Solved

LSASS.exe Group Policy Conflict

Posted on 2010-09-02
7
1,011 Views
Last Modified: 2012-05-10
I am experiencing a and issue with Group Policy that is causing LSASS.exe to crash on workstations. I know it is a GP conflict causing access denied errors to ntdll, kerberos and so forth. My question is does anyone have any suggestions as to troubleshooting my actual GP's. Does anyone know what access / permissions are needed for users / machines to utilize lsass.exe?
0
Comment
Question by:slipservice
  • 4
  • 3
7 Comments
 
LVL 2

Expert Comment

by:dehcbad25
ID: 33588664
LSASS is the Local Security Authority Subsystem Service. If it crashes the computer will restart. I seriously doubt that a GP will cause problems with LSASS, but f you want to troubleshoot it from that end run a report on the settings for the policy in question, print it (or save to PDF), then run a Resultant Set of policy and also save it.
After you have documented the offending policy, create a blank policy and apply it to 1 computer (so you can focus on getting one working), and test it. It should not crash LSASS, if it still crashes, then it is not your GP.
You can run a RSoP with the blank GP to make sure no other GP are being applied.
Right now if we assume a GP is crashing your GP, the only area I think could be responsible would be "Account Policies" in the "Security Settings" section., but a blank GP would fix that.
LSASS crashes are usually linked to malware. Have you run a malware scan? try with Malaware-Bytes Anti-Malware, and then run a deep anti virus scan
0
 
LVL 1

Author Comment

by:slipservice
ID: 33588888
Absolutely Clean. I believe it to be GP because the crash dumps show access denied.
0
 
LVL 2

Expert Comment

by:dehcbad25
ID: 33589339
does it happen on Safe Mode?
lsass is opened by the service Security Accounts Manager. Local System should be the account that runs it, and it should be automatic. Lsass enforces the policies, so it makes no sense to think that lsass is crashing because of a policy.
The file is located at C:\Windows\system32\lsass.exe
permissions should be
System, Administrators, Users R&E
TrustedInstaller Full Control
And there are no special permissions set (and it is not inherited). The owner would be TrustedINstaller.
This I am all readying in a Windows 7 PC.
There has been a patch for lsass on XP
http://www.microsoft.com/downloads/details.aspx?FamilyId=3549EA9E-DA3F-43B9-A4F1-AF243B6168F3&displaylang=en
(this will also reset the permissions to default)
Did you try using a clean GP to see what happens?
0
Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

 
LVL 1

Author Comment

by:slipservice
ID: 33589440
I will check the permissions and see if we have the hotfix applied. I really appreciate the info. i think we are on to something here.

0
 
LVL 1

Author Comment

by:slipservice
ID: 33649587
We have several domain controllers on the network and some of them havent fully replicated GP, we are forcing replication and will have to start from there. The way it is now there is no baseline to work from. Not sure why they havent replicated.
0
 
LVL 2

Accepted Solution

by:
dehcbad25 earned 500 total points
ID: 33663603
not having replication for the group policies seem to be the biggest problem then. Run a report so you can see all the settings (using GPMC) and see what it could be causing problems.
Has any of the DC been off for a long time or were imaged/converted to Virtual?
0
 
LVL 1

Author Closing Comment

by:slipservice
ID: 34394226
Once we established that the other DCs should replicate from the PDC we forced replication and forced gp update on the PC side. The error seems to be resolved, we will be monitoring.
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Starting in Windows Server 2008, Microsoft introduced the Group Policy Central Store. This automatically replicating location allows IT administrators to have the latest and greatest Group Policy (GP) configuration settings available. Let’s expl…
Mapping Drives using Group policy preferences Are you still using old scripts to map your network drives if so this article will show you how to get away for old scripts and move toward Group Policy Preference for mapping them. First things f…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now