Domain Controller 2019 Event ID 1074, Reason Code: 0x50006 Lsass.exe terminated unexpectedly

Question

The process wininit.exe has initiated the restart of computer Domain Controller 2019 on behalf of user for the following reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code -1073740767. The system will now shut down and restart.

Faulting application name: lsass.exe, version: 10.0.17763.1, time stamp: 0xf1beaffa
Faulting module name: verifier.dll, version: 10.0.17763.1, time stamp: 0x197d3cfd
Exception code: 0xc0000421
Fault offset: 0x0000000000006646
Faulting process id: 0x2a4
Faulting application start time: 0x01d77174ea850ebe
Faulting application path: C:\Windows\system32\lsass.exe
Faulting module path: C:\Windows\System32\verifier.dll
Report Id: 62e62818-ccba-40c1-a815-e036fe1c42c9
Faulting package full name:
Faulting package-relative application ID:

I detected that when I stop NETLOGON Services, server 2019 doesn't restart unexpectedly. But when start NETLOGON Services, it still restart every 5 ~ 10 minutes.

dave patrick · Answer

What's the history here? New domain controller or new problem? How many domain controllers?
&nbsp;
&nbsp;

trungnv · Answer

Dave Patrick&nbsp;I have plan upgrade AD from 2008 to 2019. On root site have 02 DC2019 (Also have issue "restart unexpected" then fixed by re-creating health mailbox account) but Child domain is not resolved. In this site, I forcing install DC2012 to client connect normally and with DC2016 &amp; DC2019, if start NETLOGON services. they are rebooted unexpected.&nbsp;I doubt that some&nbsp;suspicious client attacking thought NETLOGON services. 😞&nbsp;Please save me. This issue still not resolve for 3 months

dave patrick · Answer

I can still only understand about a third of this. Upgrading domain controllers in this broken environment is never recommended. You may want to restore a recent known good backup and work from there.
&nbsp;
&nbsp;
&nbsp;

dasave · Answer

TRUNGNV&nbsp;&nbsp;Hello friend, were you able to solve your problem? I have the same problem currently.

trungnv248 · Answer

dasave&nbsp;Hi. We open ticket premier support case Microsoft. Infomation about my case below:&nbsp;Issue: LSASS crashes on domain controller repeatedly&nbsp;Resolution:The issue happened because the password didn’t preserved properly previously and caused the crash. Normally, we save the hash after password is changed. But the password stored in dump showed up as plain text. And the plain text is way too long for LSASS to process.&nbsp;iopl=0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; nv up ei pl nz na po cycs=0033&nbsp; ss=002b&nbsp; ds=002b&nbsp; es=002b&nbsp; fs=0053&nbsp; gs=002b&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; efl=00010205samsrv!SampGetPrivateUserData+0x1db:00007ff9`00ffb5eb 488b45f8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; rax,qword ptr [rbp-8] ss:00000097`005f8ba8=0000023cf72a8df4@rbx&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; UserContext = 0x00000097`005f8270&lt;unavailable&gt;&nbsp;&nbsp;&nbsp;&nbsp; UserPasswordSettings = &lt;value unavailable&gt;&lt;unavailable&gt;&nbsp;&nbsp;&nbsp;&nbsp; DataLength = &lt;value unavailable&gt;@r13&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Data = 0x0000023c`bb6feda800000097`005f8b90 TempString = ""GREr_?;XqBo?\pfSfYEk*@bG)[;j?/\8nwV:s OGA1LZ?SXg]eS66_cVoD3xGbxQ+DRWYN_$""xV&gt;3w!w9vS:q!Jri+'fXJ[I#sbv^wiYm1PUzrvwSdGDXK2""00000097`005f8ba0 StoredBuffer = ""GREr_?;XqBo?\pfSfYEk*@bG)[;j?/\8nwV:s OGA1LZ?SXg]eS66_cVoD3xGbxQ+DRWYN_$""xV&gt;3w!w9vS:q!Jri+'fXJ[I#sbv^wiYm1PUzrvwSdGDXK2""@esi&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NtStatus = 0n0&lt;unavailable&gt;&nbsp;&nbsp;&nbsp;&nbsp; BufferPointer = &lt;value unavailable&gt;@r15d&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PasswordHistoryLength = 6&nbsp;Dump you just uploaded:UserContext = 0x0000020e`2760fb30UserPasswordSettings = &lt;value unavailable&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DataLength = &lt;value unavailable&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Data = 0x0000020d`9c9eee78&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; TempString = ""GREr_?;XqBo?\pfSfYEk*@bG)[;j?/\8nwV:s OGA1LZ?SXg]eS66_cVoD3xGbxQ+DRWYN_$""xV&gt;3w!w9vS:q!Jri+'fXJ[I#sbv^wiYm1PUzrvwSdGDXK2""&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; StoredBuffer = ""GREr_?;XqBo?\pfSfYEk*@bG)[;j?/\8nwV:s OGA1LZ?SXg]eS66_cVoD3xGbxQ+DRWYN_$""xV&gt;3w!w9vS:q!Jri+'fXJ[I#sbv^wiYm1PUzrvwSdGDXK2""&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; NtStatus = 0n0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; BufferPointer = &lt;value unavailable&gt;PasswordHistoryLength = 6&nbsp;&nbsp;We would recommend following to reduce the probability of this issue from happening again.We found you changed PasswordHistoryLength to 6 (By default is 24). Based on code review, changing the passwordhistorylength to 24 may help with the symptom. This will require you change your default domain policy: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\ Enforce password history to 24.https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/enforce-password-historyNote: Enforce password history will apply for both machine account and user account.&nbsp;&nbsp;&nbsp;&nbsp;

Forum Discussion

Domain Controller 2019 Event ID 1074, Reason Code: 0x50006 Lsass.exe terminated unexpectedly

7 Replies

Resources