lsass problem - Win2003 DC

[Tim Kalligonis]

I am having a problem with one of my DCs rebooting every 10 hours
consistantlly. This reboot is caused by the lsass process. The following
information is from the Shutdown log.

'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status
code -1073740972

KB 829993 makes it sound like a memory leak. So I monitored the lsass
process' memory usage over the next 10 hour period and it was a flat line.
It didn't continue to increase like a memory leak. It also is happening
every 10 hours. The increase of memory usage by the lsass process increases
based on the number of authentications that are occuring. It is very hard
for me to believe that the number of authentications have been exactly the
same over the last 4 days that it will fail every 10hr and 1 minute to every
10 hrs. and 2 minutes.

Has anyone also experienced this issue with Win2003 DCs?
If so, what was your resolution?

This issue started on the 18th and nothing has changed on that domain
controller. I did a visual check of the machine and I also know nothing has
change because only two people have access to the domain controllers. Me
and the guy I work with.

Additional information:
Event Type: Error
Event Source: Winlogon
Event Category: None
Event ID: 1015
Date: 4/21/2004
Time: 11:23:57 AM
User: N/A
Computer: ILELMLOG01
Description:
A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status
code c0000354. The machine must now be restarted.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 4/21/2004
Time: 11:23:54 AM
User: N/A
Computer: ILELMLOG01
Description:
Faulting application lsass.exe, version 5.2.3790.0, faulting module
secur32.dll, version 5.2.3790.0, fault address 0x0000674a.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6c 73 61 ure lsa
0018: 73 73 2e 65 78 65 20 35 ss.exe 5
0020: 2e 32 2e 33 37 39 30 2e .2.3790.
0028: 30 20 69 6e 20 73 65 63 0 in sec
0030: 75 72 33 32 2e 64 6c 6c ur32.dll
0038: 20 35 2e 32 2e 33 37 39 5.2.379
0040: 30 2e 30 20 61 74 20 6f 0.0 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 30 36 37 34 61 00674a

 

[JoS]

Hey Tim,

I experienced the same thing and i also monitored lsass over a period of
time and it didn't increase as i would have expected. Nonetheless, the
hotfix for 829993 fixed it (so far).

http://support.microsoft.com/default.aspx?scid=kb;[LN];829993

 

[Tim Kalligonis]

JoS,
How often was this occurring?
Was it happening on just one of your DC's or many?
What is the uptime since you installed the hotfix?

Thanks for your response.
Tim

Hey Tim,

I experienced the same thing and i also monitored lsass over a period of
time and it didn't increase as i would have expected. Nonetheless, the
hotfix for 829993 fixed it (so far).

http://support.microsoft.com/default.aspx?scid=kb;[LN];829993

I am having a problem with one of my DCs rebooting every 10 hours
consistantlly. This reboot is caused by the lsass process. The following
information is from the Shutdown log.

'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status
code -1073740972

KB 829993 makes it sound like a memory leak. So I monitored the lsass
process' memory usage over the next 10 hour period and it was a flat line.
It didn't continue to increase like a memory leak. It also is happening
every 10 hours. The increase of memory usage by the lsass process increases
based on the number of authentications that are occuring. It is very hard
for me to believe that the number of authentications have been exactly the
same over the last 4 days that it will fail every 10hr and 1 minute to every
10 hrs. and 2 minutes.

Has anyone also experienced this issue with Win2003 DCs?
If so, what was your resolution?

This issue started on the 18th and nothing has changed on that domain
controller. I did a visual check of the machine and I also know nothing has
change because only two people have access to the domain controllers. Me
and the guy I work with.

Additional information:
Event Type: Error
Event Source: Winlogon
Event Category: None
Event ID: 1015
Date: 4/21/2004
Time: 11:23:57 AM
User: N/A
Computer: ILELMLOG01
Description:
A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status
code c0000354. The machine must now be restarted.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 4/21/2004
Time: 11:23:54 AM
User: N/A
Computer: ILELMLOG01
Description:
Faulting application lsass.exe, version 5.2.3790.0, faulting module
secur32.dll, version 5.2.3790.0, fault address 0x0000674a.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6c 73 61 ure lsa
0018: 73 73 2e 65 78 65 20 35 ss.exe 5
0020: 2e 32 2e 33 37 39 30 2e .2.3790.
0028: 30 20 69 6e 20 73 65 63 0 in sec
0030: 75 72 33 32 2e 64 6c 6c ur32.dll
0038: 20 35 2e 32 2e 33 37 39 5.2.379
0040: 30 2e 30 20 61 74 20 6f 0.0 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 30 36 37 34 61 00674a

 

[JoS]

see in-line.

How often was this occurring?

happened twice over 24 hours

Was it happening on just one of your DC's or many?

just one win2k3 DC

What is the uptime since you installed the hotfix?

48 hours.

it is a development domain so i took the risk.

Thanks for your response.
Tim

Hey Tim,

I experienced the same thing and i also monitored lsass over a period of
time and it didn't increase as i would have expected. Nonetheless, the
hotfix for 829993 fixed it (so far).

http://support.microsoft.com/default.aspx?scid=kb;[LN];829993

I am having a problem with one of my DCs rebooting every 10 hours
consistantlly. This reboot is caused by the lsass process. The following
information is from the Shutdown log.

'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status
code -1073740972

KB 829993 makes it sound like a memory leak. So I monitored the lsass
process' memory usage over the next 10 hour period and it was a flat line.
It didn't continue to increase like a memory leak. It also is happening
every 10 hours. The increase of memory usage by the lsass process increases
based on the number of authentications that are occuring. It is very hard
for me to believe that the number of authentications have been exactly the
same over the last 4 days that it will fail every 10hr and 1 minute to every
10 hrs. and 2 minutes.

Has anyone also experienced this issue with Win2003 DCs?
If so, what was your resolution?

This issue started on the 18th and nothing has changed on that domain
controller. I did a visual check of the machine and I also know

nothing
has

change because only two people have access to the domain controllers. Me
and the guy I work with.

Additional information:
Event Type: Error
Event Source: Winlogon
Event Category: None
Event ID: 1015
Date: 4/21/2004
Time: 11:23:57 AM
User: N/A
Computer: ILELMLOG01
Description:
A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status
code c0000354. The machine must now be restarted.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 4/21/2004
Time: 11:23:54 AM
User: N/A
Computer: ILELMLOG01
Description:
Faulting application lsass.exe, version 5.2.3790.0, faulting module
secur32.dll, version 5.2.3790.0, fault address 0x0000674a.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6c 73 61 ure lsa
0018: 73 73 2e 65 78 65 20 35 ss.exe 5
0020: 2e 32 2e 33 37 39 30 2e .2.3790.
0028: 30 20 69 6e 20 73 65 63 0 in sec
0030: 75 72 33 32 2e 64 6c 6c ur32.dll
0038: 20 35 2e 32 2e 33 37 39 5.2.379
0040: 30 2e 30 20 61 74 20 6f 0.0 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 30 36 37 34 61 00674a

 

[Tim Kalligonis]

Great, thank you for the information. If it happens to go down again,
please let me know. I'd be curious to see if this really fixed the problem.

Thanks again,
Tim

see in-line.

How often was this occurring?

happened twice over 24 hours

Was it happening on just one of your DC's or many?

just one win2k3 DC

What is the uptime since you installed the hotfix?

48 hours.

it is a development domain so i took the risk.

Thanks for your response.
Tim

Hey Tim,

I experienced the same thing and i also monitored lsass over a period of
time and it didn't increase as i would have expected. Nonetheless, the
hotfix for 829993 fixed it (so far).

http://support.microsoft.com/default.aspx?scid=kb;[LN];829993



I am having a problem with one of my DCs rebooting every 10 hours
consistantlly. This reboot is caused by the lsass process. The following
information is from the Shutdown log.

'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status
code -1073740972

KB 829993 makes it sound like a memory leak. So I monitored the lsass
process' memory usage over the next 10 hour period and it was a flat line.
It didn't continue to increase like a memory leak. It also is happening
every 10 hours. The increase of memory usage by the lsass process
increases
based on the number of authentications that are occuring. It is

very
hard

for me to believe that the number of authentications have been

exactly
the

same over the last 4 days that it will fail every 10hr and 1 minute to
every
10 hrs. and 2 minutes.

Has anyone also experienced this issue with Win2003 DCs?
If so, what was your resolution?

This issue started on the 18th and nothing has changed on that domain
controller. I did a visual check of the machine and I also know nothing
has
change because only two people have access to the domain

controllers.
Me

and the guy I work with.

Additional information:
Event Type: Error
Event Source: Winlogon
Event Category: None
Event ID: 1015
Date: 4/21/2004
Time: 11:23:57 AM
User: N/A
Computer: ILELMLOG01
Description:
A critical system process, C:\WINDOWS\system32\lsass.exe, failed with
status
code c0000354. The machine must now be restarted.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 4/21/2004
Time: 11:23:54 AM
User: N/A
Computer: ILELMLOG01
Description:
Faulting application lsass.exe, version 5.2.3790.0, faulting module
secur32.dll, version 5.2.3790.0, fault address 0x0000674a.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6c 73 61 ure lsa
0018: 73 73 2e 65 78 65 20 35 ss.exe 5
0020: 2e 32 2e 33 37 39 30 2e .2.3790.
0028: 30 20 69 6e 20 73 65 63 0 in sec
0030: 75 72 33 32 2e 64 6c 6c ur32.dll
0038: 20 35 2e 32 2e 33 37 39 5.2.379
0040: 30 2e 30 20 61 74 20 6f 0.0 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 30 36 37 34 61 00674a

 

[JoS]

see in-line.

Great, thank you for the information. If it happens to go down again,
please let me know. I'd be curious to see if this really fixed the

problem.

I will definetly let you know.

Thanks again,
np,

JoS

Tim

see in-line.



happened twice over 24 hours


just one win2k3 DC


48 hours.

it is a development domain so i took the risk.

period

of

time and it didn't increase as i would have expected. Nonetheless, the
hotfix for 829993 fixed it (so far).

http://support.microsoft.com/default.aspx?scid=kb;[LN];829993



I am having a problem with one of my DCs rebooting every 10 hours
consistantlly. This reboot is caused by the lsass process. The
following
information is from the Shutdown log.

'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status
code -1073740972

KB 829993 makes it sound like a memory leak. So I monitored the lsass
process' memory usage over the next 10 hour period and it was a flat
line.
It didn't continue to increase like a memory leak. It also is happening
every 10 hours. The increase of memory usage by the lsass process
increases
based on the number of authentications that are occuring. It is very
hard
for me to believe that the number of authentications have been exactly
the
same over the last 4 days that it will fail every 10hr and 1

minute

to

 

[Guest]

Would the above hotfix related somehow to the win2000 version of the below

http://support.microsoft.com/?id=82829

im having problem win win2k rebooting on few of our dcs, and msft premiere support recommends installing this for win2k...curious if the win2003 patch needs to be installed too..

 

[Josh]

I have had this same problem with one of my clients servers. I never
received any replies on it. I applied the hotfix for the 2003 lsass.exe
memory leak and received the same error the next day. I did find something
the other day when reading through some articles for a 2000 Server and it
pointed back to a corrupt group policy template. I followed the directions
and I have been up two days without errors (hopefully, it stays that way).
Let me know if your problem has gone away.

Josh

Would the above hotfix related somehow to the win2000 version of the below?

http://support.microsoft.com/?id=828297

im having problem win win2k rebooting on few of our dcs, and msft premiere

support recommends installing this for win2k...curious if the win2003 patch
needs to be installed too..