Windows 2012 R2 Random Reboots (wininit.exe initiated restart...)

Brought up a couple of virtual DCs, on W2012 St R2.  Used the VMWare customization process (mistake) and noticed the machines were rebooting with this "wininit.exe" message citing "no real good reason".  I thought it was the VMWare network driver or the customization but then brought up a physical (on Proliant DL380 G6) and the same thing happened.  There is no real good info out there on this- so before I "buck up" and call Microsoft I figured I'd try the trusty ole EE. Thoughts?
------------------------------------Event ID 1074  Source: User32--------------

The process wininit.exe has initiated the restart of computer SERVERNAME on behalf of user  for the following reason: No title for this reason could be found
 Reason Code: 0x50006
 Shutdown Type: restart
 Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819.  The system will now shut down and restart.
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

mcburn13Author Commented:
This seems to be related- but I can't find a 2012 R2 version of this hotfix:
Cliff GaliherCommented:
HP does not support 2012 R2 on the DL380 G6, and since it isn't certificate for 2012 R2, I can tell you MS support will pretty much end up telling you the same thing. The architectural changes in storage and networking are the primary culprit and it'd take some firmware changes to resolve the outstanding issues. Since the G6 is officially legacy hardware, I'd not hold my breath for 2012 R2 support to get added.
mcburn13Author Commented:
Well I would say they'd support 2012 R2 on ESX 5.5 which two of my machines are on...I'm guessing whatever the fix is for one will be for the other as it is the same exact symptom.

I am noticing a pattern of access denied messages from machines on a broken trust though- perhaps they are crashing lsass.exe, hmmm.
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

What version of vmware are you using?  We are using ver 5 and have had no problems with 2012 R2 vms rebooting.   We did have a vm NIC issue and are using the vmxnet3 virtual adapter rather than the E1000.  Have you tried that?  I'm assuming you have vmware tools installed.
Do you have a licenses? I remember that Windows Server 2008 R2 used to shutdown after 24 hours due to no license. How quickly does the reboot occur?
mcburn13Author Commented:
Servers are activated- the VMs have the VMtools installed, using the VMware NIC, on ESX 5.5.  As the same thing is happening on a new physical server I don't think the problem is VMware-related.
mcburn13Author Commented:
one other thing I originally thought was WMware related possibly was setting this error close to the reboot error: A TDI filter (\Driver\vnetflt) was detected. This filter has not been certified by Microsoft and may cause system instability.

But again this is happening on a physical so...

not sure if it is related but I am seeing messages like this also close to time of the restart.  Since it is lsass.exe crashing- perhaps somehow these unauthorized machine accounts are overloading this AD service?

The session setup from the computer COMPUTERNAME failed to authenticate. The following error occurred:
Access is denied.
The session setup from computer 'COMPUTERNAME' failed because the security database does not contain a trust account 'COMPUTERNAME$' referenced by the specified computer.
mcburn13Author Commented:
Well it looks like it may be a bug with Microsoft when object auditing is enabled on an R2 domain controller.  There is a patch you have to call them for KB 2914387  (you won't find it at this point have to call)

See the thread here
mcburn13Author Commented:
Looks like they just released the patch yesterday. I'm installing it on one 2012 R2 Dc and will report back as I can usually trigger the reboot by renaming objects a few times.

MS Patch:

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mcburn13Author Commented:
Was a patch that was in the wild and released by Microsoft on 3/10/14
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.