| Event Id | 26 |
| Source | Program Popup |
| Description | Program popup: lsass.exe - System Error : Security Accounts Manager initialization failed because of the following error: Directory Service cannot start. Error Status: 0xc00002e1. Please click OK to shutdown this system and reboot into Directory Services Restore Mode, check the event log for more detailed information. |
| Event Information | According to Microsoft: The situation that is discussed in this article is encountered when Windows 2000-based domain controllers replicate many schema changes (anywhere from hundreds to thousands) while they concurrently reload the schema cache. During this period, critical data may be deleted from the Active Directory database (Ntds.dit) that can make the domain controller unable to function. This situation (which can act like a bug) can occur if strict timing conditions and schema extension size dependencies are favorable. If the domain controller can be restarted and it is functional in Active Directory mode after the replication of schema changes, the domain controller functions properly and is unaffected by the data deletion. In this situation, you can apply the recommendations from the "Preventing Data Deletion in Active Directory" section of this article to these domain controllers. |
| Reference Links | SP2 hotfixes recommended before making schema changes in Active Directory forests |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.