Lsass.exe error causing machines to restart - EventID 1015

Question

Hello! My organisation has recently encountered an issue in Windows 10 with lsass.exe failing and causing machines to restart, seemingly at random. We first discovered it from our MDR flagging it as a Werfault.exe exploit, so naturally thought they were blocking the process from running properly which was causing the crashing. We told our MDR team who confirmed it as a false positive. We then tried to disable that particular threat detection to confirm the root cause yet still noticed system crashing due to lsass.exe failing. In event viewer this is what we receive: Another speculation we had was a possible issue with the 2024-02 Cumulative Windows updates, however we saw conflicting evidence where some machines had crashed before installing this. We have multiple Windows 11 machines too but this is only affecting Windows 10 at the moment. The only answers we've find online have been related to old Windows servers like this: https://support.microsoft.com/en-au/topic/lsass-exe-crashes-and-system-shuts-down-automatically-on-a-windows-server-2012-r2-based-server-5abde4d6-917e-7825-867e-4c9f4ff616b9 Has anyone else experienced this issue? We can't seem to find the root cause.

Answer 1

Hello Have we got any bugcheck code when the machine restart or is there any dump file created in C:\Windows\memory.dmp or C:\Windows\minidump folder? If there is any dump file created, we could try to check the dump with Windbg tool. Install WinDbg - Windows drivers | Microsoft Learn If there is no dump created, we could try to enable WER to create a user mode dump automatically. Open administrator command line then run the follwing command. Reboot the machine. Reg Add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /f Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /V DumpFolder /t REG_SZ /D "C:\CrashDumps" /f MD C:\CrashDumps Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /V DumpType /t REG_DWORD /D 2 /f Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /V DumpCount /t REG_DWORD /D 10 /f Next time the service crash again, there should be dump file created in C:\crashdumps. The key to analyze this issue is to get a dump file for the crash service. Analyzing the dump could be complex, it is recommended to open a Microsoft Profession ticket for more resources (Lsass service is covered by our AD team). Microsoft Professional Support (pay-per-incident): FAQ - Microsoft Support For general troubleshooting, please take the following steps:

1. If there is any third party antivirus software installed, please uninstall it temporarily then reboot to check.
2. Check the issue in clean boot environment to verify third party service conflict issue. How to perform a clean boot in Windows - Microsoft Support
3. Open adinistrator command line and run "dism /online /cleanup-image /restorehealth" to check the health of system files.