+ Post New Thread
Results 1 to 12 of 12
Windows Thread, Lsass.exe error in Technical; Hello, I have started to look into an error that appeared out of the blue. The error is attached: Now ...
  1. #1

    Join Date
    May 2006
    Location
    West Bromwich
    Posts
    2,190
    Thank Post
    299
    Thanked 215 Times in 185 Posts
    Rep Power
    56

    Lsass.exe error

    Hello,

    I have started to look into an error that appeared out of the blue. The error is attached:

    Now the problem with this is that each time i try to research the error most of the sites that i need are blocked by our RM proxy.

    Also it doesn't give me the name of the component that has failed.

    I decided that the easiest way to sort this is to just RIS the machine and so i boot from the network and select the image i usually use for these machines and low and behold i get a stop message. I have chosen different images and am greeted with the same stop screen each time.

    If i click on the Ok button on the error message the machine just reboots.

    Any ideas what the problem is here or anyone come across it before?

    TIA
    Attached Images Attached Images

  2. #2

    Join Date
    Feb 2006
    Location
    Derbyshire
    Posts
    1,381
    Thank Post
    181
    Thanked 211 Times in 171 Posts
    Rep Power
    65
    Any chance you have a lovely network worm floating around? Can't remember which the most recent one to attack lsass was but it caused the process to die a lot if the station was unpatched. Have you tried a manual build and offline Windows update?

  3. #3
    Midnight's Avatar
    Join Date
    Oct 2008
    Location
    West Yorkshire
    Posts
    35
    Thank Post
    14
    Thanked 8 Times in 8 Posts
    Rep Power
    13
    Sounds like Sasser virus to me. The removal tool is here W32.Sasser Removal Tool | Symantec

  4. #4
    Singist's Avatar
    Join Date
    May 2008
    Location
    Bolton
    Posts
    132
    Thank Post
    6
    Thanked 12 Times in 12 Posts
    Rep Power
    15
    I had this problem last week. It was caused by a boot sector virus. I just re-imaged it though, solved the problem.

  5. #5
    cookie_monster's Avatar
    Join Date
    May 2007
    Location
    Derbyshire
    Posts
    4,196
    Thank Post
    392
    Thanked 278 Times in 239 Posts
    Rep Power
    74
    Can you tell us what client OS you're using?

  6. #6
    Singist's Avatar
    Join Date
    May 2008
    Location
    Bolton
    Posts
    132
    Thank Post
    6
    Thanked 12 Times in 12 Posts
    Rep Power
    15
    Quote Originally Posted by cookie_monster View Post
    Can you tell us what client OS you're using?
    Yeah it was XP Professional SP3

  7. #7
    cookie_monster's Avatar
    Join Date
    May 2007
    Location
    Derbyshire
    Posts
    4,196
    Thank Post
    392
    Thanked 278 Times in 239 Posts
    Rep Power
    74
    If you're using SP3 and deploying with the firewall enabled then it's unlikely to be a worm. Can you provide more info on the error, event logs maybe?

    At what point during an RIS build do you see this error is it after it's finished building?

  8. #8
    Singist's Avatar
    Join Date
    May 2008
    Location
    Bolton
    Posts
    132
    Thank Post
    6
    Thanked 12 Times in 12 Posts
    Rep Power
    15
    I was getting this error when trying to boot up a Asus A6 laptop used in a primary school. I can't remember the exact error as it was last tuesday (16th). It gave me an error code, I researched it and after trying serveral fixes to 'a' boot sector virus (it wasn't specific) I gave up and re-imaged from a local dev instead of deploying through the network. Sorry I can't be more specific. Odd really, this one laptop is protected by Sophos via enterprise console yet it was the only one affected out of 24 machines.

  9. #9
    cookie_monster's Avatar
    Join Date
    May 2007
    Location
    Derbyshire
    Posts
    4,196
    Thank Post
    392
    Thanked 278 Times in 239 Posts
    Rep Power
    74
    Ah I was reading it as affecting more than one client. Sounds like it could of been a boot sector issue and required overwriting which the imaging would of done.

  10. #10

    Join Date
    May 2006
    Location
    West Bromwich
    Posts
    2,190
    Thank Post
    299
    Thanked 215 Times in 185 Posts
    Rep Power
    56
    I thought the same potentially it being a virus. The only thing though was it is the only machine in the entire school that has this issue. As far as i am aware the firewalls are turned off at group policy level.

    It is a Windows XP pro box running service pack 2. I can't get to the event viewer since it happens in safe mode before the login process.

    I think i turned the boot sector protection on in the BIOS. Would this not protect against a boot sector virus?

    Also SAV has been installed on these machines for quite some time.

    The RIS installation crashes as soon as it has finished the process of installing the first set of initial drivers. Just before it starts the formatting.

  11. #11
    cookie_monster's Avatar
    Join Date
    May 2007
    Location
    Derbyshire
    Posts
    4,196
    Thank Post
    392
    Thanked 278 Times in 239 Posts
    Rep Power
    74
    Oh sorry HodgeHi the earlier responce from Singist threw me I assumed that my question had been answered by the original poster looking back I see that was not the case.

    The BIOS protection 'should' protect it but you can't guarentee it. You could try installing from a CD while unplugged from the network to test and try formatting the disk from a live CD.

    Have you tried building another client since to rule out on issue with the RIS server?

    Also has this client every built successfully from the RIS server?

  12. #12

    Join Date
    May 2006
    Location
    West Bromwich
    Posts
    2,190
    Thank Post
    299
    Thanked 215 Times in 185 Posts
    Rep Power
    56
    The RIS server was working fine last time i used it. The systems themselves have been re-imaged many times before and i have recently built a new image for these machines and deployed it to around 10 of them. I haven't tried another client since I haven't got one handy.

    I'm not too fussed about the RIS server since all our machines will be macs in the next 2 months.

    I will have to try formatting the drive with a CD.

    Thanks.

SHARE:
+ Post New Thread

Similar Threads

  1. winlogon.exe Application error
    By googlemad in forum Windows
    Replies: 5
    Last Post: 28th February 2011, 10:22 AM
  2. Spollsv.exe smart UI 32 bits gateway error
    By HodgeHi in forum Windows
    Replies: 0
    Last Post: 17th October 2008, 12:58 PM
  3. Lsass.exe - System Error
    By sLiDeR in forum Windows
    Replies: 4
    Last Post: 24th April 2008, 11:08 AM
  4. Lsass.exe and Lssas.exe
    By ndavies in forum Network and Classroom Management
    Replies: 5
    Last Post: 30th October 2007, 03:19 PM
  5. HidFind.exe error
    By sbutterworthtj in forum Windows
    Replies: 0
    Last Post: 25th September 2007, 11:30 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •