DC restarting sporadically

[dapaulio]

Hi All

 

A couple weeks ago I introduced a 2016 DC with a view to decommission my 2008r2 DC in due course however since promoting my 2016 dc I small population of my windows 7 clients logon and are presented with a black screen for upto about 30 mins

 

on the dc there seems to be to application error logs repeating itself sporadically

 

Application error - ID 1000

Faulting application name: lsass.exe, version: 10.0.14393.187, time stamp: 0x57cf9e87
Faulting module name: msvcrt.dll, version: 7.0.14393.0, time stamp: 0x57899b47
Exception code: 0xc0000005
Fault offset: 0x000000000005c7a0
Faulting process id: 0x2a8
Faulting application start time: 0x01d2bf63cc47b4f1
Faulting application path: C:\Windows\system32\lsass.exe
Faulting module path: C:\Windows\System32\msvcrt.dll
Report Id: 10681dc9-f5a0-4118-9d2a-5e30ef0b5862
Faulting package full name: 
Faulting package-relative application ID: 

 

followed by...

Wininit - ID 1015

A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000005.  The machine must now be restarted.

 

various google suggestions seem to be linked with other server os and/or different faulting files

 

Any suggestions welcome

Edited April 28, 2017 by dapaulio

[Wubbalubbadub]

I have had a quick google on this, as we have recently changed to a full 2016 domain controller setup. Ours seem to be fine so far!

 

But from what i can see, it was also an issue in 2012R2, whenever the server had to deal with LDAP queries. Is the DC being used for any external LDAP? or SSO?

 

Which DC held your FSMO roles? Was it the one you upgraded or the 2008 R2 one?

 

I would also check sites and services and make sure they are replicating fine?

 

This thread is for someone having the same issue, with 2012R2. Might be worth a read: https://social.technet.microsoft.com/Forums/en-US/9f3a1f57-38bd-480c-aa17-719a635f4086/changing-zone-replication-lsassexe-crashing-and-dc-rebooting?forum=winserver8gen

Edited April 28, 2017 by Wubbalubbadub

[dapaulio]

To give you an idea of what I have.

 

DC01 2008r2 all FSMO roles held - Roles planned to be migrated to DC04 then DC01 will be demoted and decommisioned

DC02 2008r2 planned to be demoted and decommisioned

DC03 2012r2 ADSync - No immediate plans

DC04 2016

 

I have not demoted any of my other dc's yet as I was allowing time for any glitches (like this one to surface) before demoting and decommissioning my 2008dc's

 

Replication between all servers are ok

[Wubbalubbadub]

I know this may sound obvious, but have you done all the updates on the 2016 server? Looking through the known Server 2016 bugs, there was a bug that described that exact issue on server 2016. However it was fixed in the April 11th Cumulative update?

[ITGURU]

Last holidays i demoted one of my DCs, re-installed clean with 2016, ran dc promo, no issues here.

 

Wasn't holding any FSMO roles though, just GC and AD integrated DNS. Clients are logging on fine through it.

[dapaulio]

I know this may sound obvious, but have you done all the updates on the 2016 server? Looking through the known Server 2016 bugs, there was a bug that described that exact issue on server 2016. However it was fixed in the April 11th Cumulative update?

 

last time I updated was probably just before then. looking at my server history doesn't appear to be present. can you confirm the kb?

[dapaulio]

Thanks all i will install the April cumulative update and I'm going to disable auditing tonight and review the server after the long weekend.

 

Ill let you know

[Wubbalubbadub]

last time I updated was probably just before then. looking at my server history doesn't appear to be present. can you confirm the kb?

 

KB4015217

 

https://support.microsoft.com/en-gb/help/4015217/windows-10-update-kb4015217

[Jawloms]

@dapaulio - Did you get this solved? Can you remember how please?

[dapaulio]

I did but 2 years passing my memory is not what it used to be 🤪.... You know what I really can’t remember how I resolved it.

 

I may have decommissioned the server and spun up another dc

 

Edit... it looks like I did decommission it because I no longer have a dc04 and now have a dc05 on server 2016

Hope it helps

Edited December 17, 2019 by dapaulio

[Jawloms]

I did but 2 years passing my memory is not what it used to be 🤪.... You know what I really can’t remember how I resolved it.

 

I may have decommissioned the server and spun up another dc

 

Edit... it looks like I did decommission it because I no longer have a dc04 and now have a dc05 on server 2016

Hope it helps

 

Yup, I'm wondering if that's where I may end up going. Thank you.