May 27 2020 08:32 AM
May 27 2020 08:32 AM
We have some machines on our domain that's crashing upon login. They get the "Your PC Will Automatically Restart in One Minute" then they are forced to restart. After the restart, they're able to login again and continue working until the next day.
Machines affected are running Windows 10 1809 with the latest patches.
Event Viewer Log shows that LSASS.exe crashed on the first boot with error c0000008 and then all services failed to authenticate after, which probably caused the crash.
"A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000008. The machine must now be restarted."
Any help is appreciated!
May 27 2020 11:36 PM
Please run Power troubleshooter from Settings app > Update & security > Troubleshoot. Let us know what it reports back.
May 28 2020 02:40 PM - edited May 28 2020 02:43 PMSolution
@lpham did you installed Windows 10 May 2020's updates?
I have several users got the same issue after this month's patches installed.
Exactly the same error message in Event log.
The patches we installed are: KB4551853 & KB4556441
We're still looking for a resolution.
Just noticed if user turn off PC fast start seems not having this issue anymore, not sure if this is a work around.
May 29 2020 01:46 AM
Extract: trendmicro blog
"CVE-2020-1118 is a TLS vulnerability that attackers can exploit to perpetrate a denial of service (DoS) attack on the system. With CVE-2020-1118, malicious actors can send a specially crafted request, triggering the system to reboot. If successfully exploited, the attackers may cause the vulnerable system to stop responding, and just about any system could be shut down by an attacker as the flaw affects both TLS clients and servers. Vulnerable systems that can exploit this flaw will cause lsass.exe to terminate, and can potentially cause disruptions in daily business operations."
We also have a number of 1809 users experiencing the issue, some of the reported issues have resolved themselves without intervention.
May 29 2020 01:52 PM
@lpham We have close to 100 machines affected by this error: LSASS.exe crashed on "Power on" from the "Shut down" state that is getting error "A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000008. The machine must now be restarted." Users that reporting this problem have the habit on perform daily "Shut down" of their computer. For almost all PC, after selected "Restart" instead of "Shut down" PC at least twice, the problem resolved themselves without intervention. Our PC use the default Enable with "Turn on fast startup". We have an MS Premier case open since last week, still no solution.
Jun 03 2020 08:36 PM
Jun 10 2020 05:18 AM
@Thelink73 MS provided us with a private hotfix for limited testing for a few days that seems to have resolved the issue. However, it is not included in June Tuesday patches. As we would like our test PCs to received regular June patching, the recommendation is to always remove any private hotfix before Before we can receive the We had to remove the private hotfix before installing a public release patch to avoid the potential issues.
Microsoft Support has now informed us that the fix is tentatively scheduled for July’s patch release cycle.
We have advised users' PC that is affected by this issue to use a workaround with putting PC to "Sleep" for overnight instead of Shutdown PC daily to avoid the daily crashes.
Jun 10 2020 07:41 AM
Jun 12 2020 04:26 AM
Jun 12 2020 11:12 AM - edited Jun 12 2020 11:14 AM
@Marius6299 I opened a ticket on this too; uploaded event viewer logs and can confirm the following:
Additionally, I referenced this article with in the ticket, so Microsoft SHOULD be watching. :)
Jun 12 2020 01:24 PM
@Marius6299 Yes, we have an MS case open and have tested a private Hotfix that seems to address the problem. We have to remove the private hotfix to allow the latest June CU to installed. MS has informed us that the fix is tentatively scheduled for July Cumulative updates.
Jun 18 2020 08:19 AM - edited Jun 18 2020 08:20 AM
@lphamwe are seeing this issue on a 2019 RDS server. Seems the issue is not directly related to startup, but rather is triggered occasionally by user logons. Issues started within 2 days after KB4551853 was installed. It's possible the issue is more likely to happen soon after a reboot, but I don't have enough datapoints yet to confirm. The two most recent lsass terminations both happened within 12 hours after a reboot of the server, however in some of the cases there were already a number of users logged on and working for several hours before lsass died. Possibly there is one (or more) user whose profile triggers the failure when they log on to the server. Going to try removing KB4551853 and see if that makes any difference.
Jul 14 2020 01:40 PM
@lpham The fixed is finally here...