Lsass problem, not sasser?

[Quaestor]

Lsass.ese shutdown problem, not sasser worm?

I'm running w2k sp 4 with all relevant patchs.

The last few days I have had surprise 60 second shutdowns with lsass
giving code 128, one a day until now, then today two in rapid
succession. Some are while doing something, others while machine has
been idle for a while (no screensaver, no power off modes). I see no
unusual process running, and AVAST, SpybotSD And AdAware find nothing.
The MS malicious software removal tool finds nothing. I'm set for
single user, no login (or is that auto-login?). Cable connection. It
has not happened while not connected to net.

 

[Danny Sanders]

I had the exact same symptoms starting last week and it has ended today. I'm
not sure what is causing it, but I'm running Win 2k3 with Exchange on the
same server. The *only* things that have changed is that when this started
the license for Mail security for Exchange (Symantec) had expired and the
trialware version of Premium Anti Spam licenses had expired. I'm not 100%
sure that the Lsass errors started the same time these licenses expired, it
could have been a little after they expired or a little before. To be
totally honest I'm not sure this had *anything* to do with this at all. I'm
just reporting what was happening here in hopes it rings a bell with
something on your network. Last night I completed renewing these licenses
and installing them. This Morning when I came in the server had restarted
*once* (I can tell because Win 2k3 will want to "send an error report" to MS
for each unexpected shut down and I only got one of these requests)

But when I logged back into the server this morning I saw a message about
the security log being full and only an admin can log in to fix the issue
with the security log. Changing it to overwrite as necessary fixed this.
This leads me to believe that last night's restart was related to the
Security log not the Lsass issue. Until today my Exchange server would
reboot at least twice a day. Other than this mornings reboot (for the full
security log) it has not rebooted once today.

I'm not sure what was/is going on but those are the circumstances
surrounding the start and end (I hope) of this Lsass rebooting issue.

hth
DDS W 2k MVP MCSE