Lsass.exe process crashes and error code 255 is logged because of a CNF NTDS Settings object in Active Directory on Windows

Applies to: Windows Server 2012 R2 DatacenterWindows Server 2012 R2 StandardWindows Server 2012 R2 Essentials More

Not sure if this is the right fix? We've added this issue to our memory dump diagnostic which can confirm.
This article describes an issue that occurs in the Active Directory in Windows 8.1, Windows Server 2012 R2, Windows 8, Windows Server 2012, Windows 7, Windows Server 2008 R2, Windows Vista Service Pack 2 (SP2), or Windows Server 2008 SP2. A hotfix and an update are available to resolve this issue except for Windows 8 and Windows Server 2012. The hotfix have a prerequisite.

Symptoms


When a NTDS Settings conflicting (CNF) object is created in the Active Directory, the Lsass.exe process may crash and unexpectedly reboot the Domain Controller. Additionally, the following events are logged in the System log:

Log Name: Application
Source: Application Error
Date: DateTime
Event ID: 1000
Task Category: Application Crashing Events
Level: Error
Keywords: Classic
User: N/A
Computer: ComputerName
Description:
Faulting application name: lsass.exe, version: 6.1.7601.17725, time stamp: 0x4ec483fc
Faulting module name: ntdll.dll, version: 6.1.7601.18229, time stamp: 0x51fb164a
Exception code: 0xc0000374
Fault offset: 0x00000000000c4102
Faulting process id: 0x1f4
Faulting application start time: 0x01ceb94c671de3dd
Faulting application path: C:\Windows\system32\lsass.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 80a2cd04-2540-11e3-99e2-441ea1d316a4
Faulting package full name: %14
Faulting package-relative application ID: %15


Log Name: Application
Source: Microsoft-Windows-Wininit
Date: DateTime
Event ID: 1015
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: ComputerName
Description:
A critical system process, C:\Windows\system32\lsass.exe, failed with status code 255. The machine must now be restarted.

Note The NTDS Settings represents the domain controller in the replication system. The NTDS Settings object stores connection objects, which make replication possible between two or more domain controllers.

Resolution


To resolve this issue, we have released an update rollup for Windows 8.1 and Windows Server 2012 R2. And we have released a hotfix for Windows 7, Windows Server 2008 R2, Windows Vista, and Windows Server 2008. We also have a workaround for Windows 8.1, Windows Server 2012 R2, Windows 8, Windows Server 2012, Windows 7, Windows Server 2008 R2, Windows Vista, and Windows Server 2008 SP2.

Update information for Windows 8.1 and Windows Server 2012 R2

To resolve this issue in Windows 8.1 or Windows Server 2012 R2, install update rollup 2955164. For more information about how to obtain this update rollup package, click the following article number to view the article in the Microsoft Knowledge Base:
2955164 Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 update rollup: May 2014

Workaround for Windows 8 and Windows Server 2012

To work around this issue, delete conflict objects manually according to the Workaround section.

Hotfix information for Windows 7 and Windows Server 2008 R2

To resolve this issue in Windows 7 or Windows Server 2008 R2, install hotfix 2862304. For more information about how to obtain the hotfix, click the following article number to view the article in the Microsoft Knowledge Base:
2862304 AD DS or AD LDS responds slowly to complex LDAP query that has a deeply nested filter on Windows server

Hotfix information for Windows Vista and Windows Server 2008

To resolve this issue in Windows Vista and Windows Server 2008, install the hotfix that is described in this article.

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix Download Available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft website: Note The "Hotfix Download Available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.


Prerequisites

To apply this hotfix, you must be running Windows Vista Service Pack 2 (SP2) or Windows Server 2008 Service Pack 2 (SP2).

For more information about how to obtain a Windows Vista service pack, click the following article number to view the article in the Microsoft Knowledge Base:
935791 How to obtain the latest Windows Vista service pack
For more information about how to obtain a Windows Server 2008 service pack, click the following article number to view the article in the Microsoft Knowledge Base:
968849 How to obtain the latest service pack for Windows Server 2008

Registry information

To apply this hotfix, you do not have to make any changes to the registry.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.



Status


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Workaround


To work around this issue, delete any duplicate NTDS setting objects that contain "CNF:" in the Common Name.

Note NTDS Settings objects are located in the Configuration partition, under Sites -> SiteName->Servers->ServerName. Each server should have only one NTDS Settings object that is "NTDS Settings".

Follow these steps to search for a Conflict (CNF) NTDS Settings object:
  • Open ldp.exe or ADSIEDIT.
  • Connect and bind to the Domain Controller.
  • Search the Configuration partition for any object where the Common Name contains "CNF:" and the object class is nTDSDSA. For example, LDAP search filter may look like this:
    BaseDN = CN=Configuration,DC=contoso,DC=com(&(ObjectClass=nTDSDSA)(CN=*CNF*))

More Information


For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

Additional file information

Additional file information for Windows 7 and Windows Server 2008 R2

Additional files for all supported x86-based versions of Windows 7
File propertyValue
File nameX86_dca75c9c001bc1a0ff6491f0672eb5ef_31bf3856ad364e35_6.1.7601.22547_none_b9e7ad373c53f855.manifest
File versionNot applicable
File size712
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameX86_microsoft-windows-d..toryservices-ntdsai_31bf3856ad364e35_6.1.7601.22547_none_f339c10f309839c6.manifest
File versionNot applicable
File size3,527
Date (UTC)20-Dec-2013
Time (UTC)02:38
Additional files for all supported x64-based versions of Windows 7 and Windows Server 2008 R2
File propertyValue
File nameAmd64_0b2d371678e54d7db02a7f762b9c49af_31bf3856ad364e35_6.1.7601.22547_none_a083a71df83b04f2.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_0d1f8e54811cc801022655b301d8b0ba_31bf3856ad364e35_6.1.7601.22547_none_673e29f0df23e751.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_1e6a586438ee5137a751e9abf5ffe238_31bf3856ad364e35_6.1.7601.22547_none_ed13ce770584847b.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_25bb6189a8a959842fee6ebe2400466f_31bf3856ad364e35_6.1.7601.22547_none_ffbc69faf8081320.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_299198319017bb05d073daaff2705b58_31bf3856ad364e35_6.1.7601.22547_none_3efbd210ccd846d3.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_2f7150761908229198c4b47249dad738_31bf3856ad364e35_6.1.7601.22547_none_60e11babcad4bb37.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_469662f93f09c81e11fcdc490f1ce3c9_31bf3856ad364e35_6.1.7601.22547_none_31b2935ed300a5a8.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_46aced0b8f5070090e1c313d61b9c854_31bf3856ad364e35_6.1.7601.22547_none_df7228e5ac61fde0.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_6546734a689a95a1e8b82db0232a339a_31bf3856ad364e35_6.1.7601.22547_none_cb935ad4e56d8759.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_77a19593bf53497c59feccfbc9c621f2_31bf3856ad364e35_6.1.7601.22547_none_e9995a96f3695ab8.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_7a2643644f4eeb395733359a04636669_31bf3856ad364e35_6.1.7601.22547_none_4b368898e7aae439.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_8af74d2cb9b0c25769c59918eff8359e_31bf3856ad364e35_6.1.7601.22547_none_2b21dba81ce3df98.manifest
File versionNot applicable
File size716
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_8b284cd7617e6fc25d14bbed3e2a1e88_31bf3856ad364e35_6.1.7601.22547_none_206fdbf06f4c9bf8.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_9eb8639a05f463743d157435f4e61116_31bf3856ad364e35_6.1.7601.22547_none_96b16fe40d5fde02.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_a0734e7b2380a7a97335ed186f6000cb_31bf3856ad364e35_6.1.7601.22547_none_1f2707d744d3ca4b.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_a84f5839d0aeb46616caafc1d6b7bd1a_31bf3856ad364e35_6.1.7601.22547_none_ee213803606e595d.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_c825bf00994f3bc089f72907f3be445c_31bf3856ad364e35_6.1.7601.22547_none_15b8d85648370380.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_df4f11e2acec10cbafca7699284472e2_31bf3856ad364e35_6.1.7601.22547_none_b42adaadd1ad997d.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_f8bd7f695e9ef32c037a034dce048609_31bf3856ad364e35_6.1.7601.22547_none_93623514ae8f4c17.manifest
File versionNot applicable
File size728
Date (UTC)23-Dec-2013
Time (UTC)07:27
File nameAmd64_microsoft-windows-d..toryservices-ntdsai_31bf3856ad364e35_6.1.7601.22547_none_4f585c92e8f5aafc.manifest
File versionNot applicable
File size3,531
Date (UTC)20-Dec-2013
Time (UTC)03:07

Additional file information for Windows Vista and Windows Server 2008 R2

Additional files for all supported x86-based versions of Windows Vista
File propertyValue
File nameX86_1507d8d444c8f3267eaf32774aa18dc3_31bf3856ad364e35_6.0.6002.23372_none_49e8f42fa3f4d442.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_1cfcc22922df4ee06ff1eab680ff1c32_31bf3856ad364e35_6.0.6002.23372_none_0679c9bbcf9b4791.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_1d35d339f969ec33050041d32e21ed2d_31bf3856ad364e35_6.0.6002.23372_none_349430d2fc323440.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_331f86b15968aa17ad852c7cb8bc1768_31bf3856ad364e35_6.0.6002.23372_none_e0335bb4bc4fcf38.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_3cf9e038a29492478d0aba8fe5d54ef9_31bf3856ad364e35_6.0.6002.23372_none_21df6fd9af1062ca.manifest
File versionNot applicable
File size712
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_49905f81b18d7f782a0f35269ff041ef_31bf3856ad364e35_6.0.6002.23372_none_5f4e703d66f9f525.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_57e02921275b587bea7b827339d8bd6a_31bf3856ad364e35_6.0.6002.23372_none_dc936c798b36ed81.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_6786a3cf8a8dee3d62f410d36f7a4a14_31bf3856ad364e35_6.0.6002.23372_none_088e69cb0db31c66.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_8367645e18d553250775551287a0bedc_31bf3856ad364e35_6.0.6002.23372_none_4305c3046a8b4ed5.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_8def635bf1e37f74811bad78af8795c7_31bf3856ad364e35_6.0.6002.23372_none_f5a6ec0e3aae6f10.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_94a9ee3b75aab6d0d0c9cf8757cb9783_31bf3856ad364e35_6.0.6002.23372_none_9487d9b7a2910b80.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_ab871b39a0500caf143be7046c08099c_31bf3856ad364e35_6.0.6002.23372_none_5cf86d1b8b63b399.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_b48eb89c01ec5a8a9ba3d3b539228214_31bf3856ad364e35_6.0.6002.23372_none_b9856e428cba02af.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_b9b10992842c7408306bdd591b8f19ff_31bf3856ad364e35_6.0.6002.23372_none_9b31c5d82d165dda.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_d17e3872bd451902dc038c202b303f10_31bf3856ad364e35_6.0.6002.23372_none_987edad325165362.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_d6702e6ea3d5af062419339eba58264d_31bf3856ad364e35_6.0.6002.23372_none_e3d6b9491f50532d.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_d900cd2654e4e3aa43929f7506c21733_31bf3856ad364e35_6.0.6002.23372_none_def400d5140509ae.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_f7ba09372090c46c601897d0a75a5f4d_31bf3856ad364e35_6.0.6002.23372_none_366a63049d900490.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_fe1cb08b6048857800689324da70cb1b_31bf3856ad364e35_6.0.6002.23372_none_9baff02d225c661d.manifest
File versionNot applicable
File size724
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameX86_microsoft-windows-d..toryservices-ntdsai_31bf3856ad364e35_6.0.6002.23372_none_f2ec9475cf9dbb36.manifest
File versionNot applicable
File size12,574
Date (UTC)09-Apr-2014
Time (UTC)04:44
PlatformNot applicable
Additional files for all supported x64-based versions of Windows Vista and Windows Server 2008
File propertyValue
File nameAmd64_0d018692aadb51a8b1ae2c1d0ea3757c_31bf3856ad364e35_6.0.6002.23372_none_c4a15c3ea368b0cb.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_11ca48fd21735343094771ab237cb52f_31bf3856ad364e35_6.0.6002.23372_none_4d636fa88547646f.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_15d8cea60abc83ce76e84dcec85d565f_31bf3856ad364e35_6.0.6002.23372_none_28e66c11ecb44bc8.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_286fedf45c84c553f8dcadb633acea9d_31bf3856ad364e35_6.0.6002.23372_none_7b08f5a541987448.manifest
File versionNot applicable
File size716
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_313d40965457819481d74d4ebf8c0045_31bf3856ad364e35_6.0.6002.23372_none_66ae4a4ead9f923c.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_4220fe3ce361fb6ff5122b36a604aad5_31bf3856ad364e35_6.0.6002.23372_none_29cda1d4b24d8259.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_477525fe8e9326d4dcead5a700306225_31bf3856ad364e35_6.0.6002.23372_none_6623bdce2635235c.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_5ec0ea47227e6c555b643f973e2c7e1d_31bf3856ad364e35_6.0.6002.23372_none_03dad0ebeb4b4fa5.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_6b44c17eba90ea95b2607e8dc8932c54_31bf3856ad364e35_6.0.6002.23372_none_9f25cbb26187aa93.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_7bc45fdeb43a33c7a58392f8143e97da_31bf3856ad364e35_6.0.6002.23372_none_da11faf36536861c.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_8850f591f6a9015764797e1ae031cfd7_31bf3856ad364e35_6.0.6002.23372_none_35303e960f13020a.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_8c06b5512f919d850aade11e96e0801d_31bf3856ad364e35_6.0.6002.23372_none_f4fe30c7ef7fbc99.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_8f537ede6024e102fa55df42b33b4f95_31bf3856ad364e35_6.0.6002.23372_none_fbfce6b7783b8270.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_9c25a48bbba94e86df6c978fa5abe012_31bf3856ad364e35_6.0.6002.23372_none_7c3681ec09caf743.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_ad18df83181e1ed132215a2fd1a8ce89_31bf3856ad364e35_6.0.6002.23372_none_cf54a7c12e4fc7ba.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_c334ce88e992b8d063ddd3953e93f6cd_31bf3856ad364e35_6.0.6002.23372_none_63e35f662554e539.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_c7aae66b2b3b7345c0229feb123fc45e_31bf3856ad364e35_6.0.6002.23372_none_1e71762b17284019.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_dfd0ab36085b8883355a90c847449983_31bf3856ad364e35_6.0.6002.23372_none_0faaca4b2e0e7e0a.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_ebc63e857184e5c4d9bbf386962e1aa8_31bf3856ad364e35_6.0.6002.23372_none_b4eab722304e2c87.manifest
File versionNot applicable
File size728
Date (UTC)09-Apr-2014
Time (UTC)10:20
PlatformNot applicable
File nameAmd64_microsoft-windows-d..toryservices-ntdsai_31bf3856ad364e35_6.0.6002.23372_none_4f0b2ff987fb2c6c.manifest
File versionNot applicable
File size12,632
Date (UTC)09-Apr-2014
Time (UTC)05:29
PlatformNot applicable