2012 R2 DC crashes when user account is renamed using RSAT Tools on Windows 7

Question

Hello Everyone,
we have a forest and a domain both running in 2003 native mode. We have a mixture of domain controllers running 2003 and 2008 R2 and just recently deployed two new domain controllers running 2012 R2. The 2012 R2s are configured as global catalogs but
do not hold any additional FSMO roles.
Unfortunately we have a very strange issue with the two new 2012 R2 DCs:
We have installed the domain management tools on the 2012 R2 domain controllers. When managing our domain using the locally installed tools on the DCs everything is ok. DSA.MSC shows version 6.3.9600.16384. We also have a number of admin workstations
running windows 7 enterprise 64 bit with service pack 1. We have RSAT tools for windows 7 sp1 (Windows6.1-KB958830-x64-RefreshPkg.msu) installed on these machines. DSA.MSC shows version 6.1.7601.17514. Whenever we try to rename a user account from the win7
computers, the 2012 R2 DC that is targeted shows a message saying that it will reboot within 60 seconds - and then does just that. On the client we see a message saying
"Windows cannot complete the rename operation on <name> because: The server is not operational. Name related properties on this object might be out of sync."
The server logs two errors in the application log:
1. Event ID 1000, Application Error:
Faulting application name: lsass.exe, version: 6.3.9600.16384, time stamp: 0x5215e25f
Faulting module name: ntdsai.dll, version: 6.3.9600.16421, time stamp: 0x524fcaed
Exception code: 0xc0000005
Fault offset: 0x000000000019e45d
Faulting process id: 0x214
Faulting application start time: 0x01cefa6743edbeec
Faulting application path: C:\Windows\system32\lsass.exe
Faulting module path: C:\Windows\system32\ntdsai.dll
Report Id: d4cd7581-665c-11e3-80d7-005056984a2b
Faulting package full name:
Faulting package-relative application ID:
2. Event ID 1015, Source Wininit:
A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000005.  The machine must now be restarted.
These issues do not occur if we target the admin workstations to use one of our older 2008 R2 DCs. Does anyone have an idea? Any help would be appreciated!
Regards
Harry

Answer 1

I would recommend starting with the basic steps described here: http://social.technet.microsoft.com/wiki/contents/articles/18513.active-directory-replication-issues-basic-troubleshooting-steps-single-ad-domain-in-a-single-ad-forest.aspx
Once done, please use dcdiag to do health diagnosis on your DCs. If you are running security software on these DCs, I would recommend disabling them temporary for checks.
Also, see that for virus scanning exclusions: http://support.microsoft.com/kb/822158/en-us
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Get Active Directory User Last Logon
Create an Active Directory test domain similar to the production one
Management of test accounts in an Active Directory production domain - Part I
Management of test accounts in an Active Directory production domain - Part II
Management of test accounts in an Active Directory production domain - Part III
Reset Active Directory user password