Microsoft KB Archive/938482

= The Lsass.exe process may stop responding on a Windows Server 2003-based computer or on a Windows XP-based computer that is in an Active Directory domain environment =

Article ID: 938482

Article Last Modified on 10/11/2007

-

APPLIES TO

 Microsoft Windows Server 2003 Service Pack 2, when used with:  Microsoft Windows Server 2003, Standard Edition (32-bit x86)

 Microsoft Windows Server 2003, Web Edition

 Microsoft Windows Server 2003, Enterprise Edition

 Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)</li></ul>

 Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems</li></ul>

 Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems</li></ul>

 Microsoft Windows Server 2003, Standard x64 Edition</li></ul>

 Microsoft Windows Server 2003, Enterprise x64 Edition</li></ul>

 Microsoft Windows Server 2003, Datacenter x64 Edition</li></ul> </li> Microsoft Windows XP Service Pack 2, when used with:  Microsoft Windows XP Professional</li></ul> </li></ul>

-

<div class="symptoms_section">

SYMPTOMS
In an Active Directory domain environment, the Lsass.exe process may stop responding on a Microsoft Windows Server 2003-based computer or on a Microsoft Windows XP-based computer.

In this situation, you receive the following error message:

System Shutdown - The system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost.

This shutdown was initiated by NT AUTHORITY\SYSTEM. Shutdown will begin in  seconds.

Shutdown message: The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code. The system will now shut down and restart.

Additionally, the following event is logged in the Application log: Event Type: Information

Event Source: Application Error

Event Category: (100)

Event ID: 1004

Description:

Reporting queued error: faulting application lsass.exe, version, faulting module ipsecsvc.dll, version 5.2.3790.3959, fault address.

This problem may occur if the following conditions are true:  Some Internet Protocol Security (Ipsec) policies are configured to help secure network communication.</li> Security settings are customized for all Group Policy objects (GPOs) that are applied to domain computers. Specifically, the Everyone group and the Authenticated Users group do not have permission to access any GPO. All other groups, such as the Domain Users group and the Domain Computers group, have permission to access the GPOs.</li> <li>On Windows Server 2003-based computers, Windows Server 2003 Service Pack 2 is installed.</li> <li>On Windows XP-based computers, a hotfix is installed. This hotfix has a file version that is either later than or equal to the file version that is described in the following Microsoft Knowledge Base article:

895406 All policies on a Windows XP-based computer are refreshed when you enable an IPsec policy

</li></ul>

<div class="cause_section">

CAUSE
This problem occurs because the Ipsec module (IPSecsvc.dll) generates an error when the Everyone group and the Authenticated Users group do not have the Read permission and the Apply Policy permission to access any GPO.

<div class="workaround_section">

WORKAROUND
To work around this problem, make sure that the Authenticated Users group has the Read permission and the Apply Policy permission to access at least one GPO that is applied to domain computers. To do this, grant the Authenticated Users group the Read permission and the Apply Policy permission to the default domain policy.

<div class="status_section">

STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section.

Keywords: kberrmsg kbtshoot kbprb kbexpertiseinter KB938482

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.