Faulting application name: lsass.exe, version: 10.0.20348.2340, time stamp: 0x343412e1 Faulting module name: ntdll.dll, version: 10.0.20348.2694, time stamp: 0x9be259ea Exception code: 0xc0000005 Fault offset: 0x000000000003171d Faulting process id: 0x6c0

Question

Installed Windows Server 2022 21H2 function as AD Primary & Secondary DC on Sep 2024.

Applied latest updates on the month. After system running about 1 month, getting the following error message:

1. A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.
2. Faulting application name: lsass.exe, version: 10.0.20348.1, time stamp: 0x6177486f Faulting module name: ntdll.dll, version: 10.0.20348.112, time stamp: 0x09a64f97 Exception code: 0xc0000005 Fault offset: 0x0000000000031fdd Faulting process id: 0x414 Faulting application start time: 0x01db1ab67b7c90a6 Faulting application path: C:\WINDOWS\system32\lsass.exe Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll Report Id: b71b7b09-f25d-424a-9a00-a28e2e7de4cc Faulting package full name: Faulting package-relative application ID:

Server will go into reboot loop when windows startup until Applying System settings.

These are critical system in Domain we cannot let the system having auto restart issues unsolved.

Server Hardware Information: Lenovo SR650 V3.

Had contacted Lenovo updating firmware to latest version also did not resolve. After their L3 support diagnostic confirm there is no hardware issues & confirm its due to OS level problem.

Answer 1

Hello

Have we configured any audit group policies to the domain?

If we have deployed the audit policies to the domian, please try to remove it temporarily then check the issue again.

For general troubleshooting suggestions, the following link may be useful.

THIS JUST IN!!!!  High LSASS Usage After Windows Update 3B March 2024 - Microsoft Community Hub

Considering this is a domian environment, the forum resources may be limited to troubleshoot this issue. We may consider to open a ticket for more resources.

Open Support requests | Microsoft Learn