LsaSrv event 5000 disables authentication packages (828873)


The information in this article applies to:

  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Datacenter Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows XP Professional
  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Server 2003, Standard x64 Edition
  • Microsoft Windows Server 2003, Enterprise x64 Edition

SYMPTOMS

An authentication package on a Microsoft Windows computer may not run as expected, and the following event may be logged in the system log: Event Type: Error
Event Source: LsaSrv
Event Category: Devices
Event ID: 5000
Description:
The security package Package Name generated an exception. The package is now disabled. The exception information is the data.

Data:
0000: c0000005 00000000 00000000 78566df3
...

CAUSE

This issue may occur if there is an exception to an authentication package.

RESOLUTION

To resolve this problem, restart the computer.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

MORE INFORMATION

The Local Security Authentication Subsystem (LSASS) process is designed to help protect itself from bugs in authentication packages. It identifies the exception that the bug causes and then terminates the thread that caused the exception. Additionally, the package is not loaded again in the same instance of LSASS. Because exceptions are generally access violations, the integrity of the LSASS process cannot be guaranteed, and therefore Microsoft recommends that you restart the computer. The exception does not create a memory dump file, and the context of the exception is lost after the event is logged.

Technical support for Windows x64 editions

Your hardware manufacturer provides technical support and assistance for Microsoft Windows x64 editions. Your hardware manufacturer provides support because a Windows x64 edition was included with your hardware. Your hardware manufacturer might have customized the Windows x64 edition installation with unique components. Unique components might include specific device drivers or might include optional settings to maximize the performance of the hardware. Microsoft will provide reasonable-effort assistance if you need technical help with your Windows x64 edition. However, you might have to contact your manufacturer directly. Your manufacturer is best qualified to support the software that your manufacturer installed on the hardware.

For product information about Microsoft Windows XP Professional x64 Edition, visit the following Microsoft Web site:

http://www.microsoft.com/windowsxp/64bit/default.mspx

For product information about Microsoft Windows Server 2003 x64 editions, visit the following Microsoft Web site:

http://www.microsoft.com/windowsserver2003/64bit/x64/default.mspx

Modification Type:MajorLast Reviewed:3/31/2005
Keywords:kbwinservnetwork kbBug KB828873 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.