Kerberos & lsass errors
in [Windows Servers]
|
From: Alan C on 15 Jan 2007 05:35 We have a w2k3 member server running exchange that periodically reboots for no apparent reason. After each reboot, the system error log contains 3 instances of:- Event Source: LsaSrv Event Category: Security Package Manager Event ID: 5000 Description: The security package Kerberos generated an exception. Followed by:- Event Source: USER32 Event Category: None Event ID: 1074 Description: The Process winlogon.exe has initiated the restart of computer EXSERV on behalf of user for the following reason: No title for this reason could be found Reason Code: 0x50006 Shutdown Type restart Comment: The system process 'C:\WINDOWS\system32.lsass.exe terminated unexpectedly with status code -1073740972. Help please, any clues/suggestions/etc. gratefully accepted. -- ------------------------------------------------------------------------------- This message has been checked for all known viruses. The information contained in this e-mail and any attachments is confidential and may be the subject of legal, professional or other privilege. It is intended for the named addressee only and may not be disclosed to any other parties without the prior permission of the originator.
From: Headbolt on 15 Jan 2007 05:46 I guess the most sensible place to start is patching, is the server totally up to date with all the latest windows and exchange patches ?? If So then I'd suggest re-applying the latest Service pack for Windows and Exchange and then re-patch with all the updates, should hopefully re-install clean versions of the affected files. "Alan C" <nospam(a)noisp.com> wrote in message news:OnRnnDJOHHA.960(a)TK2MSFTNGP04.phx.gbl... > We have a w2k3 member server running exchange that periodically reboots > for no apparent reason. > > After each reboot, the system error log contains 3 instances of:- > Event Source: LsaSrv > Event Category: Security Package Manager > Event ID: 5000 > Description: The security package Kerberos generated an exception. > > Followed by:- > Event Source: USER32 > Event Category: None > Event ID: 1074 > Description: The Process winlogon.exe has initiated the restart of > computer EXSERV on behalf of user for the following reason: No title for > this reason could be found > Reason Code: 0x50006 > Shutdown Type restart > Comment: The system process 'C:\WINDOWS\system32.lsass.exe terminated > unexpectedly with status code -1073740972. > > Help please, any clues/suggestions/etc. gratefully accepted. > -- > ------------------------------------------------------------------------------- > This message has been checked for all known viruses. > > The information contained in this e-mail and any attachments is > confidential and may be the subject of legal, professional or other > privilege. It is intended for the named addressee only and may not be > disclosed to any other parties without the prior permission of the > originator. > > >
From: Alan C on 15 Jan 2007 06:01 It is up to SP1, but I've just noticed that autoupdates is disabled. I'll do all the patches and if the problem reoccurs I'll repost. Thanks for the pointer. "Headbolt" <David.Treadgold(a)Incepta.co.uk> wrote in message news:eofZqJJOHHA.448(a)TK2MSFTNGP04.phx.gbl... >I guess the most sensible place to start is patching, is the server totally >up to date with all the latest windows and exchange patches ?? > > If So then I'd suggest re-applying the latest Service pack for Windows and > Exchange and then re-patch with all the updates, should hopefully > re-install clean versions of the affected files. > > > "Alan C" <nospam(a)noisp.com> wrote in message > news:OnRnnDJOHHA.960(a)TK2MSFTNGP04.phx.gbl... >> We have a w2k3 member server running exchange that periodically reboots >> for no apparent reason. >> >> After each reboot, the system error log contains 3 instances of:- >> Event Source: LsaSrv >> Event Category: Security Package Manager >> Event ID: 5000 >> Description: The security package Kerberos generated an exception. >> >> Followed by:- >> Event Source: USER32 >> Event Category: None >> Event ID: 1074 >> Description: The Process winlogon.exe has initiated the restart of >> computer EXSERV on behalf of user for the following reason: No title for >> this reason could be found >> Reason Code: 0x50006 >> Shutdown Type restart >> Comment: The system process 'C:\WINDOWS\system32.lsass.exe terminated >> unexpectedly with status code -1073740972. >> >> Help please, any clues/suggestions/etc. gratefully accepted. >> -- >> ------------------------------------------------------------------------------- >> This message has been checked for all known viruses. >> >> The information contained in this e-mail and any attachments is >> confidential and may be the subject of legal, professional or other >> privilege. It is intended for the named addressee only and may not be >> disclosed to any other parties without the prior permission of the >> originator. >> >> >> > >
From: Omar Torres on 15 Jan 2007 11:06 Alan C wrote: > It is up to SP1, but I've just noticed that autoupdates is disabled. I'll do > all the patches and if the problem reoccurs I'll repost. > Thanks for the pointer. > > "Headbolt" <David.Treadgold(a)Incepta.co.uk> wrote in message > news:eofZqJJOHHA.448(a)TK2MSFTNGP04.phx.gbl... >> I guess the most sensible place to start is patching, is the server totally >> up to date with all the latest windows and exchange patches ?? >> >> If So then I'd suggest re-applying the latest Service pack for Windows and >> Exchange and then re-patch with all the updates, should hopefully >> re-install clean versions of the affected files. >> >> >> "Alan C" <nospam(a)noisp.com> wrote in message >> news:OnRnnDJOHHA.960(a)TK2MSFTNGP04.phx.gbl... >>> We have a w2k3 member server running exchange that periodically reboots >>> for no apparent reason. >>> >>> After each reboot, the system error log contains 3 instances of:- >>> Event Source: LsaSrv >>> Event Category: Security Package Manager >>> Event ID: 5000 >>> Description: The security package Kerberos generated an exception. >>> >>> Followed by:- >>> Event Source: USER32 >>> Event Category: None >>> Event ID: 1074 >>> Description: The Process winlogon.exe has initiated the restart of >>> computer EXSERV on behalf of user for the following reason: No title for >>> this reason could be found >>> Reason Code: 0x50006 >>> Shutdown Type restart >>> Comment: The system process 'C:\WINDOWS\system32.lsass.exe terminated >>> unexpectedly with status code -1073740972. >>> >>> Help please, any clues/suggestions/etc. gratefully accepted. >>> -- >>> ------------------------------------------------------------------------------- >>> This message has been checked for all known viruses. >>> >>> The information contained in this e-mail and any attachments is >>> confidential and may be the subject of legal, professional or other >>> privilege. It is intended for the named addressee only and may not be >>> disclosed to any other parties without the prior permission of the >>> originator. >>> >>> >>> >> > > I think someone is on your server. The path to the lsass.exe is wrong. It says 'C:\WINDOWS\system32.lsass.exe terminated unexpectedly with status code -1073740972.' and there should be a back slash after system32 like c:\WINDOWS\SYSTEM32\lsass.exe Check the path and see if a file exists called system32.lsass.exe -- Omar Torres MCSA, MCDST
From: Alan C on 16 Jan 2007 06:26 Sorry Omar, finger trouble. the path is c:\windows\system32\lsass.exe - it's just that I can't type!!! "Omar Torres" <otorres_@_prcb.org> wrote in message news:uWYJE9LOHHA.2236(a)TK2MSFTNGP02.phx.gbl... > Alan C wrote: >> It is up to SP1, but I've just noticed that autoupdates is disabled. I'll >> do all the patches and if the problem reoccurs I'll repost. >> Thanks for the pointer. >> >> "Headbolt" <David.Treadgold(a)Incepta.co.uk> wrote in message >> news:eofZqJJOHHA.448(a)TK2MSFTNGP04.phx.gbl... >>> I guess the most sensible place to start is patching, is the server >>> totally up to date with all the latest windows and exchange patches ?? >>> >>> If So then I'd suggest re-applying the latest Service pack for Windows >>> and Exchange and then re-patch with all the updates, should hopefully >>> re-install clean versions of the affected files. >>> >>> >>> "Alan C" <nospam(a)noisp.com> wrote in message >>> news:OnRnnDJOHHA.960(a)TK2MSFTNGP04.phx.gbl... >>>> We have a w2k3 member server running exchange that periodically reboots >>>> for no apparent reason. >>>> >>>> After each reboot, the system error log contains 3 instances of:- >>>> Event Source: LsaSrv >>>> Event Category: Security Package Manager >>>> Event ID: 5000 >>>> Description: The security package Kerberos generated an exception. >>>> >>>> Followed by:- >>>> Event Source: USER32 >>>> Event Category: None >>>> Event ID: 1074 >>>> Description: The Process winlogon.exe has initiated the restart of >>>> computer EXSERV on behalf of user for the following reason: No title >>>> for this reason could be found >>>> Reason Code: 0x50006 >>>> Shutdown Type restart >>>> Comment: The system process 'C:\WINDOWS\system32.lsass.exe terminated >>>> unexpectedly with status code -1073740972. >>>> >>>> Help please, any clues/suggestions/etc. gratefully accepted. >>>> -- >>>> ------------------------------------------------------------------------------- >>>> This message has been checked for all known viruses. >>>> >>>> The information contained in this e-mail and any attachments is >>>> confidential and may be the subject of legal, professional or other >>>> privilege. It is intended for the named addressee only and may not be >>>> disclosed to any other parties without the prior permission of the >>>> originator. >>>> >>>> >>>> >>> >> >> > I think someone is on your server. The path to the lsass.exe is wrong. It > says 'C:\WINDOWS\system32.lsass.exe terminated unexpectedly with status > code -1073740972.' and there should be a back slash after system32 like > c:\WINDOWS\SYSTEM32\lsass.exe > > Check the path and see if a file exists called system32.lsass.exe > > -- > Omar Torres > MCSA, MCDST
|
Pages: 1 Prev: Event ID 2000 Next: there was an unexpected error with your zone settings. unable |