lsass.exe

[jeffpoulsen]

I have been having a problem with a sever. The problem is the machine keeps shutting down. I have checked the error message upon the reboot and it seems to be tied to the lsass.exe. I have scanned for the sasser worm but several scans have found no virus. I am suspicious because it reports the exe file in a \temp folder. I have the information but not with me tonight. Has anyone had a similar problem? If it's not a virus where should I look for a solution.

 

[flypoo]

This may not apply to you but..

I had some XP laptops complaining of lsass errors 'The system has recovered from a serious error'

I also scanned for the sasser virus with no joy. Once I updated to SP2, the problem went away.

 

[PaulGillespie]

I've got the same problem with a SBS2003. I'm going to do a windows update and see how it goes. All links point to the sasser worm but like you, i've scanned and not found anything.

Paul

 

[jeffpoulsen]

I have not solved the problem yet, however I have come across a few items that I tweaked that have helped to limit the reboots to once every day or two. This machine came from Dell with only a 12 gig partition for C: It was almost full so I increased the size of the C: partition. Also I increased the page files. This has helped. Now I have been studing the event logs and have found I need to check the Domain Controller setup. I had set it up a long time ago but it seems pehaps someone has made changes to the system. ?? I also have found out something very very strange, I checked MS for updates and found there are NO updates available. Also there was NO update history. I'm sure I updated when I worked on the system some time ago. I usually do. But I intend to call Microsoft today to find out if this is true. The OS Windows 2003 Server Standard Edition version is 5.2.379 SP 0.0 I have never heard of NO updates for any OS.

 

[PaulGillespie]

Jeff, Sounds very strange, thankfully my system "seems" like there are less possible issues. I've just installed quite a few patches but i need to do more at a more convenient time. I'll post back with any developments.

Cheers
Paul

 

[itsp1965]

Jeff, why don't you try installing the Microsoft Baseline Security Analyzer on the affected machine. From there you can run the MBSACLI utility which will check your machine for missing patches.

 

[JSellden]

Hi,

I have ran into the same problem as you Jeff. Although I have a little different scenario. I have Exchange 2003 with its SP1 on a Windows Server 2003, Standard Edition, without the SP1 installed (the server is not a DC). The system has worked fine for months until now.

As you described the server shuts down at irregular intervals and in the eventviewer there are messages about "lsass.exe terminated unexpectadley".

I will install SP1 for Windows Server 2003 tonight and see what happens.

Regards
Johan

 

[PaulGillespie]

My sbs2003 has been fine since my post. Installed all the relevant security patches and it has been fine since. touch wood!

 

[jeffpoulsen]

Paul,

I did install the " Microsoft Baseline Security Analyzer" MBSC and installed the updates. I had to lower my Internet Explore Security settings and went to the Micosoft update page and installed SP1. And other updates. It seemed to have worked. No reboots now. I am sorry I forgot to update this thread until now but I have been out of town. I hope this Thread helps anyone with the same problem. Jeff