Lsass.exe crashing causing Windows Server 2012 r2 to reboot

Posted on 2014-07-17
Last Modified: 2014-09-08
I have a Windows Server 2012 R2 Standard box that has been acting as my DHCP and print server for over a month with no issue.  A couple days ago I decided to promote it to a domain controller.  My domain is a Windows Server 2003 domain so I was adding to it.  I now have a Windows 2003 & Windows 2012 domain controller.  After I added the 2012 as a DC the server started rebooting about every 15-18 minutes.  Application Event log shows the following events right before the server initiates the reboots.

Event 1000, Application Error
Faulting application name: lsass.exe, version: 6.3.9600.16384, time stamp: 0x5215e25f
Faulting module name: ntdsai.dll, version: 6.3.9600.17194, time stamp: 0x5387fa3d
Exception code: 0xc0000005

Event ID 1015, Wininit
A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000005.  The machine must now be restarted.

I'm also noticing an ASP .Net warning before the Event ID's above pop up.  Here is that info below.

Event ID 1309, ASP.NET 4.0.30319.0
Event code: 3001
Event message: The request has been aborted.
Event time: 7/17/2014 3:17:49 AM
Event time (UTC): 7/17/2014 8:17:49 AM
Event ID: f773e1db474f4e35959ef4471c2b418b
Event sequence: 70
Event occurrence: 14
Event detail code: 0
Application information:
    Application domain: /LM/W3SVC/1985542016/ROOT/SimpleAuthWebService-1-130500578583696351
    Trust level: Full
    Application Virtual Path: /SimpleAuthWebService
    Application Path: C:\Program Files\Update Services\WebServices\SimpleAuthWebService\
    Machine name: BCDC1
Process information:
    Process ID: 3140
    Process name: w3wp.exe
Exception information:
    Exception type: HttpException
    Exception message: Request timed out.

Request information:
    Request URL: http://servername:8530/SimpleAuthWebService/SimpleAuth.asmx
    Request path: /SimpleAuthWebService/SimpleAuth.asmx
    User host address:
    Is authenticated: False
    Authentication Type:  
    Thread account name: NT AUTHORITY\NETWORK SERVICE
Thread information:
    Thread ID: 17
    Thread account name: NT AUTHORITY\NETWORK SERVICE
    Is impersonating: False
    Stack trace:

I have installed all windows updates as I noticed a lot of chatter regarding hotfixes for this with no resolution.  Server just keeps rebooting.  

Thank you.
Question by:themaids
    LVL 16

    Expert Comment

    by:Emmanuel Adebayo
    Did you have any third party application running on this server, i.e Antivirus etc. This happened to my estate of servers and it was out that the bug in one of the application running on the server and using the lsass address space. I have t get the latest version/build of the application from the vendor. In the interim, the issue was solved by using Last Known Good.


    Author Comment

    I have Antivirus running on it but that's been running on it for a good month now with no issue.  I think it has to be related to the dcpromo I did on it a couple days ago because as soon as I did that it started rebooting itself.

    Accepted Solution

    Ended up scrapping the machine and downgrading to Windows 2008 server.  Everything better now.

    Author Closing Comment

    Never got an answer.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Do You Know the 4 Main Threat Actor Types?

    Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

    You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
    The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
    In this Micro Tutorial viewers will learn how to restore single file or folder from Bare Metal backup image of their system. Tutorial shows how to restore files and folders from system backup. Often it is not needed to restore entire system when onl…
    This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    13 Experts available now in Live!

    Get 1:1 Help Now