Lsass.exe quits unexpectedly with status code -1073741819 (300038)


The information in this article applies to:

  • Microsoft Windows 2000 Server SP2
  • Microsoft Windows 2000 Advanced Server SP2
  • Microsoft Windows 2000 Datacenter Server SP2
This article was previously published under Q300038

SYMPTOMS

After you install Windows 2000 Service Pack 2 (SP2) on a Windows 2000-based domain controller, you may receive the following error message:
The system process lsass.exe terminated unexpectedly with status code -1073741819. The system will now shut down and restart.
This error message occurs after every subsequent reboot, usually within 15 minutes of the reboot.

CAUSE

This behavior is caused by an invalid replInterval value in the Configuration container in the properties of a site link.

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows 2000. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to obtain the latest Windows 2000 service pack

To resolve this issue, use either of the following methods:
  • Change the Replicate every value by using the user interface on the site link to be greater than or equal to 15 and less than or equal to 10,080.
  • Use Ldp.exe or Adsiedit.exe to modify the replInterval value. Set the value within the range that is specified above.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Windows 2000 Service Pack 3.

MORE INFORMATION

By default, site links are assigned a value of 180 minutes for the Replicate every value and 100 for the Cost value. Prior to Windows 2000 Service Pack 1 (SP1), you can modify the Replicate every value to less than 15 minutes and more than 10,080 minutes. Setting this value outside of the previously stated range produces an invalid value of 65551 for the replInterval value on each site link that is not using a valid value. If this value is changed before SP1 is installed, and is not updated by using the Site Link user interface after SP1 is applied, the value may be invalid and may cause an access violation in Lsass.exe

Although the Site Link user interface may show a value of 15 minutes, you can verify the value by using Ldp.exe to run the following query against the Configuration container for a given domain:

(&(objectCategory=siteLink)(replInterval>=10081))

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

251057 You can add invalid replication interval and cost values for site link properties

The site link properties, specifically the replInterval value, are stored in the following location:

CN=siteLink Name,CN=IP,CN=Inter-Site Transports,CN=Sites,DC=Configuration,DC=domain,DC=suffix

Note If the message box appears before you are able to log on, Ctrl-Alt-Del will NOT work and you will NOT be able to log on. You will, therefore, not be able to implement the workaround. If this occurs, see the following Microsoft Knowledge Base article for additional information:

306497 Lsass.exe system process unexpectedly quits with a -1073741819 status code

Modification Type:MinorLast Reviewed:2/10/2006
Keywords:kbHotfixServer kbQFE kbDirServices kbenv kberrmsg kbfix kbprb kbWin2000sp3fix KB300038
©2004 Microsoft Corporation. All rights reserved.