| Author | Messages | |
Saswati
Posts:6
 | | 06/05/2010 8:12 PM |
| Hi Gurus,
One of the domain controller is automatically rebooted occasionally and following error code is generated.
I have tried googling on this but did not get any satisfactory ideas.
DC is Win 2003 & 64 bit and fully patched.
**********************************
The process winlogon.exe has initiated the restart of computer XYZ-DC02 on behalf of user for the following reason: No title for this reason could be found Reason Code: 0x50006 Shutdown Type: restart
Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code -1073741819. The system will now shut down and restart.
Faulting application lsass.exe, version 5.2.3790.1830, faulting module ntdsa.dll, version 5.2.3790.4568, fault address 0x00000000000081fc.
********************
Logs:-
Event Type: Error
Event Source: Winlogon
Event Category: None
Event ID: 1015
Date: 5/30/2010
Time: 4:34:32 AM
User: N/A
Computer: XYZ-DC02
Description:
A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.
*****************************
Please help me with some advice.
Regards,
Saswati
| | | |
| RickSheikh
Posts:296
| | 06/05/2010 8:40 PM |
| Memory dumps' analysis with windows debugging tool may be helpful.
On 6/5/10, Mahajan, Saswati <saswati.mahajan@hp.com> wrote:
> Hi Gurus,
>
>
>
> One of the domain controller is automatically rebooted occasionally and
> following error code is generated.
>
> I have tried googling on this but did not get any satisfactory ideas.
>
>
>
> DC is Win 2003 & 64 bit and fully patched.
>
> **********************************
>
>
>
> The process winlogon.exe has initiated the restart of computer XYZ-DC02 on
> behalf of user for the following reason: No title for this reason could be
> found Reason Code: 0x50006 Shutdown Type: restart
>
> Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated
> unexpectedly with status code -1073741819. The system will now shut down
> and restart.
>
>
>
> Faulting application lsass.exe, version 5.2.3790.1830, faulting module
> ntdsa.dll, version 5.2.3790.4568, fault address 0x00000000000081fc.
>
>
>
>
>
> ********************
>
>
> Logs:-
> Event Type: Error
> Event Source: Winlogon
> Event Category: None
> Event ID: 1015
> Date: 5/30/2010
> Time: 4:34:32 AM
> User: N/A
> Computer: XYZ-DC02
> Description:
> A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status
> code c0000005. The machine must now be restarted.
>
>
> *****************************
>
> Please help me with some advice.
>
>
>
> Regards,
>
> Saswati
>
>
>
>
--
Sent from my mobile device
| | | |
| bdesmond
Posts:843
| | 06/05/2010 8:42 PM |
| Do you have something like Quest Intrust running or a custom password filter or anything else running in-process in LSA?
Thanks,
Brian Desmond
brian@briandesmond.com
c - 312.731.3132
From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of Mahajan, Saswati
Sent: Saturday, June 05, 2010 2:07 PM
To: 'activedir@mail.activedir.org'
Subject: [ActiveDir] DC rebooting
Hi Gurus,
One of the domain controller is automatically rebooted occasionally and following error code is generated.
I have tried googling on this but did not get any satisfactory ideas.
DC is Win 2003 & 64 bit and fully patched.
**********************************
The process winlogon.exe has initiated the restart of computer XYZ-DC02 on behalf of user for the following reason: No title for this reason could be found Reason Code: 0x50006 Shutdown Type: restart
Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code -1073741819. The system will now shut down and restart.
Faulting application lsass.exe, version 5.2.3790.1830, faulting module ntdsa.dll, version 5.2.3790.4568, fault address 0x00000000000081fc.
********************
Logs:-
Event Type: Error
Event Source: Winlogon
Event Category: None
Event ID: 1015
Date: 5/30/2010
Time: 4:34:32 AM
User: N/A
Computer: XYZ-DC02
Description:
A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.
*****************************
Please help me with some advice.
Regards,
Saswati
| | | |
| sdelrio
Posts:14
| | 06/06/2010 3:22 PM |
| Because lsass it is a crucial proccess , the system cannot continue working
without it, will be good to configure Debug Diag, adplus or userdump to
catch the lsass process , and generate a dump while the process is being
crashed.
Generally this is caused by a third party stuff running into the LSA.
Maybe if you can take a dump of the lsass process now , when the issue is
not happening , we would be able to check the modules installed on the lsass
process and maybe removing them will help.
However the best approach on this cases , is to configure the mentioned
appliccations to catch the crash and check with debugging tools why the
process has crashed.
Regards ,
On Sat, Jun 5, 2010 at 4:41 PM, Brian Desmond <brian@briandesmond.com>wrote:
> *Do you have something like Quest Intrust running or a custom password
> filter or anything else running in-process in LSA? *
>
> * *
>
> *Thanks,*
>
> *Brian Desmond*
>
> *brian@briandesmond.com*
>
> * *
>
> *c – 312.731.3132*
>
> * *
>
> *From:* activedir-owner@mail.activedir.org [mailto:
> activedir-owner@mail.activedir.org] *On Behalf Of *Mahajan, Saswati
> *Sent:* Saturday, June 05, 2010 2:07 PM
> *To:* 'activedir@mail.activedir.org'
> *Subject:* [ActiveDir] DC rebooting
>
>
>
> Hi Gurus,
>
>
>
> One of the domain controller is automatically rebooted occasionally and
> following error code is generated.
>
> I have tried googling on this but did not get any satisfactory ideas.
>
>
>
> DC is Win 2003 & 64 bit and fully patched.
>
> **********************************
>
>
>
> The process winlogon.exe has initiated the restart of computer XYZ-DC02 on
> behalf of user for the following reason: No title for this reason could be
> found Reason Code: 0x50006 Shutdown Type: restart
>
> Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated
> unexpectedly with status code -1073741819. The system will now shut down
> and restart.
>
>
>
> Faulting application lsass.exe, version 5.2.3790.1830, faulting module
> ntdsa.dll, version 5.2.3790.4568, fault address 0x00000000000081fc.
>
>
>
>
>
> ********************
>
>
>
> Logs:-
>
> *Event Type: Error*
>
> *Event Source: Winlogon*
>
> *Event Category: None*
>
> *Event ID: 1015*
>
> *Date: 5/30/2010*
>
> *Time: 4:34:32 AM*
>
> *User: N/A*
>
> *Computer: *XYZ-DC02**
>
> *Description:*
>
> *A critical system process, C:\WINDOWS\system32\lsass.exe, failed with
> status code c0000005. The machine must now be restarted.*
>
>
>
> *****************************
>
>
>
> Please help me with some advice.
>
>
>
>
>
>
>
> Regards,
>
>
>
> Saswati
>
>
>
>
>
>
>
| | | |
| AnthonyP
Posts:6
| | 06/06/2010 3:48 PM |
| You can take a look at what authentication packages are being loaded into
LSASS by taking a look in *
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa*
Can you post that output here?
Anthony Petito
On Sun, Jun 6, 2010 at 10:20 AM, Sebastian del Rio <
sebastiandelrio@gmail.com> wrote:
> Because lsass it is a crucial proccess , the system cannot continue working
> without it, will be good to configure Debug Diag, adplus or userdump to
> catch the lsass process , and generate a dump while the process is being
> crashed.
>
> Generally this is caused by a third party stuff running into the LSA.
>
> Maybe if you can take a dump of the lsass process now , when the issue is
> not happening , we would be able to check the modules installed on the lsass
> process and maybe removing them will help.
>
> However the best approach on this cases , is to configure the mentioned
> appliccations to catch the crash and check with debugging tools why the
> process has crashed.
>
> Regards ,
>
>
> On Sat, Jun 5, 2010 at 4:41 PM, Brian Desmond <brian@briandesmond.com>wrote:
>
>> *Do you have something like Quest Intrust running or a custom password
>> filter or anything else running in-process in LSA? *
>>
>> * *
>>
>> *Thanks,*
>>
>> *Brian Desmond*
>>
>> *brian@briandesmond.com*
>>
>> * *
>>
>> *c – 312.731.3132*
>>
>> * *
>>
>> *From:* activedir-owner@mail.activedir.org [mailto:
>> activedir-owner@mail.activedir.org] *On Behalf Of *Mahajan, Saswati
>> *Sent:* Saturday, June 05, 2010 2:07 PM
>> *To:* 'activedir@mail.activedir.org'
>> *Subject:* [ActiveDir] DC rebooting
>>
>>
>>
>> Hi Gurus,
>>
>>
>>
>> One of the domain controller is automatically rebooted occasionally and
>> following error code is generated.
>>
>> I have tried googling on this but did not get any satisfactory ideas.
>>
>>
>>
>> DC is Win 2003 & 64 bit and fully patched.
>>
>> **********************************
>>
>>
>>
>> The process winlogon.exe has initiated the restart of computer XYZ-DC02 on
>> behalf of user for the following reason: No title for this reason could be
>> found Reason Code: 0x50006 Shutdown Type: restart
>>
>> Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated
>> unexpectedly with status code -1073741819. The system will now shut down
>> and restart.
>>
>>
>>
>> Faulting application lsass.exe, version 5.2.3790.1830, faulting module
>> ntdsa.dll, version 5.2.3790.4568, fault address 0x00000000000081fc.
>>
>>
>>
>>
>>
>> ********************
>>
>>
>>
>> Logs:-
>>
>> *Event Type: Error*
>>
>> *Event Source: Winlogon*
>>
>> *Event Category: None*
>>
>> *Event ID: 1015*
>>
>> *Date: 5/30/2010*
>>
>> *Time: 4:34:32 AM*
>>
>> *User: N/A*
>>
>> *Computer: *XYZ-DC02**
>>
>> *Description:*
>>
>> *A critical system process, C:\WINDOWS\system32\lsass.exe, failed with
>> status code c0000005. The machine must now be restarted.*
>>
>>
>>
>> *****************************
>>
>>
>>
>> Please help me with some advice.
>>
>>
>>
>>
>>
>>
>>
>> Regards,
>>
>>
>>
>> Saswati
>>
>>
>>
>>
>>
>>
>>
>
>
| | | |
| rkaramchand
Posts:51
| | 06/07/2010 11:15 AM |
| Check the Kerberos.dll there is version mismatch
-----Original Message-----
From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of Rick Sheikh
Sent: Saturday, June 05, 2010 3:40 PM
To: activedir@mail.activedir.org
Subject: Re: [ActiveDir] DC rebooting
Memory dumps' analysis with windows debugging tool may be helpful.
On 6/5/10, Mahajan, Saswati <saswati.mahajan@hp.com> wrote:
> Hi Gurus,
>
>
>
> One of the domain controller is automatically rebooted occasionally and
> following error code is generated.
>
> I have tried googling on this but did not get any satisfactory ideas.
>
>
>
> DC is Win 2003 & 64 bit and fully patched.
>
> **********************************
>
>
>
> The process winlogon.exe has initiated the restart of computer XYZ-DC02 on
> behalf of user for the following reason: No title for this reason could be
> found Reason Code: 0x50006 Shutdown Type: restart
>
> Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated
> unexpectedly with status code -1073741819. The system will now shut down
> and restart.
>
>
>
> Faulting application lsass.exe, version 5.2.3790.1830, faulting module
> ntdsa.dll, version 5.2.3790.4568, fault address 0x00000000000081fc.
>
>
>
>
>
> ********************
>
>
> Logs:-
> Event Type: Error
> Event Source: Winlogon
> Event Category: None
> Event ID: 1015
> Date: 5/30/2010
> Time: 4:34:32 AM
> User: N/A
> Computer: XYZ-DC02
> Description:
> A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status
> code c0000005. The machine must now be restarted.
>
>
> *****************************
>
> Please help me with some advice.
>
>
>
> Regards,
>
> Saswati
>
>
>
>
--
Sent from my mobile device
| | | |
|
|