Hello, I have a serious problem with our main domaincontroller. We are running on a Windows 2008 on that box. From time to time something happens to the box and noone cant log into their domainaccount. When we try we only get username and password is wrong. When I then try to connect to the server locally i get the following error "LogonUI.exe - Bad Image" with the errortext "C:\Windows\system32\keymgr.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administratotor or the software vendor for support". If i reboot the domaincontroller everything goes back to normal until the error keeps coming every twice a week. best regards Marius

HiI thinkyou can run a disk check (chkdsk) and sfc /scannow to detect and repair damaged system files resolve this issueDeva Try hard to get what u like (or) you will be forced to like what u get"

Hi I thinkyou can run a disk check (chkdsk) and sfc /scannow to detect and repair damaged system files resolve this issue Deva Try hard to get what u like (or) you will be forced to like what u get" Hi Deva, Thanks for the response, but both of these return no problems at all.

Hi Please look in to this article . http://www.sevenforums.com/general-discussion/13957-logonui-exe-bad-image-problem.htmlhttp://social.answers.microsoft.com/Forums/en-US/vistaperformance/thread/19976e43-4e81-4ac7-846c-66c63e5a9d2fDeva -- Don't do what others say - listen to them, but do what you feel good doing.

Hi marius, thanks for posting in windows fourms , i would sense a corruption on the keymgr.dll, but its very early to predict,cant log into their domainaccount, i understand windows domain clients uses cached credentials to login so i guess the users should not have any problem logging on to server ( if this is not happening , then this would be different issue ) secondly , try registering keymgrdll using run.dll32.exe keymgr.dll, KRShowKeyMgr what is the output of control keymgr.dllplease provide the event id on the domain controller. Please perform a clean virus scan on the server.sainath !analyze

Hi Please look in to this article . http://www.sevenforums.com/general-discussion/13957-logonui-exe-bad-image-problem.html http://social.answers.microsoft.com/Forums/en-US/vistaperformance/thread/19976e43-4e81-4ac7-846c-66c63e5a9d2f Deva -- Don't do what others say - listen to them, but do what you feel good doing. Hi Deva, Ive tried both of these without any luck.

Hi marius, thanks for posting in windows fourms , i would sense a corruption on the keymgr.dll, but its very early to predict, cant log into their domainaccount, i understand windows domain clients uses cached credentials to login so i guess the users should not have any problem logging on to server ( if this is not happening , then this would be different issue ) secondly , try registering keymgrdll using run.dll32.exe keymgr.dll, KRShowKeyMgr what is the output of control keymgr.dll please provide the event id on the domain controller. Please perform a clean virus scan on the server. sainath !analyze Hi Sainath, Thanks for the answer. When users log into the domain they get an error that username or password is wrong. I have also tried to register the keymgr.dll as you described today, but I have my doubts that this is the issue. I cant find anything in the eventlogs at the time of the event. It suddenly just wont respond anymore. The output of keymgr.dll show and empty box. The strange thing is that when we implemented a secondary domaincontroller wich replicates from this one, it also replicates the error. So yesterday we had the exact same problem with administrator and users not able to log into domain, or local administrator on the server. This server have been migrated from Windows 2000 server to Windows 2008 as described in Microsofts documentation. Could it have dragged something along the way from the old server? -Marius

I have also recieved a secondary error msg from Windows. LogonUI.exe - Application Error The instruction at 0x7437607e referenced memory at 0x7437607e. The required data was not placed into memory because of an I/O error status of 0xc000000e. Click on OK to terminate the application. This has been seen on both of the servers. And when this comes noone can log into the domain or the server.

Hi MariusThis is a file which is used by your operating system while it shuts your comp down - sounds like it has been corrupted or infected. I thing you have copy OS cd LogonUI (run a find file for logonui) -> replace the application which should be in C:\windows\system resolved this issueLet me know the status of the resultThanks...Deva --Self-trust is the first secret of success.

Hi Marius, I would sense either multiple issues related to the error. One of the issue might be a virus /infected system. The other would be one of the depending component of logonUI.exe has corrupted or missing ( might happen due to several reasons) In order to further troubleshooting the issue you can use start --> run --> msconfig to disable all the 3rd party utilities and then try restarting the system and check for the event. i would like to verfiy the registry keys below HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogonentire winlogon hive needs to be dumped to the text file and paste the output for analysis. More Infowinlogon will create the initial object after login, winlogon uses msgina.dll which is a standard logon box for entering user name and the password. And i dont want to go into depth of architecture which might be a offtrack in the issue.A simple process is winlogon process -->LOGONUI <-->LSA server <--> KDC <--> NETLOGON <-->ADso the above are the majore components invloved.If none of the troubleshooting helped we might need to perform debugging , by collecting relevant logs or we have to perform live debugging. sainath !analyze

any update on this case?Deva --Self-trust is the first secret of success.

any update on this case? Deva --Self-trust is the first secret of success. Hi Deva, Sorry for late answer in this case, but I have been away on vacation. We have also had a case with Microsoft support on this and so far it seems like the issue have been outdated supportpack drivers from HP, network drivers or bios update. The server have ran almost a week without lockdown. So far so good. I will make this answer when the week is over and no error have been seen.