Error Message: Stop 0xC0000244 Unable to Generate Security Events (314358)


The information in this article applies to:

  • Microsoft Windows XP Professional
This article was previously published under Q314358
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SYMPTOMS

During the graphical user interface (GUI) portion of an upgrade from Microsoft Windows 2000 Professional to Windows XP, you may receive the following error message on a blue screen:
Stop 0xC0000244 Unable to generate security events.

CAUSE

This problem may occur if the "Shutdown system immediately if unable to generate security audits" policy in Windows 2000 Professional is enabled and you have some events (such as logon events, and system events) set to audit. Note that this problem is more likely to occur if the security log is full and is set not to overwrite events.

RESOLUTION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To resolve this problem:
  1. Create a parallel installation of Windows XP. To do so, install Windows XP to a different hard disk or to a different folder than the hard disk or folder in which your current (halted) upgrade installation is located. Alternatively, if you have another computer that is running Windows XP, you could temporarily install the hard disk in the other computer.
  2. After you complete the parallel installation, start Registry Editor.
  3. Click HKEY_LOCAL_MACHINE, and then click Load Hive on the File menu.
  4. View original installation folder\System32\Config.
  5. Open the "system" registry hive.
  6. When you are prompted for a name, type Alternate. Note that this name is just the name that is displayed while the registry hive is loaded.
  7. View the following location in the loaded registry hive:

    HKEY_LOCAL_MACHINE\Alternate\ControlSet001\Control\Lsa

  8. Double-click the CrashOnAuditFail subkey in the right-side pane to edit it.
  9. Change the value from 1 to 0, and then click OK.
  10. Click HKEY_LOCAL_MACHINE\Alternate, and then click Unload Hive on the File menu. Note that if this procedure does not resolve the issue and there are multiple ControlSet keys (such as ControlSet002, ControlSet003, and so on), you may need to repeat the preceding steps in the other controlsets.
  11. Reboot your computer, and then continue the upgrade process.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.
Modification Type:MinorLast Reviewed:7/14/2003
Keywords:kbenv kberrmsg kbprb kbsetup KB314358
©2003 Microsoft Corporation. All rights reserved.