i'm having a dilemma with this lsass.exe or isass.exe, i don't know which one for sure... i'm getting this message... "Isass.exe - System Error" "Directory services could not start because of the following error: There is not enough space on the disk. Error Status: 0xc000007f. Please Click OK to shutdown this system and reboot into Directory Services Restore Mode, check the event log for more detailed information". the main thing is i can't get inside the system even if i switch to safe mode, it's always giving me this message, even command prompt i can't access... please help me with my problem.

THIS IS THE CAUSE
CAUSE
Active Directory cannot start if it runs out of disk space. Windows 2000 attempts to avoid this situation, but it can occur if you ignore warnings about low disk space in the System log or if you run large scripts against Active Directory for mass directory imports.
RESOLUTION
To resolve this issue, use any of the following methods.
Method 1: Clear Space on the Drive
Use this method if you have one drive available and you cannot install additional drives in the server.
Click OK to acknowledge the error message so that the computer will reboot.
At the Boot menu, press F8.
Boot the domain controller into Directory Services Restore mode (Windows 2000 domain controllers only), and log on with the Directory Services Restore mode administrator account and password. (This is the password you assigned during the Dcpromo process).
Locate the drive containing the directory and log files. The directory (Ntds.dit) and log files are located in the \Winnt\Ntds folder on the root drive by default. However, the administrator may have changed their locations during the Dcpromo process.
Free some space on the drive. If there is no space to free, use method 2.
If you can free space on the drive, reboot the computer normally.
Method 2: Move the Database or Log Files
Ntdsutil.exe has an option for moving either the database file or the database log file. This method is ideal when you cannot move data to another drive to free more space. If all drives are at capacity, it may be necessary to install an additional hard disk in the computer.
Boot the domain controller in Directory Services Restore mode and log on with the Directory Services Restore mode administrator account and password (this is the password you assigned during the Dcpromo process).
At a command prompt, type ntdsutil.exe. You receive the following prompt:
ntdsutil:

Type files to receive the following prompt:
file maintenance:

Type info. Note the path of the database and log files.
To move the database, type move db to %s (where %s is the target folder).
To move the log files, type move logs to %s (where %s is the target folder).
Type quit twice to return to the command prompt.
Reboot the computer normally.

i think that's a virus. my friend gets the same error message. been trying to help her out. i also tried running on safemode...i tried everything i could think of! i even created a rescue disk from this freeware antivirus but i guess thier definitions are incomplete or whatever.

there is actually a valid windows process called Lsass.exe. that's with an "L" not an "I". In which case, it's a virus caused by a trojan.

check out the details at:
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.ratsou.b.html

goodluck. tell me how you resolved it so i can help my friend.

Lsass.exe is good - Microsoft component that runs under sertain conditions

Isass.exe is the name of a program installed by a trojan which opens up a backdoor port.

One way to see the difference between lsass.exe and Isass.exe is to click on the "image name" in task manager and see if it it lists with the "L" processes or actually is an I. Changing the default system font also allows you to see the difference between a lower case "L" and an upper case "I" easier.

I was having problems with a different trojan and almost became convinced I had the bad one - I'm glad I checked some more before I deleted the good file.