Windows 10 Restart after Login

[lpham]

We have some machines on our domain that's crashing upon login.  They get the "Your PC Will Automatically Restart in One Minute"  then they are forced to restart.  After the restart, they're able to login again and continue working until the next day.  

Machines affected are running Windows 10 1809 with the latest patches.  

Event Viewer Log shows that LSASS.exe crashed on the first boot with error c0000008 and then all services failed to authenticate after, which probably caused the crash.

"A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000008. The machine must now be restarted."

Any help is appreciated!

Thanks!

[#2]

Hello, 

Please run Power troubleshooter from Settings app > Update & security > Troubleshoot. Let us know what it reports back. 

Regards.

[#3]

@KapilArya  Only issue was "Time to see was too long"

[#4 · Accepted solution]

@lpham did you installed Windows 10 May 2020's updates?

I have several users got the same issue after this month's patches installed.

Exactly the same error message in Event log. 

The patches we installed are: KB4551853 & KB4556441

We're still looking for a resolution.

Just noticed if user turn off PC fast start seems not having this issue anymore, not sure if this is a work around.

[#5]

Likely a red herring but kb4551853 Included a patch for CVE-2020-1118 which is the only recent patch making changes to lsass.

Extract: trendmicro blog 

"CVE-2020-1118 is a TLS vulnerability that attackers can exploit to perpetrate a denial of service (DoS) attack on the system. With CVE-2020-1118, malicious actors can send a specially crafted request, triggering the system to reboot. If successfully exploited, the attackers may cause the vulnerable system to stop responding, and just about any system could be shut down by an attacker as the flaw affects both TLS clients and servers. Vulnerable systems that can exploit this flaw will cause lsass.exe to terminate, and can potentially cause disruptions in daily business operations."

We also have a number of 1809 users experiencing the issue, some of the reported issues have resolved themselves without intervention.

[#6]

@lpham We have close to 100 machines affected by this error: LSASS.exe crashed on "Power on" from the "Shut down" state that is getting error "A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000008. The machine must now be restarted." Users that reporting this problem have the habit on perform daily "Shut down" of their computer. For almost all PC, after selected "Restart" instead of "Shut down" PC at least twice, the problem resolved themselves without intervention.  Our PC use the default Enable with "Turn on fast startup". We have an MS Premier case open since last week, still no solution.

[#7]

@ppboo  @LeoZ001 @ScottA605 Thank you!  We'll look at turning off fast start up and ask users to restart instead of shutting down or hopefully it will be resolve by this month's patches.

[#8]

Go to advanced system settings under properties of my computer, uncheck automatically restart opt, ssve and exist.

[#9]

@ppboo Hi, have you got any feedback from Microsoft regarding this error... I'm getting these errors now also in my environment... 

Rgds

Jonas

[#10]

@Thelink73 MS provided us with a private hotfix for limited testing for a few days that seems to have resolved the issue. However, it is not included in June Tuesday patches. As we would like our test PCs to received regular June patching, the recommendation is to always remove any private hotfix before   Before we can receive the We had to remove the private hotfix before installing a public release patch to avoid the potential issues. 

Microsoft Support has now informed us that the fix is tentatively scheduled for July’s patch release cycle.

We have advised users' PC that is affected by this issue to use a workaround with putting PC to "Sleep" for overnight instead of Shutdown PC daily to avoid the daily crashes.

[#11]

"We have advised users' PC that is affected by this issue to use a workaround with putting PC to "Sleep" for overnight instead of Shutdown PC daily to avoid the daily crashes."

Our problem is when the users log off the PC and not with a shut down.

We have turned off the "Fast Startup" option and that is working except on one PC.

[#12]

Did you log a Microsoft Support ticket? We logged one, but have had no tangible feedback.
We're experiencing same issue.

[#13]

@Marius6299 I opened a ticket on this too; uploaded event viewer logs and can confirm the following:

• All PC's with issues are Windows 10 1809
• kb4551853 may be the culprit, as we are finding that lsass.exe keeps failing; I requested that our service desk uninstall this patch and keep me posted
• Restarting the PC helps the issue

Additionally, I referenced this article with in the ticket, so Microsoft SHOULD be watching.  🙂

[#14]

@Marius6299 Yes, we have an MS case open and have tested a private Hotfix that seems to address the problem. We have to remove the private hotfix to allow the latest June CU to installed. MS has informed us that the fix is tentatively scheduled for July Cumulative updates.

[#15]

Thx. I've also referenced this thread and reported to our dedicated MS PFE as well. 

We've tested removal of kb4551853 as well. Got a mix bag of results.

Hopefully a fix can be found soon. 

[#16]

@lphamwe are seeing this issue on a 2019 RDS server. Seems the issue is not directly related to startup, but rather is triggered occasionally by user logons. Issues started within 2 days after KB4551853 was installed. It's possible the issue is more likely to happen soon after a reboot, but I don't have enough datapoints yet to confirm. The two most recent lsass terminations both happened within 12 hours after a reboot of the server, however in some of the cases there were already a number of users logged on and working for several hours before lsass died. Possibly there is one (or more) user whose profile triggers the failure when they log on to the server. Going to try removing KB4551853 and see if that makes any difference.

[#17]

@lphamMicrosoft has updated the known issue with lasss.exe crashing problem in May CU https://support.microsoft.com/en-us/help/4551853 Hopefully we will received the public release soon.

[#18]

@ppboo   Thanks for the information!  Glad to see they're aware of the issue!

[#19]

Thanks for update. Hopefully it comes soon as we have many users having to live with the reboots daily.

[#20]

@lpham The fixed is finally here...  

July 14, 2020—KB4558998 (OS Build 17763.1339)

https://support.microsoft.com/en-us/help/4558998/windows-10-update-kb4558998