Microsoft KB Archive/923241

From BetaArchive Wiki

Article ID: 923241

Article Last Modified on 4/2/2007



APPLIES TO

  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
  • Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems



Important This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry


SYMPTOMS

On a domain controller that is running Microsoft Windows Server 2003, the Local Security Authentication Server (Lsass.exe) process may stop responding if the following conditions are true:

  • You have many external trusts and many simultaneous logon requests.
  • These logon requests do not specify the domain name.


CAUSE

This problem occurs because the Lsass.exe process runs out of resources if the number of simultaneous logons multiplied by the number of trusts is more than 1,000.

RESOLUTION

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To resolve this problem, apply the latest service pack for Windows Server 2003 or the following hotfix. Then, enable the NeverPing setting.

Important This setting may cause unwanted side effects if you have clients that do not specify domain names in the logon requests. These clients may include Microsoft Windows 98 clients and Outlook Web Access. These clients work correctly if the user accounts that the logon requests use are in the Windows Server 2003 domain or in the global catalog. Problems occur only if a user account is in an external domain.

To enable the NeverPing setting, follow these steps:

  1. Click Start, click Run, type Regedit, and then click OK.
  2. Locate the following registry subkey:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

  3. Right-click this subkey, point to New, and then click DWORD Value.
  4. Type NeverPing as the registry entry name, and then press ENTER.
  5. Double-click NeverPing, type 1 in the Value data text box, and then click OK.
  6. Exit Registry Editor.

Service pack information

To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

889100 How to obtain the latest service pack for Windows Server 2003


Hotfix information

Prerequisites

No prerequisites are required.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Server 2003, x86-based versions
File name File version File size Date Time Platform
Netlogon.dll 5.2.3790.573 419,328 08-Aug-2006 13:01 x86
Windows Server 2003, Itanium-based versions
File name File version File size Date Time Platform Service branch
Netlogon.dll 5.2.3790.573 959,488 07-Aug-2006 21:58 IA-64 RTMQFE
Wnetlogon.dll 5.2.3790.573 419,328 07-Aug-2006 22:01 x86 WOW


STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Windows Server 2003 Service Pack 2.

MORE INFORMATION

For more information about a similar problem in Microsoft Windows 2000, click the following article number to view the article in the Microsoft Knowledge Base:

825107 The Lsass.exe process may stop responding if you have many external trusts on a Windows 2000 Server-based domain controller


Keywords: kbwinserv2003sp2fix kbwinserv2003sp1fix kbexpertiseinter kbbug kbfix kbhotfixserver kbqfe kbpubtypekc KB923241