LSASS.exe utilizing 3 GB of RAM on Windows 2008 R2 SP1 - MS Dynamics AX 2012 application server (it's not a DC)

Hi guys,
Does anyone know why would lsass.exe be using 3 GB of RAM on an application server with 8 GB of RAM in total running on Windows 2008 R2 SP1? Is this something I should log with Microsoft support?
Thanks
Zoran

Hi we experienced the same issue. but im not able to reproduce it on the second server.
We got two member servers both in the same configuration Windows 2008R2 SP1 STD hosting Axapta AOS. the first server is experiencing the Lssas memory leak (we got a little bit more memory then you but it consumes 5,6GB form 6GB
total RAM) the second one not. both servers are VM hosted on hyper-v 2012 cluster. the only difference betwean them is instaled Avast Antivirus, but we have a testing environment (single VM server with identical deployment with Avast also installed) and
it does not seems that the Avast is the cause.
can anybody please point us how to troubleshoot lsass memory leaks on member servers not DCs, becouse the event logs does not show anything interesting about the couse, but are full of errors about what i see as consequences of low memory condition.
Thanks in advance Martin Stejskal

Similar Messages

HELP. Lsass.exe error and cannot log in to windows on Thinkpad T 42

hi, i messed up with registry ..safe mode, access IBM dont help ..... rescue and recovery is on same HD but i have not made recovery CDs .
Is it possible to make these CDs if i take out HD from T42 and use it as external HD on my desktop if so Can some one help me step by step or any other advice to fix lsass.exe error and login into windows

Hi AbbyTaylor,
Welcome to Lenovo Community Forums!
I’m sorry to hear that you are getting lsass.exe error while trying to login to your Lenovo ThinkPad T400.
Lsass.exe is responsible for how Microsoft Windows handles security and security related policies, authority domain authentication, and Active Directory management on your computer.
Have you tried to start in Safe Mode as well as with the last know good configuration?
Boot with your Windows system CD and go into the repair console. Try performing a system repair.
Refer this knowledgebase and see if it helps!
Best regards,
Mithun.
Did someone help you today? Press the star on the left to thank them with a Kudo!
If you find a post helpful and it answers your question, please mark it as an "Accepted Solution"! This will help the rest of the Community with similar issues identify the verified solution and benefit from it.
Follow @LenovoForums on Twitter!

Windows 2008 R2 - High memory on lsass.exe

Windows 2008 R2 fully patched VM with 8GB of RAM and 4 vCPUs. Machine is a DC and file server.
Had an issue that just came up where lsass.exe will start sucking up memory. It gets to the point where the machine is almost not usable. The only way to get everything back in check is to reboot.
I just rebooted a little bit ago and I'm watching lsass.exe slowly start sucking up more and more memory. I'm not sure how to tell where the memory is being used and then how to remedy it. This machine has run fine as a DC/file/print server for 3 years.
Something has happened in the last week that is making it mad.

Hi,
Firstly, have you typed an invalid IPv6 subnet mask in the Active Directory Sites and Services snap-in on that Windows Server 2008 R2 DC? If yes, please refer to the KB below:
The Lsass.exe process crashes on Windows Server 2008 R2-based domain controllers
If not, I would recommend you perform a virus scan on your DC and run the Performance Monitor's Active Directory Data Collector Set on that domain controller while the problem is occurring to find the root reason. To run the Active Directory Data Collector
follow these steps:
1.Run ”Perfmon.msc”and then press enter.
2.Expand Data Collector Sets > System.
3.Right-click on Active Directory Diagnostics and then click
Start in the menu which appears.
Once the report has compiled (The default setting will gather data for the report for 300 seconds, after which it will take an additional period to compile the report.), view reports which will show details of potential problems which need to be investigated
as possible causes.
Best regards,
Susie

The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code 255

Hello All
We have a server 2008 R2 HyperV server and during the last few months it started to reboot randomly.
Initially we thought its related to the issue fixed by the following hotfix so we applied it but even with the hotfix it still keeps rebooting.
http://support.microsoft.com/kb/2732595
Unlike what's mentioned in the hotfix , the faulting module is not "ntdll.dll" but "msvcrt.dll".Also came up with the following indication the reboots could be related to KB2871997 but that update is not installed
on this system.
Following are the events from system log.
Log Name:      System
Source:        LsaSrv
Date:          2/9/2015 11:58:12 PM
Event ID:      5000
Task Category: None
Level:         Error
Keywords:
User:          SYSTEM
Computer:      HV2008-Host
Description:
The security package Kerberos generated an exception. The exception information is the data.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="LsaSrv" Guid="{199FE037-2B82-40A9-82AC-E1D46C792B99}" />
    <EventID>5000</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2015-02-10T04:58:12.415529200Z" />
    <EventRecordID>8091130</EventRecordID>
    <Correlation />
    <Execution ProcessID="736" ThreadID="5888" />
    <Channel>System</Channel>
    <Computer>HV2008-Host</Computer>
    <Security UserID="S-1-5-18" />
</System>
<EventData>
    <Data Name="Package">Kerberos</Data>
    <Binary>050000C00000000000000000000000001111F6FEFE070000020000000000000000000000000000008EEB1802000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
</EventData>
</Event>
Log Name:      System
Source:        USER32
Date:          2/9/2015 11:58:24 PM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      HV2008-Host
Description:
The process wininit.exe has initiated the restart of computer HV2008-HOST on behalf of user for the following reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code 255. The system will now shut down and restart.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="USER32" />
    <EventID Qualifiers="32768">1074</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-02-10T04:58:24.000000000Z" />
    <EventRecordID>8091132</EventRecordID>
    <Channel>System</Channel>
    <Computer>HV2008-Host</Computer>
    <Security UserID="S-1-5-18" />
</System>
<EventData>
    <Data>wininit.exe</Data>
    <Data>HV2008-HOST</Data>
    <Data>No title for this reason could be found</Data>
    <Data>0x50006</Data>
    <Data>restart</Data>
    <Data>The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code 255. The system will now shut down and restart.</Data>
    <Data>
    </Data>
    <Binary>06000500000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
</EventData>
</Event>
Following are the events from Application logs.
Log Name:      Application
Source:        Application Error
Date:          2/9/2015 11:58:14 PM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      HV2008-Host
Description:
Faulting application name: lsass.exe, version: 6.1.7601.22653, time stamp: 0x534893ed
Faulting module name: msvcrt.dll, version: 7.0.7601.17744, time stamp: 0x4eeb033f
Exception code: 0xc0000005
Fault offset: 0x0000000000001111
Faulting process id: 0x2e0
Faulting application start time: 0x01d03c91dbe5854f
Faulting application path: C:\Windows\system32\lsass.exe
Faulting module path: C:\Windows\system32\msvcrt.dll
Report Id: 6af0ff3d-b0e1-11e4-83ca-0026b9340d61
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-02-10T04:58:14.000000000Z" />
    <EventRecordID>267648</EventRecordID>
    <Channel>Application</Channel>
    <Computer>HV2008-Host</Computer>
    <Security />
</System>
<EventData>
    <Data>lsass.exe</Data>
    <Data>6.1.7601.22653</Data>
    <Data>534893ed</Data>
    <Data>msvcrt.dll</Data>
    <Data>7.0.7601.17744</Data>
    <Data>4eeb033f</Data>
    <Data>c0000005</Data>
    <Data>0000000000001111</Data>
    <Data>2e0</Data>
    <Data>01d03c91dbe5854f</Data>
    <Data>C:\Windows\system32\lsass.exe</Data>
    <Data>C:\Windows\system32\msvcrt.dll</Data>
    <Data>6af0ff3d-b0e1-11e4-83ca-0026b9340d61</Data>
</EventData>
</Event>
Log Name:      Application
Source:        Windows Error Reporting
Date:          2/9/2015 11:58:23 PM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      HV2008-Host
Description:
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: lsass.exe
P2: 6.1.7601.22653
P3: 534893ed
P4: msvcrt.dll
P5: 7.0.7601.17744
P6: 4eeb033f
P7: c0000005
P8: 0000000000001111
P9:
P10:
Attached files:
C:\Windows\Temp\WER5001.tmp.appcompat.txt
C:\Windows\Temp\WER535C.tmp.WERInternalMetadata.xml
C:\Windows\Temp\WER53DA.tmp.hdmp
C:\Windows\Temp\WER6690.tmp.mdmp
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lsass.exe_3c1aa5eeba75bf26fcebc4f54e714efe7b5162a2_cab_20a56871
Analysis symbol:
Rechecking for solution: 0
Report Id: 6af0ff3d-b0e1-11e4-83ca-0026b9340d61
Report Status: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-02-10T04:58:23.000000000Z" />
    <EventRecordID>267650</EventRecordID>
    <Channel>Application</Channel>
    <Computer>HV2008-Host</Computer>
    <Security />
</System>
<EventData>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>APPCRASH</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>lsass.exe</Data>
    <Data>6.1.7601.22653</Data>
    <Data>534893ed</Data>
    <Data>msvcrt.dll</Data>
    <Data>7.0.7601.17744</Data>
    <Data>4eeb033f</Data>
    <Data>c0000005</Data>
    <Data>0000000000001111</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
C:\Windows\Temp\WER5001.tmp.appcompat.txt
C:\Windows\Temp\WER535C.tmp.WERInternalMetadata.xml
C:\Windows\Temp\WER53DA.tmp.hdmp
C:\Windows\Temp\WER6690.tmp.mdmp</Data>
    <Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lsass.exe_3c1aa5eeba75bf26fcebc4f54e714efe7b5162a2_cab_20a56871</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>6af0ff3d-b0e1-11e4-83ca-0026b9340d61</Data>
    <Data>0</Data>
</EventData>
</Event>
Log Name:      Application
Source:        Windows Error Reporting
Date:          2/9/2015 11:58:22 PM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      HV2008-Host
Description:
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: lsass.exe
P2: 6.1.7601.22653
P3: 534893ed
P4: msvcrt.dll
P5: 7.0.7601.17744
P6: 4eeb033f
P7: c0000005
P8: 0000000000001111
P9:
P10:
Attached files:
C:\Windows\Temp\WER5001.tmp.appcompat.txt
C:\Windows\Temp\WER535C.tmp.WERInternalMetadata.xml
C:\Windows\Temp\WER53DA.tmp.hdmp
C:\Windows\Temp\WER6690.tmp.mdmp
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lsass.exe_3c1aa5eeba75bf26fcebc4f54e714efe7b5162a2_cab_20a56871
Analysis symbol:
Rechecking for solution: 0
Report Id: 6af0ff3d-b0e1-11e4-83ca-0026b9340d61
Report Status: 4
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-02-10T04:58:22.000000000Z" />
    <EventRecordID>267649</EventRecordID>
    <Channel>Application</Channel>
    <Computer>HV2008-Host</Computer>
    <Security />
</System>
<EventData>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>APPCRASH</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>lsass.exe</Data>
    <Data>6.1.7601.22653</Data>
    <Data>534893ed</Data>
    <Data>msvcrt.dll</Data>
    <Data>7.0.7601.17744</Data>
    <Data>4eeb033f</Data>
    <Data>c0000005</Data>
    <Data>0000000000001111</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
C:\Windows\Temp\WER5001.tmp.appcompat.txt
C:\Windows\Temp\WER535C.tmp.WERInternalMetadata.xml
C:\Windows\Temp\WER53DA.tmp.hdmp
C:\Windows\Temp\WER6690.tmp.mdmp</Data>
    <Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lsass.exe_3c1aa5eeba75bf26fcebc4f54e714efe7b5162a2_cab_20a56871</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>6af0ff3d-b0e1-11e4-83ca-0026b9340d61</Data>
    <Data>4</Data>
</EventData>
</Event>
Would really appreciate if someone can point us to the correct direction on how to get this issue sorted.
Regards,
Dhanushka

Hi Sir,
Please try the following items:
1. if ther is anti-virus installed , please uninstall it temporarily
2. run " sfc /scannow "
3. keep windows up-to-date
4. if you updated some hardware driver please roll it back
5. if the issue persists , please use windows installation media to perform inplace-upgrade for the system
Also please refer to reinstall C++ runtime within the similar thread:
https://social.technet.microsoft.com/Forums/windows/en-US/bf69eeff-24c4-499f-b280-b6a3098f4f9f/problem-with-msvcrtdll-version-70760117744?forum=w7itprogeneral
Best Regards,
Elton Ji
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected] .

Windows Server 2008 SP2 randomly reboots due to lsass.exe failed with status code 255

Hello,
Any help on this issue would be greatly appreciated. I have an older Windows Server 2008 SP2 (I don't believe it is R2) (running SQL Server 2008 and SSRS 2008 on the machine) that is crashing randomly
during business hours. Looking into the event logs, I have found the following:
Faulting application lsass.exe, version 6.0.6002.18541, time stamp 0x4ec3ca01, faulting module msvcrt.dll, version 7.0.6002.18551, time stamp 0x4ee8d118, exception code 0xc0000005, fault offset 0x00000000000011ad, process id 0x284, application start
time 0x01d066d9669a3e1c.
A critical system process, C:\Windows\system32\lsass.exe, failed with status code 255. The machine must now be restarted.
The process wininit.exe has initiated the restart of computer RIDEDB02 on behalf of user for the following reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code 255. The system will now shut down and restart.
I found a Hot Fix for a similar issue (https://support.microsoft.com/en-us/kb/2732595?wa=wsignin1.0), but it appeared to only be applicable to Windows Server 2008 R2 and Windows 7.
A few hours later, the crash happened again, with a slightly different error:
The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819. The system will now shut down and restart.
Faulting application lsass.exe, version 6.0.6002.18541, time stamp 0x4ec3ca01, faulting module msvcrt.dll, version 7.0.6002.18551, time stamp 0x4ee8d118, exception code 0xc0000005, fault offset 0x00000000000011ad, process id 0x284, application start
time 0x01d066fa9d74c5d7.
A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.
The security package Kerberos generated an exception. The exception information is the data
I have been unable to find a reason for these exceptions and the server rebooting. Any thoughts or ideas on how I can correct this error so it doesn't reboot our server again? .
Thank you,
Ben

Hello,
Any help on this issue would be greatly appreciated. I have an older Windows Server 2008 SP2 (I don't believe it is R2) (running SQL Server 2008 and SSRS 2008 on the machine) that is crashing randomly
during business hours. Looking into the event logs, I have found the following:
Faulting application lsass.exe, version 6.0.6002.18541, time stamp 0x4ec3ca01, faulting module msvcrt.dll, version 7.0.6002.18551, time stamp 0x4ee8d118, exception code 0xc0000005, fault offset 0x00000000000011ad, process id 0x284, application start
time 0x01d066d9669a3e1c.
A critical system process, C:\Windows\system32\lsass.exe, failed with status code 255. The machine must now be restarted.
The process wininit.exe has initiated the restart of computer RIDEDB02 on behalf of user for the following reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code 255. The system will now shut down and restart.
I found a Hot Fix for a similar issue (https://support.microsoft.com/en-us/kb/2732595?wa=wsignin1.0), but it appeared to only be applicable to Windows Server 2008 R2 and Windows 7.
A few hours later, the crash happened again, with a slightly different error:
The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819. The system will now shut down and restart.
Faulting application lsass.exe, version 6.0.6002.18541, time stamp 0x4ec3ca01, faulting module msvcrt.dll, version 7.0.6002.18551, time stamp 0x4ee8d118, exception code 0xc0000005, fault offset 0x00000000000011ad, process id 0x284, application start
time 0x01d066fa9d74c5d7.
A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.
The security package Kerberos generated an exception. The exception information is the data
I have been unable to find a reason for these exceptions and the server rebooting. Any thoughts or ideas on how I can correct this error so it doesn't reboot our server again? .
Thank you,
Ben

Ocopy.exe utility in Oracle 9i

I would like to take a hot backup of an Oracle 9i database on Win 2000 using the OCOPY.EXE utility. I'll be backing up all *.CTL, *.LOG, and *.DBF files.
Does this utility do the same thing as a level 0 hot backup in RMAN?
Pls advise
Thanks

Don't forget to put your tablespace in backup mode before
you copy datafiles using any OS utility! More details
in the docs:
http://download-west.oracle.com/docs/cd/B10501_01/server.920/a96572/osbackups.htm
Hope this helps.
Kailash.

Where can I download the Linksys TFTP.exe utility?

Hello everyone, I am trying to upgrade this router I've got and was wondering if anyone knew where to get the Linksys TFTP.exe utility. Apparently Linksys have decided to re-organize their public FTP and the file is no longer anywhere to be found. I have been linked to ftp://ftp.linksys.com/pub/network/tftp.exe but I get a "550 Failed to Change Directory" error message. I've browsed through all of the directories on the public FTP and am at a loss. Can anyone help? Thanks a million.

I used the Netgear TFTP solution and it worked well: Netgear TFTP firmware recovery procedure: http://kb.netgear.com/app/answers/detail/a_id/22688/~/how-to-upload-firmware-to-a-wndr3700v2-router-using-tftp Download TFTP2.exe software from http://www.shadowsoftware.net/shadowgameworld/downloads/tftp2.exe You could also try the DD-WRT option: Subject "Recover From A Bad Flash" Article: https://www.dd-wrt.com/wiki/index.php/Recover_from_a_Bad_Flash#Recovering_with_TFTP "DrayTek Router Tools - OSX/Windows: This program will run all those pesky TFTP commands with a push of a button. Simply download and install DrayTek router tools from here and follow the instructions:" ftp://ftp.draytek.com/tools/Router_Tools/ ..... Para Dox

Event ID 1000 & 1015 - Faulting application name: lsass.exe / lsass failed event

HELLO ALL, I hope this is the right place to raise this question because I am having some trouble with a couple errors I receive. First this is a new HP Workstation running Windows 7 64bit SP1 completely
stand alone and I have installed the appropriate hot fix #405595 adn the problem remains:
A critical system process C:\WINDOWS\system32\lsass.exe,
failed with status code 255. The machine must now be restarted.

Hi,
Have you installed this hotfix:
Lsass.exe crashes and error code 255 is generated in Windows Server 2008 R2 or in Windows 7
http://support.microsoft.com/kb/2732595
Alex Zhao
TechNet Community Support

Disk Utility to format DVD-RAM disk

I have swapped out my Combo drive and installed an LG GSA-4163b so that I can burn, write to, DVD-RAM disks.
I have installed Patchburn which now allows me to burn CD's and all manner of DVD's but DVD-RAM disks will not mount.
DVD-RAM disk is recognized by Disk Utility but I cannot figure out how to make Disk Utility format the DVD-RAM disk. How do I do this.
Thanks,
Doug

Hi Douglas,
should work pretty straight forward:
* Open Disk Utility
* Select the disc in the column on the left
* click Erase (select Quick Erase if you don't want to zero out the disk)
* Click Erase to start the process
HTH,
Koinseb
Message was edited by: Koinseb

LSASS.exe Authentication Failure ever 30 minutes

I'm getting two authentication failures every 30 minutes from lsass.exe on various ports (changes every time). The attempted authentication is for the admin account, which was recently changed. This is sourced from the server back to the server on either 127.0.0.1 or the server's IP. Anyone have any idea on this?
This topic first appeared in the Spiceworks Community

Verify your RADIUS configuration with the Test button on the AAA Server Groups configuration screen. Once you supply a username and password, this button allows you to send a test authentication request to the ACS server.
Choose Configuration > Remote Access VPN > AAA Setup > AAA Server Groups.
Select your desired AAA Server group in the top pane. Select the AAA server that you want to test in the lower pane. Click the Test button to the right of the lower pane. In the window that appears, click the Authentication radio button, and supply the credentials with which you want to test. Click OK when finished

Lsass.exe permissions issue

lsass.exe will generate numerous Audit Failures, in groups of three or more, because it is requesting SeTcbPrivileges but, other times, it will be granted the requested privilege. I would like to know why it is generating all these failures
but, ultimately, I just want to make them stop filling up my Security Log. As it stands, the System, Administrators and users all have "Read & Execute" permissions. Only the "TrustedInstaller" has full permissions. OS is 2008 r2, x64
w/SP1.
Also, this is happening across all servers in the domain and it started long before I inherited the system so i can't trace it back to some patch or change in roll/feature.
Thanks in advance.

And, here is a successful event that happened a few seconds later. I realize that it is being called by a different service but i don't understand why the privilege levels are different.
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          9/5/2013 10:58:51 PM
Event ID:      4673
Task Category: Sensitive Privilege Use
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      [FQDN]
Description:
A privileged service was called.
Subject:
Security ID:  SYSTEM
Account Name:  [Server$]
Account Domain:  [Domain]
Logon ID:  0x3e7
Service:
Server: NT Local Security Authority / Authentication Service
Service Name: LsaRegisterLogonProcess()
Process:
Process ID: 0x204
Process Name: C:\Windows\System32\lsass.exe
Service Request Information:
Privileges:  SeTcbPrivilege
Event Xml:
<Event xmlns= [unallowed Microsoft link]>
<System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4673</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>13056</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2013-09-06T03:58:51.939035500Z" />
    <EventRecordID>4292000</EventRecordID>
    <Correlation />
    <Execution ProcessID="516" ThreadID="532" />
    <Channel>Security</Channel>
    <Computer>[FQDN]</Computer>
    <Security />
</System>
<EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">[Server$]</Data>
    <Data Name="SubjectDomainName">[Domain]</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <Data Name="ObjectServer">NT Local Security Authority / Authentication Service</Data>
    <Data Name="Service">LsaRegisterLogonProcess()</Data>
    <Data Name="PrivilegeList">SeTcbPrivilege</Data>
    <Data Name="ProcessId">0x204</Data>
    <Data Name="ProcessName">C:\Windows\System32\lsass.exe</Data>
</EventData>
</Event>

Please help help with sapshcut.exe utility

Hi experts,
I did try some commands to log-on to SAP system as the following examples and get some conclusions:
(1) sapshcut.exe -sysname="今ウィ　ちゃわ異" -user="paragon1" -pw="paragon1" -client="800" -language=en -maxgui "
(2) sapshcut.exe -sysname="EC5" -user="paragon1" -pw="paragon1" -client="800" -language=en -maxgui "
- For the (1) case, with any "double-byte characters" sysname (Janpanese,...), I can not log-on to SAP and get "Microsoft Visual C++ Runtime Library" error message.
- For the (2) case, without "double-byte characters" -sysname, I can log-on to SAP easily.
Thus, I wan to know
1) Does the sapshcut.exe support double-byte characters?
2) Do we have a way to use sapshcut.exe with double-byte characters(Japanese,...)?
Kindly Regards,

Hi,
Can you please check the following notes
Note 103019 - SAPshortcut: Program parameters
Note 99054 - SAPshortcut - Collective note
Thanks,
Sridhar

Prerequisiteinstaller.exe error - unable to install Application Server Role, Web Server (IIS) Role

Windows Server 2012 R2 running on Hyper-V VM. File services, App server & IIS roles installed
SQL Server 2012 installed
Tried:
kb 2765260 method 1 which is kb 2771431 which ends with "not applicable to computer"
kb 2765260 method 2 with no effect (this was power shell commands for PC's connected to the internet)
One post suggested "aspnet_regii - enable -i" but my OS doesn't have aspnet_regii on it (not sure what that implies)
One post suggested ServerManagerCmd.exe needed to be installed which sounds true as shown below (but where do I find this exe?)
There are some errors in the log file, I only included the portions where the errors are listed. The initial lines are at the top of the log file, then I skipped to the section where the other errors were. I can include the whole log if
it becomes necessary.
9:47:11 Processor architecture is (9)
9:47:11 Reading the following string value/name...
9:47:11 Common Startup
9:47:11 from the following registry location...
9:47:11 SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
9:47:11 The value is...
9:47:11 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
9:47:11 Trying to remove the startup task if there is any.
9:47:11 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SharePointServerPreparationToolStartup_0FF1CE14-0000-0000-0000-000000000000.cmd
9:47:11 Error: Startup task doesn't exist. This is not a continuation after a restart.
9:47:11 Locating the following command line arguments file:
9:47:11 E:\PrerequisiteInstaller.Arguments.txt
9:47:11 Error: This file does not exist
9:47:11 Details of the current operating system:
9:47:11 Check whether the following prerequisite is installed:
9:47:11 Cumulative Update Package 1 for Microsoft AppFabric 1.1 for Windows Server (KB2671763)
9:47:11 Reading the following DWORD value/name...
9:47:11 IsInstalled
9:47:11 from the following registry location...
9:47:11 SOFTWARE\Wow6432Node\Microsoft\Updates\AppFabric 1.1 for Windows Server\KB2671763
9:47:17 Beginning download/installation
9:47:17 Created thread for installer
9:47:17 "C:\Windows\system32\ServerManagerCmd.exe" -inputpath "C:\Users\ADMINI~1\AppData\Local\Temp\1\PreE0DB.tmp.XML"
9:47:17 Error: Unable to install (2)
9:47:17 Error: [In HRESULT format] (-2147024894)
9:47:17 Last return code (2)
9:47:17 Reading the following DWORD value/name...
9:47:17 Flags
9:47:17 from the following registry location...
9:47:17 SOFTWARE\Microsoft\Updates\UpdateExeVolatile
9:47:17 Reading the following string value/name...
9:47:17 PendingFileRenameOperations
9:47:17 from the following registry location...
9:47:17 SYSTEM\CurrentControlSet\Control\Session Manager
9:47:17 Reading the following registry location...
9:47:17 SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired
9:47:17 Error: The tool was unable to install Application Server Role, Web Server (IIS) Role.
9:47:17 Last return code (2)
9:47:17 Options for further diagnostics: 1. Look up the return code value 2. Download the prerequisite manually and verify size downloaded by the prerequisite installer. 3. Install the prerequisite manually from the given location without any command line options.
9:47:17 Cannot retry
I'm presuming the first 2 errors are OK and just indicate optional startup modes for prerequisiteinstaller.exe
The 2nd set of errors seems more serious. I don't see ServerManagerCmd.exe on my PC that's listed in the error
I don't understand the last error which I'm supposing triggered the listed error even though there are other errors in the log.
Many of the existing posts don't match the configuration I'm using, and the ones that do match didn't seem to provide a usable answer. Any help is appreciated. Do these problems exist using Sever 2012 Standard? I will try that, but would
like to resolve the issue here with R2.
Thanks.
Best Regards,
Alan

ServerManagerCMD.exe is a deprecated utility and (as far as I know) is only found on Server 2008 versions, so I'm surprised it's needed for the preinstaller. Are you trying to install SharePoint 2010?
Running this page through Google Translate should give you an clearer idea on getting this installed.
http://blog.hand-net.com/sharepoint/2010-06-10-error-lors-de-linstallation-des-office-web-apps-2010-sur-windows-7.htm
Steven Andrews
SharePoint Business Analyst: LiveNation Entertainment
Blog: baron72.wordpress.com
Twitter: Follow @backpackerd00d
My Wiki Articles:
CodePlex Corner Series
Please remember to mark your question as "answered" if this solves (or helps) your problem.

Description: A problem caused this program to stop interacting with Windows. Problem signature: Problem Event Name: AppHangB1 Application Name: firefox.exe Application Version: 1.9.2.3855 Application Timestamp: 4c48d5ce Hang Signature: 9962

I am having this problem, in the first window when I try to do anything.
Description:
A problem caused this program to stop interacting with Windows.
Problem signature:
Problem Event Name: AppHangB1
Application Name: firefox.exe
Application Version: 1.9.2.3855
Application Timestamp: 4c48d5ce
Hang Signature: 9962
Hang Type: 0
OS Version: 6.0.6002.2.2.0.768.3
Locale ID: 1033
Additional Hang Signature 1: 5df72ce88195c0212c542e9c8c172716
Additional Hang Signature 2: 2b94
Additional Hang Signature 3: 9acafbb8ad01bf9d2eb258d8fddad3ca
Additional Hang Signature 4: 9962
Additional Hang Signature 5: 5df72ce88195c0212c542e9c8c172716
Additional Hang Signature 6: 2b94
Additional Hang Signature 7: 9acafbb8ad01bf9d2eb258d8fddad3ca
== This happened ==
Every time Firefox opened
== User Agent ==
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.99 Safari/533.4

I suspect a RAM or hardware problem.

How to use 4GB RAM on Windows 2000

Hi,
We use a third party application that parses weblogs and generates statistics.
The application gives OutOfMemory exception when the weblogs are hugs.
I am wondering if doing "editbin.exe /LARGEADDRESSAWARE java.exe" is going to help.
I have 4GB of physical RAM and I have /3GB in boot.ini in Windows 2000 Advanced Server.
Thanks,
Anurag.

How to use 4GB RAM on Windows 2000You are never going to use 4g on a windows box. The maximum addressable space is 4g. Normally the OS reserves 2g. Which means the maximum addressable space for an application is 2g.
It is supposed to be possible to increase the addressable space to 3 gig. And also increase the JVM space. However, there are risks. The following thread suggests a way to do this
http://forum.java.sun.com/thread.jsp?forum=37&thread=201718

LSASS.exe utilizing 3 GB of RAM on Windows 2008 R2 SP1 - MS Dynamics AX 2012 application server (it's not a DC)

Similar Messages

Maybe you are looking for