[Last Call] Learn how to a build a cloud-first strategyRegister Now


Lsass.exe crashing causing Windows Server 2012 r2 to reboot

Posted on 2014-07-17
Medium Priority
Last Modified: 2014-09-08
I have a Windows Server 2012 R2 Standard box that has been acting as my DHCP and print server for over a month with no issue.  A couple days ago I decided to promote it to a domain controller.  My domain is a Windows Server 2003 domain so I was adding to it.  I now have a Windows 2003 & Windows 2012 domain controller.  After I added the 2012 as a DC the server started rebooting about every 15-18 minutes.  Application Event log shows the following events right before the server initiates the reboots.

Event 1000, Application Error
Faulting application name: lsass.exe, version: 6.3.9600.16384, time stamp: 0x5215e25f
Faulting module name: ntdsai.dll, version: 6.3.9600.17194, time stamp: 0x5387fa3d
Exception code: 0xc0000005

Event ID 1015, Wininit
A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000005.  The machine must now be restarted.

I'm also noticing an ASP .Net warning before the Event ID's above pop up.  Here is that info below.

Event ID 1309, ASP.NET 4.0.30319.0
Event code: 3001
Event message: The request has been aborted.
Event time: 7/17/2014 3:17:49 AM
Event time (UTC): 7/17/2014 8:17:49 AM
Event ID: f773e1db474f4e35959ef4471c2b418b
Event sequence: 70
Event occurrence: 14
Event detail code: 0
Application information:
    Application domain: /LM/W3SVC/1985542016/ROOT/SimpleAuthWebService-1-130500578583696351
    Trust level: Full
    Application Virtual Path: /SimpleAuthWebService
    Application Path: C:\Program Files\Update Services\WebServices\SimpleAuthWebService\
    Machine name: BCDC1
Process information:
    Process ID: 3140
    Process name: w3wp.exe
Exception information:
    Exception type: HttpException
    Exception message: Request timed out.

Request information:
    Request URL: http://servername:8530/SimpleAuthWebService/SimpleAuth.asmx 
    Request path: /SimpleAuthWebService/SimpleAuth.asmx
    User host address:
    Is authenticated: False
    Authentication Type:  
    Thread account name: NT AUTHORITY\NETWORK SERVICE
Thread information:
    Thread ID: 17
    Thread account name: NT AUTHORITY\NETWORK SERVICE
    Is impersonating: False
    Stack trace:

I have installed all windows updates as I noticed a lot of chatter regarding hotfixes for this with no resolution.  Server just keeps rebooting.  

Thank you.
Question by:themaids
  • 3
LVL 18

Expert Comment

by:Emmanuel Adebayo
ID: 40202458
Did you have any third party application running on this server, i.e Antivirus etc. This happened to my estate of servers and it was out that the bug in one of the application running on the server and using the lsass address space. I have t get the latest version/build of the application from the vendor. In the interim, the issue was solved by using Last Known Good.


Author Comment

ID: 40202473
I have Antivirus running on it but that's been running on it for a good month now with no issue.  I think it has to be related to the dcpromo I did on it a couple days ago because as soon as I did that it started rebooting itself.

Accepted Solution

themaids earned 0 total points
ID: 40302200
Ended up scrapping the machine and downgrading to Windows 2008 server.  Everything better now.

Author Closing Comment

ID: 40309457
Never got an answer.

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Understanding the various editions available is vital when you decide to purchase Windows Server 2012. You need to have a basic understanding of the features and limitations in each edition in order to make a well-informed decision that best suits y…
OfficeMate Freezes on login or does not load after login credentials are input.
In this Micro Tutorial viewers will learn how to restore their server from Bare Metal Backup image created with Windows Server Backup feature. As an example Windows 2012R2 is used.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
Suggested Courses

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question