Lsasrv error 5000 and server restarts every couple of days

Hello,

I have been dealing with the problem for a month now. Our network is a sngle DC with about 15 computers. DHCP, DNS is all on the server. We fixed NTPCLient w32time errors by syncing the server with external time source.

The last server reboot occured on 4/17. The first error in the System Log was a 7pm and 24 seconds.
Event Type:      Error
Event Source:      LsaSrv
Event Category:      Security Package Manager
Event ID:      5000
Date:            4/17/2006
Time:            7:00:24 PM
User:            N/A
Computer:      MUMBAI
Description:
The security package Kerberos generated an exception.  The exception information is the data.

Right before this error, i had a warning:
Event Type:      Warning
Event Source:      LSASRV
Event Category:      SPNEGO (Negotiator)
Event ID:      40968
Date:            4/17/2006
Time:            2:45:35 PM
User:            N/A
Computer:      MUMBAI
Description:
The Security System has received an authentication request that could not be  decoded.  The request has failed.

Then immdiately, I had an error in the APPLICATION LOG

Event Type:      Error
Event Source:      Application Error
Event Category:      (100)
Event ID:      1000
Date:            4/17/2006
Time:            7:00:29 PM
User:            N/A
Computer:      MUMBAI
Description:
Faulting application lsass.exe, version 5.2.3790.0, faulting module ntdll.dll, version 5.2.3790.0, fault address 0x00007933.

Then the winlogon.exe service triggered a restart of the server. Upon reboot, i got LSAShell encoutered an error.

I have no others and the reboot occurs randomly. I have done DCDIAG etc and all tests are passing. I think I have come a long way and a lot of things have been fixed but I just cannot figure out what causes the server to restart. It is random and no errors in any other categories.

I would be very proud if you can figure this out.

   

birenshuklaAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
davino_1Commented:
0
birenshuklaAuthor Commented:
Isnt there a way to fix the problem without hotfixes...This does not seem to be a licensed product.
0
Cloud Class® Course: Ruby Fundamentals

This course will introduce you to Ruby, as well as teach you about classes, methods, variables, data structures, loops, enumerable methods, and finishing touches.

ADExpertCommented:
Hotfixes are a must & sure shot solution. Hotfix cases are treated for free if you call microsoft support. But, you need to have a licensed version for them.

ADExpert
0
birenshuklaAuthor Commented:
there is a workaround mentioned in the fix....can you help me with that..
0
ADExpertCommented:
Please mention which article are you following.

ADExpert
0
birenshuklaAuthor Commented:
I am following the support document from microsoft.

To work around this problem, remove the Deny ACE from the OU.

Please help.
0
ADExpertCommented:
Hi Biren,

I'd be rather grateful, if you could give me the link to the article or KB no.

ADExpert
0
birenshuklaAuthor Commented:
http://support.microsoft.com/?kbid=818080

it has not restarted since the 17th...which is good. but would like your suggestion anyways...

0
birenshuklaAuthor Commented:
it restarted after almost two weeks...this time.. the error in event viewer just before the crash looked liked "bad packet received from 192.168.1.1.(router)...or large packet lenght...something like that. any ideas? this is the longest it has been without restart.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.