Microsoft KB Archive/306748

= Event ID 5000 Message Is Logged After You Restart Your Windows 2000 Server Computer =

Article ID: 306748

Article Last Modified on 10/30/2006

-

APPLIES TO


 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Service Pack 2
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Advanced Server

-



This article was previously published under Q306748



SYMPTOMS
Your Windows 2000 Server computer stops responding, and after you restart the server computer, the following event ID message is logged in the System log: Source: LsaSrv

Category: (1)

Type: Error

Event ID: 5000

Description: &quot;The security package NTLM generated an exception. The package is now disabled. The exception information is the data.&quot;

You may also receive an error message that the Lsass service has experienced an access violation.



CAUSE
This problem occurs because a user who belongs to more than 1,024 Active Directory directory service groups tries to connect to a Windows 2000 member server or to an Internet Information Services (IIS) server by using NTLM authentication. The Lsass service may experience an error and report that the NTLM service has been disabled. The server does not permit the log on, and the event ID message is logged.



RESOLUTION
To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

324953 List of Security Fixes in Windows 2000 Service Pack 3



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

Keywords: kbbug kbqfe kbwin2000sp3fix kbpending KB306748

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.