Forum Discussion
ATA Client on a Server 2019 Domain Controller
We have noticed that when installing the ATA client on a Windows Server 2019 domain controller the Lsass.exe service crashes every 10-25 minutes and causes the server to reboot. We also noticed that when we installed the client on multiple 2019 domain controllers they all have Lsass.exe crash at the same time and they reboot within a few moments of each other.
- EliOfek
Microsoft
Interesting.
ATA does not install anything that I am aware of that should effect lsass at all.
Please open a case with MS support ASAP, and ask the responding support engineer to add me to the email thread.
This is something that will need to be investigated using crash dumps etc, which is not applicable on this forum thread. once we find root cause we can update this thread with results.
Also, we might want to engage both an ATA engineer and a platform engineer to take a look on the crash dumps.
Questions:
Can you tell me if uninstalling the ATA gateway resolves the issue and lsass stop crashing?
Any 3rd party security apps installed on the machines?
Are those physical machines / VMs or both?
Do you have other DCs (< 2019) where everything works fine?
Do you have other DCs (< 2019) which experience the same problem?
If you have crash dumps already, please zip and upload to the secured workspace that will be provided by the support engineer.
Also, attach any logs & blg files you can find from the gateway service on the crashing machine:
See those for how to collect these files:
Eli
- EliOfek
Adding some important info to set expectations:
Officially, (and also according to ATA docs) ATA is not yet supported on 2019.
(When the latest ATA was released, Server 2019 was not GA yet).
In spite of that, we are interested in this case because this is not something we thought was possible,
so researching it is interesting, but eventually the support on this will be "best effort".
Can you tell me if uninstalling the ATA gateway resolves the issue and lsass stop crashing?
Yes it did stop the reboots
Any 3rd party security apps installed on the machines?
None. These are dedicated AD controllers
Are those physical machines / VMs or both?
We tried both. The interesting thing is they all seemed to reboot at the same time.
Do you have other DCs (< 2019) where everything works fine?
Yes we have other 2016 DC’s that the Azure ATA client works just fine on
Do you have other DCs (< 2019) which experience the same problem?
No. The 2016 servers are acting as expected
If you have crash dumps already, please zip and upload to the secured workspace that will be provided by the support engineer.
Not yet. I will work on this.
Also, attach any logs & blg files you can find from the gateway service on the crashing machine:
I will work on this
- Same in our '19 environment, AATP sensor causes lsaas crashing and reboot on 2019 DC's. No 3rd party software installed.
- EliOfek
Please open a support case , and mentioned to the assigned engineer to add me to the thread as well.
We have some progress with the initial case, I want to make sure you are failing on the same thing.
Question: Do you have Windows hello for business installed there?
No, do not have Windows Hello for Business configured yet.
I can confirm this is still an issue two months later! We have an open case with MS support on this issue. We upgraded two dedicated DCs from 2016 to 2019 and they were fine until Monday morning when they got user load then lsass became very unhappy.
It is very frustrating when MS tech breaks other MS tech, especially when it is tech specifically designed to run on a particular server role like this.
- EliOfek
Hi Doug,
There is a reason AATP is still not stating support for Windows Server 2019 Domain Controllers,
and this is because it hasn't cleared testing yet.
Sadly, there is a bug in lsass.exe that gets triggered easily when the sensor is installed.There is a private fix for it that wasn't publicly released yet, so if you are already in this situation support will be able to provide it to you for mitigation but this is "best effort" support for now as it's officially not yet a supported configuration.
Once the lsass fix will be publicly released, hoping that AATP will pass 2019 testing, we will work quickly to officially support it.
So on our open issue with support on Windows Hello for Business breaking when authenticating against a Server 2019 DC, support just came back to us and said that issue is due to a bug in LSASS which there will be a fix for in the February CU, and provided a "temporary fix" for "testing purposes only". Is it the same bug in LSASS that is biting both Azure ATP and WhfB?
I ask because we have a workaround that will be fine for us for the WhfB issue in the interim without the temporary fix, but would look at it if it will allow us to get Azure ATP going again so we are not partially blind until Feb 13th with the CU comes out.
