Lsass.exe Error Occurs After You Install the Windows 2000 High Encryption Pack (301684)

SYMPTOMS

When you restart your computer after you install the Windows 2000 High Encryption Pack, you may receive the following error message.

Lsass.exe - Entry Point Not Found

The procedure entry point EqualDomainSid could not be located in the dynamic link library ADVAPI32.dll.

When you click OK, the following message appears:

System Shutdown This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by \

Time before shutdown: 00:00:59

Message

The system process 'C:\WINNT\System32\Lsass.exe' terminated unexpectedly with status code 128. The system will now shut down and restart.

CAUSE

This error can occur in the following situation:

You install the hotfix that is described in the following Microsoft Knowledge Base article, and you do not restart the computer:
271976 Hotfix Rollup Package Corrects Problems Described in Q257357 and Q271907
You install the hotfix that is described in the following Microsoft Knowledge Base article, and then restart the computer:
274172 FIX: Adding Multiple Users to Active Directory Can Cause Memory Leak When Setting Passwords
You install the Windows 2000 High Encryption Pack, and then restart the computer when you are prompted.

This behavior occurs only when you install the hotfixes in the order described in this section, and only when you do not restart the computer after you install the Q271976 hotfix (for example, if you install it using the -z switch). This issue occurs because both hotfixes update the Advapi32.dll file. When you install both hotfixes without restarting the computer between updates, a mismatched version of Advapi32.dll remains installed.

The hotfix that is described in Microsoft Knowledge Base article Q271976 installs Advapi32.dll version 5.0.2195.2867, 360,208 bytes, Feb-26-01, while the hotfix described in Microsoft Knowledge Base article Q274172 installs Advapi32.dll version 5.0.2195.2835, 348,944 bytes, Jan-25-01.

RESOLUTION

To resolve this issue, start the computer by using the Windows 2000 recovery console, and then replace the Advapi32.dll file with a copy from the Q274172 hotfix files:

Start the computer by using the recovery console. To do so, start the computer from the Windows 2000 CD. For additional information about how to use the recovery console, click the article numbers below to view the articles in the Microsoft Knowledge Base:
229716 Description of the Windows 2000 Recovery Console
At the Welcome to Setup screen, press R.
Press C to repair a Windows 2000 installation by using the recovery console.
When you are prompted by the recovery console, type the number of the Windows 2000 installation that you want to repair, and then press ENTER.
Type the Administrator password, and then press ENTER.
Type cd system32, and then press ENTER.
Type ren advapi32.dll advapi32.old, and then press ENTER.
Type copy c:\winnt\$ntuninstallq274172$\advapi32.dll (where c: is the drive on which Windows is installed and winnt is the folder in which Windows is installed), and then press ENTER. The following message appears:
1 file(s) copied.
Type exit, and then press ENTER to quit the recovery console.
Start Windows as you typically do.

MORE INFORMATION

If you install multiple hotfixes without restarting the computer between each update, this action is unsupported unless you use the QChain utility. For additional information about how to use the QChain utility, click the article number below to view the article in the Microsoft Knowledge Base:

296861 Use QChain.exe to Install Multiple Hotfixes with Only One Reboot