Microsoft KB Archive/828873

= LsaSrv event 5000 disables authentication packages =

Article ID: 828873

Article Last Modified on 10/11/2007

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Datacenter Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows XP Professional
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition
 * Microsoft Windows Server 2003, Web Edition
 * Microsoft Windows Server 2003, Standard x64 Edition
 * Microsoft Windows Server 2003, Enterprise x64 Edition

-



SYMPTOMS
An authentication package on a Microsoft Windows computer may not run as expected, and the following event may be logged in the system log: Event Type: Error

Event Source: LsaSrv

Event Category: Devices

Event ID: 5000

Description:

The security package  generated an exception. The package is now disabled. The exception information is the data.

Data:

0000: c0000005 00000000 00000000 78566df3

...



CAUSE
This issue may occur if there is an exception to an authentication package.



RESOLUTION
To resolve this problem, restart the computer.



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.



MORE INFORMATION
The Local Security Authentication Subsystem (LSASS) process is designed to help protect itself from bugs in authentication packages. It identifies the exception that the bug causes and then terminates the thread that caused the exception. Additionally, the package is not loaded again in the same instance of LSASS. Because exceptions are generally access violations, the integrity of the LSASS process cannot be guaranteed, and therefore Microsoft recommends that you restart the computer. The exception does not create a memory dump file, and the context of the exception is lost after the event is logged.

Technical support for Windows x64 editions
Your hardware manufacturer provides technical support and assistance for Microsoft Windows x64 editions. Your hardware manufacturer provides support because a Windows x64 edition was included with your hardware. Your hardware manufacturer might have customized the Windows x64 edition installation with unique components. Unique components might include specific device drivers or might include optional settings to maximize the performance of the hardware. Microsoft will provide reasonable-effort assistance if you need technical help with your Windows x64 edition. However, you might have to contact your manufacturer directly. Your manufacturer is best qualified to support the software that your manufacturer installed on the hardware.

For product information about Microsoft Windows XP Professional x64 Edition, visit the following Microsoft Web site:

http://www.microsoft.com/windowsxp/64bit/default.mspx

For product information about Microsoft Windows Server 2003 x64 editions, visit the following Microsoft Web site:

http://www.microsoft.com/windowsserver2003/64bit/x64/default.mspx

Additional query words: Winx64 Windowsx64 64bit 64-bit

Keywords: kbbug kbwinservnetwork KB828873

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.