Domain Controller 2019 Event ID 1074, Reason Code: 0x50006 Lsass.exe terminated unexpectedly

%3CLINGO-SUB%20id%3D%22lingo-sub-2517649%22%20slang%3D%22en-US%22%3EDomain%20Controller%202019%20Event%20ID%201074%2C%20Reason%20Code%3A%200x50006%20Lsass.exe%20terminated%20unexpectedly%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2517649%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20process%20wininit.exe%20has%20initiated%20the%20restart%20of%20computer%20Domain%20Controller%202019%20on%20behalf%20of%20user%20for%20the%20following%20reason%3A%20No%20title%20for%20this%20reason%20could%20be%20found%3CBR%20%2F%3EReason%20Code%3A%200x50006%3CBR%20%2F%3EShutdown%20Type%3A%20restart%3CBR%20%2F%3EComment%3A%20The%20system%20process%20'C%3A%5CWindows%5Csystem32%5Clsass.exe'%20terminated%20unexpectedly%20with%20status%20code%20-1073740767.%20The%20system%20will%20now%20shut%20down%20and%20restart.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EFaulting%20application%20name%3A%20lsass.exe%2C%20version%3A%2010.0.17763.1%2C%20time%20stamp%3A%200xf1beaffa%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EFaulting%20module%20name%3A%20verifier.dll%2C%20version%3A%2010.0.17763.1%2C%20time%20stamp%3A%200x197d3cfd%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EException%20code%3A%200xc0000421%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EFault%20offset%3A%200x0000000000006646%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EFaulting%20process%20id%3A%200x2a4%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EFaulting%20application%20start%20time%3A%200x01d77174ea850ebe%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EFaulting%20application%20path%3A%20C%3A%5CWindows%5Csystem32%5Clsass.exe%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EFaulting%20module%20path%3A%20C%3A%5CWindows%5CSystem32%5Cverifier.dll%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EReport%20Id%3A%2062e62818-ccba-40c1-a815-e036fe1c42c9%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EFaulting%20package%20full%20name%3A%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EFaulting%20package-relative%20application%20ID%3A%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EI%20detected%20that%20when%20I%20stop%20NETLOGON%20Services%2C%20server%202019%20doesn't%20restart%20unexpectedly.%20But%20when%20start%20NETLOGON%20Services%2C%20it%20still%20restart%20every%205%20~%2010%20minutes.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2517649%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EActive%20Directory%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ENetworking%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2519171%22%20slang%3D%22en-US%22%3ERe%3A%20Domain%20Controller%202019%20Event%20ID%201074%2C%20Reason%20Code%3A%200x50006%20Lsass.exe%20terminated%20unexpectedly%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2519171%22%20slang%3D%22en-US%22%3E%3CP%3EWhat's%20the%20history%20here%3F%20New%20domain%20controller%20or%20new%20problem%3F%20How%20many%20domain%20controllers%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

The process wininit.exe has initiated the restart of computer Domain Controller 2019 on behalf of user for the following reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code -1073740767. The system will now shut down and restart.

 

Faulting application name: lsass.exe, version: 10.0.17763.1, time stamp: 0xf1beaffa
Faulting module name: verifier.dll, version: 10.0.17763.1, time stamp: 0x197d3cfd
Exception code: 0xc0000421
Fault offset: 0x0000000000006646
Faulting process id: 0x2a4
Faulting application start time: 0x01d77174ea850ebe
Faulting application path: C:\Windows\system32\lsass.exe
Faulting module path: C:\Windows\System32\verifier.dll
Report Id: 62e62818-ccba-40c1-a815-e036fe1c42c9
Faulting package full name:
Faulting package-relative application ID:

 

I detected that when I stop NETLOGON Services, server 2019 doesn't restart unexpectedly. But when start NETLOGON Services, it still restart every 5 ~ 10 minutes.

3 Replies

What's the history here? New domain controller or new problem? How many domain controllers?

 

 

@Dave Patrick 

I have plan upgrade AD from 2008 to 2019. On root site have 02 DC2019 (Also have issue "restart unexpected" then fixed by re-creating health mailbox account) but Child domain is not resolved. In this site, I forcing install DC2012 to client connect normally and with DC2016 & DC2019, if start NETLOGON services. they are rebooted unexpected. 

I doubt that some suspicious client attacking thought NETLOGON services. :( 

Please save me. This issue still not resolve for 3 months

I can still only understand about a third of this. Upgrading domain controllers in this broken environment is never recommended. You may want to restore a recent known good backup and work from there.