2012 R2 restarts


  • I am getting the following error when attempting to manage a Hyper-V host:

    "A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000005.  The machine must now be restarted."


    "Faulting application name: lsass.exe, version: 6.3.9600.16384, time stamp: 0x5215e25f
    Faulting module name: kerberos.DLL, version: 6.3.9600.16408, time stamp: 0x523d35cc
    Exception code: 0xc0000005
    Fault offset: 0x0000000000087ca7
    Faulting process id: 0x45c
    Faulting application start time: 0x01cf0bd5a8f44ab6
    Faulting application path: C:\Windows\system32\lsass.exe
    Faulting module path: C:\Windows\system32\kerberos.DLL
    Report Id: ca93c187-77d0-11e3-80ce-a0369f11bda2
    Faulting package full name: 
    Faulting package-relative application ID: "

    The server in question is running windows server 2012 R2 and has hyper v and failover clustering installed. I can reproduce the issue on command by logging on to the server and attempting to change various setting hyper v via hyper manager. The screen then pops up saying "Windows has encountered a problems and needs to restart. Please save your work" or something similar.

    It seems like an authentication issue but I have been unable to find anything in the logs to point me in the right direction.

    I have tried to reproduce the problem in server 2012 but was unable to.

    Tuesday, January 07, 2014 8:09 PM


All replies

  • Hi,

    Are there any errors in event log?

    When did the issue occur?

    To troubleshoot this kind of kernel mode crash issue, we generally need to analyze the performance monitor logs and memory dump files to locate the root cause.

    If the issue persists, I'd like to recommend that you contact Microsoft Customer Support Service (CSS) for assistance so that this problem can be resolved efficiently.


    Vivian Wang

    Wednesday, January 08, 2014 8:45 AM
  • 1. Is this error from the very beginning or after some application installation, configuration or update? History plays the role here as this type of error is exceptional in new installations.

    2. What role the server/ cluster has? (Similar error occured in DC (W2003 ) - KB927342 - and patch was issued to do the remedy.)

    3. What other software packages are installed on server/cluster? Namely software that change or modify the logon/ SSO and similar may cause the problem. Contact software vendor for support.



    • Edited by Milos Puchta Wednesday, January 08, 2014 9:03 AM
    Wednesday, January 08, 2014 9:00 AM
  • The errors in the event log are:

    Event ID 1015 and 1000

    The content of the logs are in my original post.  

    I can reproduce fairly easily by making a change to the hyper V host from Hyper v manager.

    The server only as on it hyper v role as well as failvover clustering.

    Wednesday, January 08, 2014 6:03 PM
  • Only things configured are fail-over clustering and hyper v. No other software is installed. I have reinstalled a few time with different ISOs, same issue.
    Wednesday, January 08, 2014 6:10 PM