Unexpected Shutdown - LSASS.exe ?

[Martyn]

I have a serious problem with both of my Servers.
On occasions (randomly, approx once a week) one of the Servers shuts itself
off, and restarts. No warning, nothing. And with our MRP accounts system in
full swing, and with 80+ people logged on !!!!!

Just twice I've been standing in the Server room and seen the message;

'Windows is shutting down..
Initiated by NT Authority\System
LSASS.EXE terminated unexpectedly with status code -1073741819.
The system will now shut down.

And it did.
Event Log shows that the Shut-down was 'unexpected' !!! (no kidding!)
There is no 'Minidump' folder.

MS Knowledge Base articles 300038, 318650, 289612, 306497, 824226 talk about
this but none of them offer a solution.

I've also had a lot of services stopping, for no apparent reason, mainly
'RPC', 'File Replication', 'MS Firewall', 'Exchange Information Store' and
'Exchange System Attendant'.
I use NOD32 for Anti-Virus and it's fully up to date, and both systems test
clean.

According to Dell Tech Support this seems never to have happened before, but
I've got two Dell (PE4600) Servers that both do it !!

Any help, discussion, ideas at all would be much appreciated.
It would be nice to know I'm not the only person with this problem.

Martyn

 

[Enkidu]

I have a serious problem with both of my Servers.
On occasions (randomly, approx once a week) one of the Servers shuts itself
off, and restarts. No warning, nothing. And with our MRP accounts system in
full swing, and with 80+ people logged on !!!!!

Just twice I've been standing in the Server room and seen the message;

'Windows is shutting down..
Initiated by NT Authority\System
LSASS.EXE terminated unexpectedly with status code -1073741819.
The system will now shut down.

And it did.
Event Log shows that the Shut-down was 'unexpected' !!! (no kidding!)
There is no 'Minidump' folder.

MS Knowledge Base articles 300038, 318650, 289612, 306497, 824226 talk about
this but none of them offer a solution.

I've also had a lot of services stopping, for no apparent reason, mainly
'RPC', 'File Replication', 'MS Firewall', 'Exchange Information Store' and
'Exchange System Attendant'.
I use NOD32 for Anti-Virus and it's fully up to date, and both systems test
clean.

According to Dell Tech Support this seems never to have happened before, but
I've got two Dell (PE4600) Servers that both do it !!

Any help, discussion, ideas at all would be much appreciated.
It would be nice to know I'm not the only person with this problem.

You appear to have the Blaster virus, in spite of your Anti-Virus.
Download the free cleanup utility from Symantec. While you are there
download the Welchia cleanup utility. Run them with the machine
disconnected from the network.

Cheers,

Cliff

 

[Martyn]

You appear to have the Blaster virus, in spite of your Anti-Virus.
Download the free cleanup utility from Symantec. While you are there
download the Welchia cleanup utility. Run them with the machine
disconnected from the network.

Cheers,

Cliff

I've run several Anti-Virus checks, on both Servers, normally have NOD32
running, updating every hour.
Definitely not a virus.
One or other of the Servers now shuts down, about once a week, at random
times of the day or night.
'Exchange System Attendant' service stops, about once a day.

Any clues anybody.

 

[Leif Nilsson]

Hi.
If the server is a DC and are running W2000SP4 I would try KB824226
(replaced by KB828297). Check if you have a Event ID: 1173 in the in the
Directory Services log. If you have that you definitely need the hotfix for
KB828297. We got the same problem after applying SP4, the fix solved
everything.

//Leif

 

[Martyn]

I've already installed 824226 a while ago.
I haven't heard of 828297. Is it different ?
I've not seem Event 1173 though.

I'll look into it now.
thanks.

Martyn

 

[Martyn]

I had tried 824226, and then also 828297, (MS sent them to me) .
That didn't work either.
I'm still getting occasional (randomly, approx once a week) one of the
Servers shuts itself off, and restarts.
I've also had a lot of services stopping, for no apparent reason,
mainly 'RPC', 'File Replication', 'MS Firewall', 'Exchange Information
Store'
but mostly 'Exchange System Attendant'.
It seems that nobody in the world has ever seen this before, and I've got it
happening on BOTH Servers.

Martyn

 

[Marina Roos]

Martyn,

You might have a look at www.jsifaq.com/subh/tip3800/rh3891.htm

Marina

 

[Martyn]

Marina,

This is 'EXACTLY' the error message I'm getting,- on the rare occasions I've
been in the Server room when one of my Servers has decided to reboot itself.
It's not easy to find the 'Replicate Every' setting but I've found it and it
is already set to 180 minutes (the default) on both Servers.
I'm only getting the rebooting on average once a week, not 15 minutes as the
article suggests.
I'm also getting lots of Services stopping, at random, with no obvious
reason.

Martyn
_________________________________________________

 

[Marina Roos]

Hi Martyn,

I haven't checked out that link myself, but does it offer a solution?
Also, spontaneous reboots often point to hardware failure, like motherboard
and memory.

Marina