When an application calls the LsaLogonUser function together with the KERB_TICKET_LOGON structure to submit an authentication request on a Windows Server 2008-based computer or on a Windows Vista Service pack 1 (SP1)-based computer, the LsaLogonUser function returns an ERROR_HANDLE_NOT_CLOSABLE error code. Additionally, the Lsass.exe process crashes. Additionally, you receive the following message, and then the computer restarts:

You are about to be logged off
Windows has encountered a critical problem and will restart automatically in one minute. Please save your work now.

After the computer restarts, the following event is logged in the event log:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Description: Application popup:
System Shutdown: The system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM. Shutdown will begin in number seconds. Shutdown message: The system process 'C: \WINDOWS\system32\lsass.exe' terminated unexpectedly with status code error code. The system will now shut down and restart.

This problem occurs if the application submits the authentication request by using stored credentials information on the computer.