9350-3321DA7ACF7E@microsoft.com...
>> >I get the blue screen error code c0000244 - security audit won't
>> >generate.
>> > How do you get past this?
>>
>>
>>

I'm past that point. I've already tried the safe mode.

"Rick "Nutcase" Rogers" wrote:

> Have you tried cancelling out of installation during the file copy process?
> Tried safe mode with command prompt? I don't know of a way to do this from a
> command line tool or the Recovery console, as you are trying to change the
> behavior of a program.
>
> --
> Best of Luck,
>
> Rick Rogers, aka "Nutcase" - Microsoft MVP
> http://mvp.support.microsoft.com/
> Windows help - www.rickrogers.org
>
> "jmp13" <jmp13.DeleteThis@discussions.microsoft.com> wrote in message
> news:DCBA3B66-AE1D-4FC4-8952-239CD1724E3F@microsoft.com...
> >I read all those articles. My problem is it is in the middle of the
> >upgrade.
> > So after the files are copied it reboots to start the install and gets
> > this
> > errror. I need to know how to fix this via the recovery console or some
> > other
> > command line tool. I do not have access to Windows GUI.
> >
> > "Rick "Nutcase" Rogers" wrote:
> >
> >> Hi,
> >>
> >> Change the overwrite behavior. The error occurs because the event log is
> >> full and you are not set to overwrite old events. Run eventvwr.msc, right
> >> click the security log and select properties. Either increase the maximum
> >> size or enable it to overwrite when it has reached the maximum capacity.
> >>
> >> --
> >> Best of Luck,
> >>
> >> Rick Rogers, aka "Nutcase" - Microsoft MVP
> >> http://mvp.support.microsoft.com/
> >> Windows help - www.rickrogers.org
> >>
> >> "jmp13" <jmp13.DeleteThis@discussions.microsoft.com> wrote in message
> >> news:1028CE02-A7E3-4112-9350-3321DA7ACF7E@microsoft.com...
> >> >I get the blue screen error code c0000244 - security audit won't
> >> >generate.
> >> > How do you get past this?
> >>
> >>
> >>
>
>
>

I'm pasted that poing. Safe mode does not work.

"Rick "Nutcase" Rogers" wrote:

> Have you tried cancelling out of installation during the file copy process?
> Tried safe mode with command prompt? I don't know of a way to do this from a
> command line tool or the Recovery console, as you are trying to change the
> behavior of a program.
>
> --
> Best of Luck,
>
> Rick Rogers, aka "Nutcase" - Microsoft MVP
> http://mvp.support.microsoft.com/
> Windows help - www.rickrogers.org
>
> "jmp13" <jmp13.RemoveThis@discussions.microsoft.com> wrote in message
> news:DCBA3B66-AE1D-4FC4-8952-239CD1724E3F@microsoft.com...
> >I read all those articles. My problem is it is in the middle of the
> >upgrade.
> > So after the files are copied it reboots to start the install and gets
> > this
> > errror. I need to know how to fix this via the recovery console or some
> > other
> > command line tool. I do not have access to Windows GUI.
> >
> > "Rick "Nutcase" Rogers" wrote:
> >
> >> Hi,
> >>
> >> Change the overwrite behavior. The error occurs because the event log is
> >> full and you are not set to overwrite old events. Run eventvwr.msc, right
> >> click the security log and select properties. Either increase the maximum
> >> size or enable it to overwrite when it has reached the maximum capacity.
> >>
> >> --
> >> Best of Luck,
> >>
> >> Rick Rogers, aka "Nutcase" - Microsoft MVP
> >> http://mvp.support.microsoft.com/
> >> Windows help - www.rickrogers.org
> >>
> >> "jmp13" <jmp13.RemoveThis@discussions.microsoft.com> wrote in message
> >> news:1028CE02-A7E3-4112-9350-3321DA7ACF7E@microsoft.com...
> >> >I get the blue screen error code c0000244 - security audit won't
> >> >generate.
> >> > How do you get past this?
> >>
> >>
> >>
>
>
>

From the Recovery Console issue the disable command:

disable eventlog

That should let you get past the c0000244 error. If it does work you
will find that with the Event Log disabled it will take a bit of time
for the logon window to appear, maybe a minute or two. If it doesn't
work you can enable the service again from the RC by issuing the Enable
command:

enable eventlog service_auto_start

To get a list of services that can be disable or started use the listsvc
command. To get help on any command use the /? switch.

If disabling the event log fails to get you past the error you can slave
the disk in another Windows 2000/XP machine and use regedt32 to remotely
edit:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Add the entry:

Key: CrashOnAuditFail
Type: REG_DWORD
Value: 1

See: http://support.microsoft.com/kb/140058/

The article is for NT3.x 4.0 but it also applies to Windows 2000 and I'm
99.9% sure that it also applies to XP.

John

jmp13 wrote:
> I read all those articles. My problem is it is in the middle of the upgrade.
> So after the files are copied it reboots to start the install and gets this
> errror. I need to know how to fix this via the recovery console or some other
> command line tool. I do not have access to Windows GUI.
>
> "Rick "Nutcase" Rogers" wrote:
>
>
>>Hi,
>>
>>Change the overwrite behavior. The error occurs because the event log is
>>full and you are not set to overwrite old events. Run eventvwr.msc, right
>>click the security log and select properties. Either increase the maximum
>>size or enable it to overwrite when it has reached the maximum capacity.
>>
>>--
>>Best of Luck,
>>
>>Rick Rogers, aka "Nutcase" - Microsoft MVP
>>http://mvp.support.microsoft.com/
>>Windows help - www.rickrogers.org
>>
>>"jmp13" <jmp13.DeleteThis@discussions.microsoft.com> wrote in message
>>news:1028CE02-A7E3-4112-9350-3321DA7ACF7E@microsoft.com...
>>
>>>I get the blue screen error code c0000244 - security audit won't generate.
>>>How do you get past this?
>>
>>
>>

The first option does not work. I already tried it. I will try the second
option.

"John John" wrote:

> From the Recovery Console issue the disable command:
>
> disable eventlog
>
> That should let you get past the c0000244 error. If it does work you
> will find that with the Event Log disabled it will take a bit of time
> for the logon window to appear, maybe a minute or two. If it doesn't
> work you can enable the service again from the RC by issuing the Enable
> command:
>
> enable eventlog service_auto_start
>
> To get a list of services that can be disable or started use the listsvc
> command. To get help on any command use the /? switch.
>
> If disabling the event log fails to get you past the error you can slave
> the disk in another Windows 2000/XP machine and use regedt32 to remotely
> edit:
>
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
>
> Add the entry:
>
> Key: CrashOnAuditFail
> Type: REG_DWORD
> Value: 1
>
> See: http://support.microsoft.com/kb/140058/
>
> The article is for NT3.x 4.0 but it also applies to Windows 2000 and I'm
> 99.9% sure that it also applies to XP.
>
> John
>
> jmp13 wrote:
> > I read all those articles. My problem is it is in the middle of the upgrade.
> > So after the files are copied it reboots to start the install and gets this
> > errror. I need to know how to fix this via the recovery console or some other
> > command line tool. I do not have access to Windows GUI.
> >
> > "Rick "Nutcase" Rogers" wrote:
> >
> >
> >>Hi,
> >>
> >>Change the overwrite behavior. The error occurs because the event log is
> >>full and you are not set to overwrite old events. Run eventvwr.msc, right
> >>click the security log and select properties. Either increase the maximum
> >>size or enable it to overwrite when it has reached the maximum capacity.
> >>
> >>--
> >>Best of Luck,
> >>
> >>Rick Rogers, aka "Nutcase" - Microsoft MVP
> >>http://mvp.support.microsoft.com/
> >>Windows help - www.rickrogers.org
> >>
> >>"jmp13" <jmp13 DeleteThis @discussions.microsoft.com> wrote in message
> >>news:1028CE02-A7E3-4112-9350-3321DA7ACF7E@microsoft.com...
> >>
> >>>I get the blue screen error code c0000244 - security audit won't generate.
> >>>How do you get past this?
> >>
> >>
> >>
>

How do you connect to the registry on the slave drive? Regedt32 is looking
for computer names.

"jmp13" wrote:

> The first option does not work. I already tried it. I will try the second
> option.
>
> "John John" wrote:
>
> > From the Recovery Console issue the disable command:
> >
> > disable eventlog
> >
> > That should let you get past the c0000244 error. If it does work you
> > will find that with the Event Log disabled it will take a bit of time
> > for the logon window to appear, maybe a minute or two. If it doesn't
> > work you can enable the service again from the RC by issuing the Enable
> > command:
> >
> > enable eventlog service_auto_start
> >
> > To get a list of services that can be disable or started use the listsvc
> > command. To get help on any command use the /? switch.
> >
> > If disabling the event log fails to get you past the error you can slave
> > the disk in another Windows 2000/XP machine and use regedt32 to remotely
> > edit:
> >
> > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
> >
> > Add the entry:
> >
> > Key: CrashOnAuditFail
> > Type: REG_DWORD
> > Value: 1
> >
> > See: http://support.microsoft.com/kb/140058/
> >
> > The article is for NT3.x 4.0 but it also applies to Windows 2000 and I'm
> > 99.9% sure that it also applies to XP.
> >
> > John
> >
> > jmp13 wrote:
> > > I read all those articles. My problem is it is in the middle of the upgrade.
> > > So after the files are copied it reboots to start the install and gets this
> > > errror. I need to know how to fix this via the recovery console or some other
> > > command line tool. I do not have access to Windows GUI.
> > >
> > > "Rick "Nutcase" Rogers" wrote:
> > >
> > >
> > >>Hi,
> > >>
> > >>Change the overwrite behavior. The error occurs because the event log is
> > >>full and you are not set to overwrite old events. Run eventvwr.msc, right
> > >>click the security log and select properties. Either increase the maximum
> > >>size or enable it to overwrite when it has reached the maximum capacity.
> > >>
> > >>--
> > >>Best of Luck,
> > >>
> > >>Rick Rogers, aka "Nutcase" - Microsoft MVP
> > >>http://mvp.support.microsoft.com/
> > >>Windows help - www.rickrogers.org
> > >>
> > >>"jmp13" <jmp13 RemoveThis @discussions.microsoft.com> wrote in message
> > >>news:1028CE02-A7E3-4112-9350-3321DA7ACF7E@microsoft.com...
> > >>
> > >>>I get the blue screen error code c0000244 - security audit won't generate.
> > >>>How do you get past this?
> > >>
> > >>
> > >>
> >

In article <158C5D41-B5A6-491E-BB10-31DD17CFB183 DeleteThis @microsoft.com>, jmp13
@discussions.microsoft.com, jmp13 says...

> The first option does not work. I already tried it. I will try the second
> option.

Why don't you just wipe it out and start clean?
--
************************************************
The Tobes of Hades, lit by flickering torchlight
The netherworld is gathered in the glare
Prince By-Tor takes the cavern to the north light
The sign of Eth is rising in the air.
By-Tor, knight of darkness,
Centurion of evil, devil's prince.

You are going to use the "Load Hive" function in the Registry menu.

1- First bring forth and highlight the current HKEY_LOCAL_MACHINE hive.

2- Now from the Registry menu select "Load Hive". Navigate to the
broken installation registry in the inactive installation. The hive
will be in the %systemroot%\system32\config folder. The hive you want
to load is the SYSTEM hive (without an extension).

3- You will be asked to give the hive/key a temporary name, you can
call it anything you want, like xyz for example.

4- Now you will see the xyz key in the hklm tree structure. Double
click and edit the necessary key. You will not see a
"CurrentControlSet" when you edit an offline registry. To determine
which one of the ControlSet00n will load when you boot the installation
go to the "Select" key (in the xyz hive) and note the reference number
in the Default: REG_DWORD, then edit the corresponding ControlSet. If
the Default: REG_DWORD is "0x1" then edit CurrentControlSet001.

5- When you are done highlight the xyz key and in the Registry menu
select "Unload Hive".

6- Exit Regedt32.

7- Keep your fingers crossed and hope it works!

Good luck!

John


jmp13 wrote:
> How do you connect to the registry on the slave drive? Regedt32 is looking
> for computer names.
>
> "jmp13" wrote:
>
>
>>The first option does not work. I already tried it. I will try the second
>>option.
>>
>>"John John" wrote:
>>
>>
>>> From the Recovery Console issue the disable command:
>>>
>>>disable eventlog
>>>
>>>That should let you get past the c0000244 error. If it does work you
>>>will find that with the Event Log disabled it will take a bit of time
>>>for the logon window to appear, maybe a minute or two. If it doesn't
>>>work you can enable the service again from the RC by issuing the Enable
>>>command:
>>>
>>>enable eventlog service_auto_start
>>>
>>>To get a list of services that can be disable or started use the listsvc
>>>command. To get help on any command use the /? switch.
>>>
>>>If disabling the event log fails to get you past the error you can slave
>>>the disk in another Windows 2000/XP machine and use regedt32 to remotely
>>>edit:
>>>
>>>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
>>>
>>>Add the entry:
>>>
>>>Key: CrashOnAuditFail
>>>Type: REG_DWORD
>>>Value: 1
>>>
>>>See: http://support.microsoft.com/kb/140058/
>>>
>>>The article is for NT3.x 4.0 but it also applies to Windows 2000 and I'm
>>>99.9% sure that it also applies to XP.
>>>
>>>John
>>>
>>>jmp13 wrote:
>>>
>>>>I read all those articles. My problem is it is in the middle of the upgrade.
>>>>So after the files are copied it reboots to start the install and gets this
>>>>errror. I need to know how to fix this via the recovery console or some other
>>>>command line tool. I do not have access to Windows GUI.
>>>>
>>>>"Rick "Nutcase" Rogers" wrote:
>>>>
>>>>
>>>>
>>>>>Hi,
>>>>>
>>>>>Change the overwrite behavior. The error occurs because the event log is
>>>>>full and you are not set to overwrite old events. Run eventvwr.msc, right
>>>>>click the security log and select properties. Either increase the maximum
>>>>>size or enable it to overwrite when it has reached the maximum capacity.
>>>>>
>>>>>--
>>>>>Best of Luck,
>>>>>
>>>>>Rick Rogers, aka "Nutcase" - Microsoft MVP
>>>>>http://mvp.support.microsoft.com/
>>>>>Windows help - www.rickrogers.org
>>>>>
>>>>>"jmp13" <jmp13.RemoveThis@discussions.microsoft.com> wrote in message
>>>>>news:1028CE02-A7E3-4112-9350-3321DA7ACF7E@microsoft.com...
>>>>>
>>>>>
>>>>>>I get the blue screen error code c0000244 - security audit won't generate.
>>>>>>How do you get past this?
>>>>>
>>>>>
>>>>>