Access Violation in Lsass.exe Due to Incorrect Buffer Size

Article translations Article translations
Article ID: 154087 - View products that this article applies to.
This article was previously published under Q154087
This article has been archived. It is offered "as is" and will no longer be updated.
Expand all | Collapse all

SYMPTOMS

While running Windows NT, you may receive an Access Violation error message in Lsass.exe. After this error occurs, you cannot logon locally and the administrative tools that rely on LSA/LSARPC (such as Event Viewer and Server Manager) do not function.

CAUSE

The failure occurs when a remote client connects to the Local Security Authority over a named pipe and passes an incorrect buffer size (fragment length).

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows NT 4.0 or Windows NT Server 4.0, Terminal Server Edition. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
152734 How to Obtain the Latest Windows NT 4.0 Service Pack



Microsoft has updated Lsasrv.dll to correct this problem and posted the updated version to the following Internet location.

NOTE: Lsa-fix has been superseded by Lsa2-fix.

For your convenience, the English version of this post-SP3 hotfix has been posted to the following Internet location. However, Microsoft recommends that you install Windows NT 4.0 Service Pack 4 to correct this problem.

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/ hotfixes-postSP3/lsa2-fix/

You can find the original hotfix at the following Microsoft ftp site:

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/ hotfixes-postSP3/archive/lsa-fix/

WARNING: If you install the original (archived) version of this hotfix AFTER you apply the later version, your system may become unusable. Microsoft does not recommend you install the original hotfix after applying the later version.

STATUS

Microsoft has confirmed this problem could result in some degree of security vulnerability in Windows NT version 4.0. This problem was first corrected in Windows NT 4.0 Service Pack 4.0 and Windows NT Server 4.0, Terminal Server Edition Service Pack 4.

Properties

Article ID: 154087 - Last Review: October 1, 2013 - Revision: 2.2
APPLIES TO
  • Microsoft Windows NT Server 4.0, Terminal Server Edition
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT 4.0 Service Pack 3
Keywords: 
kbnosurvey kbarchive kbhotfixserver kbqfe kbbug kberrmsg kbfile kbfix KB154087

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com