The Lsass.exe process crashes when the Network Service account runs a service that calls the IADsUser::ChangePassword method to change the machine account password of the member server that is running the service
Consider the following scenario:
- You run a service on a member server that is running Windows Server 2008 or Windows Vista in an Active Directory domain.
- The service runs under the Network Service account.
- The service calls the IADsUser::ChangePassword method to change the machine account password of the member server.
In this scenario, the Lsass.exe process crashes because of an access violation error. You receive the following error message:
You are about to be logged off Windows has encountered a critical problem and will restart automatically in one minute. Please save your work now.
After the computer restarts, you find that the following event is logged in the event log:
Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Description: Application popup:
System Shutdown: The system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM. Shutdown will begin in number seconds. Shutdown message: The system process ‘C: \WINDOWS\system32\lsass.exe’ terminated unexpectedly with status code error code . The system will now shut down and restart.
For more information on this issue, including potential causes, workarounds, and resolutions, see: Microsoft KB Article KB969837.