Link to home
Start Free TrialLog in
Avatar of themaids
themaidsFlag for United States of America

asked on

Lsass.exe crashing causing Windows Server 2012 r2 to reboot

I have a Windows Server 2012 R2 Standard box that has been acting as my DHCP and print server for over a month with no issue.  A couple days ago I decided to promote it to a domain controller.  My domain is a Windows Server 2003 domain so I was adding to it.  I now have a Windows 2003 & Windows 2012 domain controller.  After I added the 2012 as a DC the server started rebooting about every 15-18 minutes.  Application Event log shows the following events right before the server initiates the reboots.

Event 1000, Application Error
Faulting application name: lsass.exe, version: 6.3.9600.16384, time stamp: 0x5215e25f
Faulting module name: ntdsai.dll, version: 6.3.9600.17194, time stamp: 0x5387fa3d
Exception code: 0xc0000005

Event ID 1015, Wininit
A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000005.  The machine must now be restarted.


I'm also noticing an ASP .Net warning before the Event ID's above pop up.  Here is that info below.

Event ID 1309, ASP.NET 4.0.30319.0
Event code: 3001
Event message: The request has been aborted.
Event time: 7/17/2014 3:17:49 AM
Event time (UTC): 7/17/2014 8:17:49 AM
Event ID: f773e1db474f4e35959ef4471c2b418b
Event sequence: 70
Event occurrence: 14
Event detail code: 0
 
Application information:
    Application domain: /LM/W3SVC/1985542016/ROOT/SimpleAuthWebService-1-130500578583696351
    Trust level: Full
    Application Virtual Path: /SimpleAuthWebService
    Application Path: C:\Program Files\Update Services\WebServices\SimpleAuthWebService\
    Machine name: BCDC1
 
Process information:
    Process ID: 3140
    Process name: w3wp.exe
    Account name: NT AUTHORITY\NETWORK SERVICE
 
Exception information:
    Exception type: HttpException
    Exception message: Request timed out.

 
 
Request information:
    Request URL: http://servername:8530/SimpleAuthWebService/SimpleAuth.asmx 
    Request path: /SimpleAuthWebService/SimpleAuth.asmx
    User host address:
    User:  
    Is authenticated: False
    Authentication Type:  
    Thread account name: NT AUTHORITY\NETWORK SERVICE
 
Thread information:
    Thread ID: 17
    Thread account name: NT AUTHORITY\NETWORK SERVICE
    Is impersonating: False
    Stack trace:


I have installed all windows updates as I noticed a lot of chatter regarding hotfixes for this with no resolution.  Server just keeps rebooting.  

Thank you.
Avatar of Emmanuel Adebayo
Emmanuel Adebayo
Flag of United Kingdom of Great Britain and Northern Ireland image

Did you have any third party application running on this server, i.e Antivirus etc. This happened to my estate of servers and it was out that the bug in one of the application running on the server and using the lsass address space. I have t get the latest version/build of the application from the vendor. In the interim, the issue was solved by using Last Known Good.

regards
Avatar of themaids

ASKER

I have Antivirus running on it but that's been running on it for a good month now with no issue.  I think it has to be related to the dcpromo I did on it a couple days ago because as soon as I did that it started rebooting itself.
ASKER CERTIFIED SOLUTION
Avatar of themaids
themaids
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Never got an answer.