Microsoft KB Archive/306479

= Dr. Watson Stops Responding While Writing Dump for Lsass.exe =

Article ID: 306479

Article Last Modified on 10/31/2006

-

APPLIES TO


 * Microsoft Windows 2000 Service Pack 2
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Service Pack 2

-



This article was previously published under Q306479



SYMPTOMS
When Lsass.exe experiences an access violation and Dr. Watson tries to write a memory dump for it, Dr. Watson may stop responding (hang). This behavior can occur if either of the following conditions are true:
 * Drive E is mapped to a network share.

-or-
 * The symbol file Msvcrt.pdb for Msvcrt.dll is installed in the symbol path.



CAUSE
This behavior occurs because Msvcrt.pdb has a hard-coded path to drive E. The DBGHELP library follows this path and tries to gain access to drive E. When the redirector is called, it needs to retrieve a security context for the caller. But it cannot do this because Lsass is stopped in the debugger (Dr. Watson). This causes a deadlock and causes Dr Watson to stop responding.

If Dr. Watson were running for a different process under the System context, it would retrieve the credentials, but it would then receive an Access Denied message because the drive was mapped by the interactive user.



RESOLUTION
To work around this issue, do either of the following:
 * Unmap drive letter E.

Then the drive is not found and the open request fails.

-or-
 * Delete the symbol file for Msvcrt.dll.

Dr. Watson logs are usually readable without this symbol, and it does not affect the dump.



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

Keywords: kbenv kbprb KB306479

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.