frequent restart of server 2022 due to lsass.exe crashes

Question

Dears, Greetings, I have a problem with my Windows server 2022 with active directory, the server frequently restarts due to lsass.exe crashes with event id 1000 in application log as below: Faulting application name: lsass.exe, version: 0.0.0.0, time stamp: 0x00000000 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0x00000000 Fault offset: 0x0000000000000000 Faulting process id: 0x37c Faulting application start time: 0x01da4d3674b4dec7 Faulting application path: C:\Windows\System32\lsass.exe Faulting module path: unknown Report Id: 76f075bb-5266-418f-a022-7f5c17671111 Faulting package full name: Faulting package-relative application ID: and event#1074 error in system log as below: The process wininit.exe has initiated the restart of computer "***" on behalf of user for the following reason: No title for this reason could be found Reason Code: 0x50006 Shutdown Type: restart Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code -1073741819. The system will now shut down and restart. the server is updated to the latest updates, please advise if there's a solution thank you

Answer 1

Hello, According to the error, the issue you are experiencing is lsass.exe crashes leading to system restart.

1. Try boot machine into safe mode and then retry the operation:Start your PC in safe mode in Windows - Microsoft Support
2. This may cause by a driver, try run driver verifier: Start a Command Prompt window by selecting Run as administrator, and type verifier to open Driver Verifier Manager. Driver Verifier - Windows drivers | Microsoft Learn
3. Sometimes the problem may not be the driver and just the third-party applications and services. Try perform clean boot: How to perform a clean boot in Windows - Microsoft Support

Answer 2

Microsoft announced KB5034770

• This update addresses an issue that affects the Local Security Authority Subsystem Service (LSASS). It might stop working. This occurs when you access the Active Directory database.

Let' see if this CU improves the stability.

Best regards, TVA