Dr. Watson Stops Responding While Writing Dump for Lsass.exe (306479)
The information in this article applies to:
- Microsoft Windows 2000 Server SP2
- Microsoft Windows 2000 Advanced Server SP2
- Microsoft Windows 2000 Professional SP2
This article was previously published under Q306479 SYMPTOMS
When Lsass.exe experiences an access violation and Dr. Watson tries to write a memory dump for it, Dr. Watson may stop responding (hang). This behavior can occur if either of the following conditions are true:
- Drive E is mapped to a network share.
-or- - The symbol file Msvcrt.pdb for Msvcrt.dll is installed in the symbol path.
CAUSE
This behavior occurs because Msvcrt.pdb has a hard-coded path to drive E. The DBGHELP library follows this path and tries to gain access to drive E. When the redirector is called, it needs to retrieve a security context for the caller. But it cannot do this because Lsass is stopped in the debugger (Dr. Watson). This causes a deadlock and causes Dr Watson to stop responding.
If Dr. Watson were running for a different process under the System context, it would retrieve the credentials, but it would then receive an Access Denied message because the drive was mapped by the interactive user.
RESOLUTION
To work around this issue, do either of the following:
- Unmap drive letter E.
Then the drive is not found and the open request fails.
-or- - Delete the symbol file for Msvcrt.dll.
Dr. Watson logs are usually readable without this symbol, and it does not affect the dump.
STATUSMicrosoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.
| Modification Type: | Minor | Last Reviewed: | 1/27/2006 |
|---|
| Keywords: | kbenv kbprb KB306479 |
|---|
|