OOB Update released for Domain Controller LSASS memory leaks

[5tu]

Out of band updates have been released to resolve the LSASS memory leaks issue on domain controllers introduced by the March 2024 cumulative updates.

 

 

Server 2022 - https://support.microsoft.com/en-gb/topic/march-22-2024-kb5037422-os-build-20348-2342-out-of-band-e8f5bf56-c7cb-4051-bd5c-cc35963b18f3

 

Server 2016 - https://support.microsoft.com/en-gb/topic/march-22-2024-kb5037423-os-build-14393-6799-out-of-band-1775cda2-4bb6-43a9-9fd4-ddc3528d3408

 

Server 2012R2 - https://support.microsoft.com/en-gb/topic/kb5037426-update-to-address-a-known-issue-that-affects-lsass-in-windows-server-2012-r2-eda1002a-4b4d-4c99-8383-b0e2bab5c1d0

 

 

From Microsoft: We strongly recommend you do not apply the March 2024 security update on DCs and install the Resolved KBs listed above instead. As this is a cumulative update, you do not need to apply any previous update before installing the Resolved KBs listed above.

Edited March 25, 2024 by gybe78

[FN-GM]

Did this not impact server 2019?

[5tu]

Apparently not....

 

[FN-GM]

Oh wow - I find it a little unusual that it managed to skip a version!

[Guest Guest]

According to https://learn.microsoft.com/en-us/windows/release-health/windows-message-center the fix for 2019 is coming soon

[pete]

Yeah, I have a 2019 DC that's definitely exhibiting higher-than-normal memory use for lsass.exe.

 

Not as bad as the 2022 DCs, which anecdotally seems to leak faster / be more of a problem. I have a tiny 2022 DC (fewer than 50 users) with an lsass.exe consuming memory faster than on the 2019 DCs serving 1000+ users.

[5tu]

According to https://learn.microsoft.com/en-us/windows/release-health/windows-message-center the fix for 2019 is coming soon

 

 

Server 2019 - https://support.microsoft.com/en-gb/topic/march-25-2024-kb5037425-os-build-17763-5579-out-of-band-fa8fb7fa-8185-408f-bdd6-ea575ce2fcb5

[Olliedawg]

Patched mine last night with the out of band release. No issues to report