themaids
asked on
Lsass.exe crashing causing Windows Server 2012 r2 to reboot
I have a Windows Server 2012 R2 Standard box that has been acting as my DHCP and print server for over a month with no issue. A couple days ago I decided to promote it to a domain controller. My domain is a Windows Server 2003 domain so I was adding to it. I now have a Windows 2003 & Windows 2012 domain controller. After I added the 2012 as a DC the server started rebooting about every 15-18 minutes. Application Event log shows the following events right before the server initiates the reboots.
Event 1000, Application Error
Faulting application name: lsass.exe, version: 6.3.9600.16384, time stamp: 0x5215e25f
Faulting module name: ntdsai.dll, version: 6.3.9600.17194, time stamp: 0x5387fa3d
Exception code: 0xc0000005
Event ID 1015, Wininit
A critical system process, C:\Windows\system32\lsass. exe, failed with status code c0000005. The machine must now be restarted.
I'm also noticing an ASP .Net warning before the Event ID's above pop up. Here is that info below.
Event ID 1309, ASP.NET 4.0.30319.0
Event code: 3001
Event message: The request has been aborted.
Event time: 7/17/2014 3:17:49 AM
Event time (UTC): 7/17/2014 8:17:49 AM
Event ID: f773e1db474f4e35959ef4471c 2b418b
Event sequence: 70
Event occurrence: 14
Event detail code: 0
Application information:
Application domain: /LM/W3SVC/1985542016/ROOT/ SimpleAuth WebService -1-1305005 7858369635 1
Trust level: Full
Application Virtual Path: /SimpleAuthWebService
Application Path: C:\Program Files\Update Services\WebServices\Simpl eAuthWebSe rvice\
Machine name: BCDC1
Process information:
Process ID: 3140
Process name: w3wp.exe
Account name: NT AUTHORITY\NETWORK SERVICE
Exception information:
Exception type: HttpException
Exception message: Request timed out.
Request information:
Request URL: http://servername:8530/SimpleAuthWebService/SimpleAuth.asmx
Request path: /SimpleAuthWebService/Simp leAuth.asm x
User host address:
User:
Is authenticated: False
Authentication Type:
Thread account name: NT AUTHORITY\NETWORK SERVICE
Thread information:
Thread ID: 17
Thread account name: NT AUTHORITY\NETWORK SERVICE
Is impersonating: False
Stack trace:
I have installed all windows updates as I noticed a lot of chatter regarding hotfixes for this with no resolution. Server just keeps rebooting.
Thank you.
Event 1000, Application Error
Faulting application name: lsass.exe, version: 6.3.9600.16384, time stamp: 0x5215e25f
Faulting module name: ntdsai.dll, version: 6.3.9600.17194, time stamp: 0x5387fa3d
Exception code: 0xc0000005
Event ID 1015, Wininit
A critical system process, C:\Windows\system32\lsass.
I'm also noticing an ASP .Net warning before the Event ID's above pop up. Here is that info below.
Event ID 1309, ASP.NET 4.0.30319.0
Event code: 3001
Event message: The request has been aborted.
Event time: 7/17/2014 3:17:49 AM
Event time (UTC): 7/17/2014 8:17:49 AM
Event ID: f773e1db474f4e35959ef4471c
Event sequence: 70
Event occurrence: 14
Event detail code: 0
Application information:
Application domain: /LM/W3SVC/1985542016/ROOT/
Trust level: Full
Application Virtual Path: /SimpleAuthWebService
Application Path: C:\Program Files\Update Services\WebServices\Simpl
Machine name: BCDC1
Process information:
Process ID: 3140
Process name: w3wp.exe
Account name: NT AUTHORITY\NETWORK SERVICE
Exception information:
Exception type: HttpException
Exception message: Request timed out.
Request information:
Request URL: http://servername:8530/SimpleAuthWebService/SimpleAuth.asmx
Request path: /SimpleAuthWebService/Simp
User host address:
User:
Is authenticated: False
Authentication Type:
Thread account name: NT AUTHORITY\NETWORK SERVICE
Thread information:
Thread ID: 17
Thread account name: NT AUTHORITY\NETWORK SERVICE
Is impersonating: False
Stack trace:
I have installed all windows updates as I noticed a lot of chatter regarding hotfixes for this with no resolution. Server just keeps rebooting.
Thank you.
ASKER
I have Antivirus running on it but that's been running on it for a good month now with no issue. I think it has to be related to the dcpromo I did on it a couple days ago because as soon as I did that it started rebooting itself.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Never got an answer.
regards