Microsoft KB Archive/923241

= The Lsass.exe process may stop responding if you have many external trusts on a Windows Server 2003-based domain controller =

Article ID: 923241

Article Last Modified on 4/2/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
 * Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems

-



Important This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry



SYMPTOMS
On a domain controller that is running Microsoft Windows Server 2003, the Local Security Authentication Server (Lsass.exe) process may stop responding if the following conditions are true:
 * You have many external trusts and many simultaneous logon requests.
 * These logon requests do not specify the domain name.



CAUSE
This problem occurs because the Lsass.exe process runs out of resources if the number of simultaneous logons multiplied by the number of trusts is more than 1,000.



RESOLUTION
Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To resolve this problem, apply the latest service pack for Windows Server 2003 or the following hotfix. Then, enable the NeverPing setting.

Important This setting may cause unwanted side effects if you have clients that do not specify domain names in the logon requests. These clients may include Microsoft Windows 98 clients and Outlook Web Access. These clients work correctly if the user accounts that the logon requests use are in the Windows Server 2003 domain or in the global catalog. Problems occur only if a user account is in an external domain.

To enable the NeverPing setting, follow these steps:  Click Start, click Run, type Regedit, and then click OK. Locate the following registry subkey:

 Right-click this subkey, point to New, and then click DWORD Value. Type NeverPing as the registry entry name, and then press ENTER. Double-click NeverPing, type 1 in the Value data text box, and then click OK. Exit Registry Editor.</li></ol>

Service pack information
To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

889100 How to obtain the latest service pack for Windows Server 2003

Prerequisites
No prerequisites are required.

Restart requirement
You must restart the computer after you apply this hotfix.

Hotfix replacement information
This hotfix does not replace any other hotfixes.

File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Server 2003, Itanium-based versions
<div class="status_section">

STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section. This problem was first corrected in Windows Server 2003 Service Pack 2.

<div class="moreinformation_section">

MORE INFORMATION
For more information about a similar problem in Microsoft Windows 2000, click the following article number to view the article in the Microsoft Knowledge Base:

825107 The Lsass.exe process may stop responding if you have many external trusts on a Windows 2000 Server-based domain controller

Keywords: kbwinserv2003sp2fix kbwinserv2003sp1fix kbexpertiseinter kbbug kbfix kbhotfixserver kbqfe kbpubtypekc KB923241

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.