Microsoft KB Archive/300038

= Lsass.exe quits unexpectedly with status code -1073741819 =

Article ID: 300038

Article Last Modified on 10/27/2006

-

APPLIES TO


 * Microsoft Windows 2000 Service Pack 2
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Service Pack 2

-



This article was previously published under Q300038



SYMPTOMS
After you install Windows 2000 Service Pack 2 (SP2) on a Windows 2000-based domain controller, you may receive the following error message:

The system process lsass.exe terminated unexpectedly with status code -1073741819. The system will now shut down and restart.

This error message occurs after every subsequent reboot, usually within 15 minutes of the reboot.



CAUSE
This behavior is caused by an invalid replInterval value in the Configuration container in the properties of a site link.



RESOLUTION
To resolve this problem, obtain the latest service pack for Windows 2000. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to obtain the latest Windows 2000 service pack

To resolve this issue, use either of the following methods:
 * Change the Replicate every value by using the user interface on the site link to be greater than or equal to 15 and less than or equal to 10,080.
 * Use Ldp.exe or Adsiedit.exe to modify the replInterval value. Set the value within the range that is specified above.



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section. This problem was first corrected in Windows 2000 Service Pack 3.



MORE INFORMATION
By default, site links are assigned a value of 180 minutes for the Replicate every value and 100 for the Cost value. Prior to Windows 2000 Service Pack 1 (SP1), you can modify the Replicate every value to less than 15 minutes and more than 10,080 minutes. Setting this value outside of the previously stated range produces an invalid value of 65551 for the replInterval value on each site link that is not using a valid value. If this value is changed before SP1 is installed, and is not updated by using the Site Link user interface after SP1 is applied, the value may be invalid and may cause an access violation in Lsass.exe

Although the Site Link user interface may show a value of 15 minutes, you can verify the value by using Ldp.exe to run the following query against the Configuration container for a given domain:

(&(objectCategory=siteLink)(replInterval>=10081))

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

251057 You can add invalid replication interval and cost values for site link properties

The site link properties, specifically the replInterval value, are stored in the following location:

CN= ,CN=IP,CN=Inter-Site Transports,CN=Sites,DC=Configuration,DC= ,DC=

Note If the message box appears before you are able to log on, Ctrl-Alt-Del will NOT work and you will NOT be able to log on. You will, therefore, not be able to implement the workaround. If this occurs, see the following Microsoft Knowledge Base article for additional information:

306497 Lsass.exe system process unexpectedly quits with a -1073741819 status code

Additional query words: kbDirServices

Keywords: kberrmsg kbfix kbqfe kbwin2000sp3fix kbenv kbprb kbdirservices kbhotfixserver KB300038

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.