Symptoms. Windows Server 2012 R2-based server restarts unexpectedly, and you may find the following events in Event Viewer: Event ID 1015: A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.

This update addresses a known issue that affects the Local Security Authority Subsystem Service (LSASS). It might leak memory on domain controllers (DCs). This issue occurs after you install KB5035885 (March 12, 2024).

Fixes an issue in which Lsass.exe process crashes and error code 255 is logged because of a CNF NTDS Settings object in Active Directory on Windows 8.1, Windows Server 2012 R2, Windows 8, Windows Server 2012, Windows 7, Windows Server 2008 R2, Windows Vista, or Windows Server 2008.

Notes. The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:

On a domain controller that is running Microsoft Windows Server 2003, the Local Security Authentication Server (Lsass.exe) process may stop responding if the following conditions are true: You have many external trusts and many simultaneous logon requests. These logon requests do not specify the domain name.

This article describes an issue that occurs when a Windows Server 2012 R2-based domain controller (DC) runs under low memory. A hotfix is available to resolve this issue. Before you install this hotfix, check out the prerequisites and the hotfix replacement in this article.

Describes an issue in which LSASS fails and returns a "0xc0000005" error message when you run a "Full Import" command on AAD Connect against a Windows Server 2012 R2 domain controller. Provides a resolution.

When you restart a Microsoft Windows Server 2003 server that is a domain controller, you may receive the following error message: lsass.exe-System Error: Security Accounts Manager initialization failed because of the following error: Directory Service cannot start. Error Status: 0xc00002e1.

This issue occurs because the obsolete MailboxDeliveryAvailability health management probe, monitor, and responder that are defined on Microsoft Exchange Health Manager service startup are still enabled by default.

Fixes an issue in which both the Svchost.exe process and the Lsm.exe process consume lots of CPU resources. This issues occurs after you remotely connect to a computer that is running Windows 7 or Windows Server 2008 R2.