Article ID: 923241 - View products that this article applies to.
Important This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/256986/ )Description of the Microsoft Windows registry
On a domain controller that is running Microsoft Windows Server 2003, the Local Security Authentication Server (Lsass.exe) process may stop responding if the following conditions are true:
This problem occurs because the Lsass.exe process runs out of resources if the number of simultaneous logons multiplied by the number of trusts is more than 1,000.
Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
To resolve this problem, apply the latest service pack for Windows Server 2003 or the following hotfix. Then, enable the NeverPing setting.
Important This setting may cause unwanted side effects if you have clients that do not specify domain names in the logon requests. These clients may include Microsoft Windows 98 clients and Outlook Web Access. These clients work correctly if the user accounts that the logon requests use are in the Windows Server 2003 domain or in the global catalog. Problems occur only if a user account is in an external domain.
To enable the NeverPing setting, follow these steps:
Service pack informationTo resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/889100/ )How to obtain the latest service pack for Windows Server 2003
Hotfix informationA supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.
If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.
Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=supportNote The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
PrerequisitesNo prerequisites are required.
Restart requirementYou must restart the computer after you apply this hotfix.
Hotfix replacement informationThis hotfix does not replace any other hotfixes.
File informationThe English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
Windows Server 2003, x86-based versions
Collapse this tableExpand this table
Windows Server 2003, Itanium-based versions
Collapse this tableExpand this table
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Windows Server 2003 Service Pack 2.
This issue occurs when applications use legacy NTLM authentication and do not submit the domain the user is associated with when submitting an authentication request. When legacy behavior is required by the client the domain controllers must use legacy methods to locate the user's proper domain so that the authoritative domain for that user can provide verification of the user's credentials. The legacy behavior is a sequential network communication with each domain the domain controller trusts. This issue worsens when there are greater numbers of domains and numbers of authentication requests missing the domain portion of the users credentials.
This concern can be identified in Netlogon service debug logs on the domain controllers by looking for SamLogon entries which display "<nulll>\username". Simply searching the logs for "<null>\" will reveal if the issue is occuring at all.
This concern can worsen legacy authentication performance bottlenecks. For more information on that refer to the Knowledge Base article:
(http://support.microsoft.com/kb/975363)You are intermittently prompted for credentials or experience time-outs when you connect to Authenticated Services
For more information about a similar problem in Microsoft Windows 2000, click the following article number to view the article in the Microsoft Knowledge Base:
825107In some situations, performance issues may still be seen even after configuring the Neverping setting. In those cases the MaxConcurrentApi setting should be set to a higher value. More information on how to estimate the best MaxConcurrentApi setting can be found in the Knowledge Base article below.
(http://support.microsoft.com/kb/825107/ )The Lsass.exe process may stop responding if you have many external trusts on a Windows 2000 Server-based domain controller
(http://support.microsoft.com/kb/http://support.microsoft.com/kb/2688798/ )How to do performance tuning for NTLM authentication by using the MaxConcurrentApi setting
Article ID: 923241 - Last Review: March 30, 2012 - Revision: 7.0