Changing Password via Terminal Services causes Server Reboot (lsas
From: CMS_Tech (CMS_Tech_at_discussions.microsoft.com)
Date: 03/25/05
- Next message: topgun: "perfmon console displays disk reads+writes, but binary counter logs only contain zeros"
- Previous message: Todd J Heron: "Re: windows firewall"
- Messages sorted by: [ date ] [ thread ]
Date: Fri, 25 Mar 2005 07:23:02 -0800
We are currently experiencing a problem with one of our Windows 2003 servers.
The server is a new machine, a Dell PowerEdge 1850. It has the Dell Factory
install of Windows 2003 on it. The server is also running MSSQL 2000,
ColdFusion MX 6.1 and Plesk 7.5.
When a user logs in through Terminal Services (Administration mode) and
changes their password, the machine is rebooted. (Windows Security, Change
Password, Enter current and new passwords, and then the server reboots. The
server doesn’t seem to reboot if the password change is done through the
computer management MMC.)
The following error is shown on screen:
The system is shutting down. Please save all work in progress and log off.
Any unsaved changes will be lost. This shutdown was initiated by NT
AUTHORTY\SYSTEM. Shutdown will begin in 58 seconds. Shutdown message: The
system process ‘C:\windows\system32\lsass.exe’ terminated unexpectedly with
status code -1073740972. The system will now shut down and restart.
The following items can also be found in the Application error log around
this time:
Event ID: 1004
Reporting queued error: faulting application winlogon.exe, version 0.0.0.0,
faulting module msgina.dll, version 5.2.3790.0, fault address 0x000118e6.
Event ID: 1004
Reporting queued error: faulting application lsass.exe, version 5.2.3790.0,
faulting module ntdll.dll, version 5.2.3790.0, fault address 0x0003c10b.
Event ID: 1000
Faulting application , version 0.0.0.0, faulting module msgina.dll, version
5.2.3790.0, fault address 0x000118e6.
Event ID: 1015
A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status
code c0000354. The machine must now be restarted.
Event ID: 1000
Faulting application lsass.exe, version 5.2.3790.0, faulting module
ntdll.dll, version 5.2.3790.0, fault address 0x0003c10b.
Errors in System Error Log:
Event ID: 26
Application popup: System Shutdown : The system is shutting down. Please
save all work in progress and log off. Any unsaved changes will be lost.
This shutdown was initiated by NT AUTHORITY\SYSTEM. Shutdown will begin in
58 seconds. Shutdown message: The system process
'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code
-1073740972. The system will now shut down and restart..
Event ID: 1074
The process winlogon.exe has initiated the restart of computer KRYTON on
behalf of user for the following reason: No title for this reason could be
found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated
unexpectedly with status code -1073740972. The system will now shut down and
restart.
Event ID: 5000
The security package ACRONIS_RELOGON_AUTHENTICATION_PACKAGE generated an
exception. The exception information is the data.
I have looked at a few MS KB articles, that seem to be similar, but not
exactly the same as the problem that we are experiencing:
http://support.microsoft.com/default.aspx?scid=kb;en-us;818080
I know that a lost of LSASS.exe reboots are caused by the SASSER virus.
I’ve scanned our machine with AV software, and also run the removal tool from
Symantec – the machine has shown to be clean of this virus.
Has anyone else experienced this problem? Can anyone offer any suggestions
for a resolution to this problem.
Thank you for your help.
Kind regards,
Roland
- Next message: topgun: "perfmon console displays disk reads+writes, but binary counter logs only contain zeros"
- Previous message: Todd J Heron: "Re: windows firewall"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
