Win2k3 Server restarting - LsaSrv 5000

Hi all,

Our win2k3 with VPN server works perfectly until we decided to install a
separate broadband line to cater the VPN access. Now, it restarts by
itself randomly and we get these in the event log:

Source: LsaSrv
Event ID: 5000
"The security package NTLM generated an exception. The exception
information is the data."

followed by,

Source: USER32
Ivent ID: 1074
"The prrocess winlogon.exe has initiated the restart of computer
<<servername>> on behalf of user for the following reason: No title for this
reason could be found.
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process C:|WINDOWS\System32\lsass.exe terminated
unexpectedly with status code - 1073740972. The system will now shutdown
and restart"

Previously the server has 1 NIC that connects to the router, it serves both
local and remote users perfectly.

Now, we have installed additional NIC to handle the other broadband line for
VPN access. that's when the problem started. Here's my configuration:

NIC1 (connected to the router)
ip: 192.168.1.xxx
sm: 255.255.255.0
gw: none

NIC2 (connects directly to the broadband modem)
It has the IP address, Subnet Mask & Gateway given by our ISP.

Please help,

Thanks in advance,
Garry

Hello Garry,

see inline

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.

> Hi all,
>
> Our win2k3 with VPN server works perfectly until we decided to install
> a separate broadband line to cater the VPN access. Now, it restarts
> by itself randomly and we get these in the event log:
>
> Source: LsaSrv
> Event ID: 5000
> "The security package NTLM generated an exception. The exception
> information is the data."
> followed by,


http://support.microsoft.com/kb/838656


>
> Source: USER32
> Ivent ID: 1074
> "The prrocess winlogon.exe has initiated the restart of computer
> <<servername>> on behalf of user for the following reason: No title
> for this
> reason could be found.
> Reason Code: 0x50006
> Shutdown Type: restart
> Comment: The system process C:|WINDOWS\System32\lsass.exe terminated
> unexpectedly with status code - 1073740972. The system will now
> shutdown
> and restart"
> Previously the server has 1 NIC that connects to the router, it serves
> both local and remote users perfectly.
>
> Now, we have installed additional NIC to handle the other broadband
> line for VPN access. that's when the problem started.


Did you check that you have the correct and new drivers for the NIC?


Here's my
> configuration:
>
> NIC1 (connected to the router)
> ip: 192.168.1.xxx
> sm: 255.255.255.0
> gw: none
> NIC2 (connects directly to the broadband modem)
> It has the IP address, Subnet Mask & Gateway given by our ISP.
> Please help,
>
> Thanks in advance,
> Garry

Thanks. I have submitted the request and awaiting reply. Will post back
for the result.

Regards,
Garry

"Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
news:(E-Mail Removed) .com...
> Hello Garry,
>
> see inline
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
>
>> Hi all,
>>
>> Our win2k3 with VPN server works perfectly until we decided to install
>> a separate broadband line to cater the VPN access. Now, it restarts
>> by itself randomly and we get these in the event log:
>>
>> Source: LsaSrv
>> Event ID: 5000
>> "The security package NTLM generated an exception. The exception
>> information is the data."
>> followed by,
>
>
> http://support.microsoft.com/kb/838656
>
>
>>
>> Source: USER32
>> Ivent ID: 1074
>> "The prrocess winlogon.exe has initiated the restart of computer
>> <<servername>> on behalf of user for the following reason: No title
>> for this
>> reason could be found.
>> Reason Code: 0x50006
>> Shutdown Type: restart
>> Comment: The system process C:|WINDOWS\System32\lsass.exe terminated
>> unexpectedly with status code - 1073740972. The system will now
>> shutdown
>> and restart"
>> Previously the server has 1 NIC that connects to the router, it serves
>> both local and remote users perfectly.
>>
>> Now, we have installed additional NIC to handle the other broadband
>> line for VPN access. that's when the problem started.
>
>
> Did you check that you have the correct and new drivers for the NIC?
>
>
> Here's my
>> configuration:
>>
>> NIC1 (connected to the router)
>> ip: 192.168.1.xxx
>> sm: 255.255.255.0
>> gw: none
>> NIC2 (connects directly to the broadband modem)
>> It has the IP address, Subnet Mask & Gateway given by our ISP.
>> Please help,
>>
>> Thanks in advance,
>> Garry
>
>

I had the hotfix installed and the server is seems behaving now.

Thanks a lot for your help.

Regards,
Garry

"Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
news:(E-Mail Removed) .com...
> Hello Garry,
>
> see inline
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
>
>> Hi all,
>>
>> Our win2k3 with VPN server works perfectly until we decided to install
>> a separate broadband line to cater the VPN access. Now, it restarts
>> by itself randomly and we get these in the event log:
>>
>> Source: LsaSrv
>> Event ID: 5000
>> "The security package NTLM generated an exception. The exception
>> information is the data."
>> followed by,
>
>
> http://support.microsoft.com/kb/838656
>
>
>>
>> Source: USER32
>> Ivent ID: 1074
>> "The prrocess winlogon.exe has initiated the restart of computer
>> <<servername>> on behalf of user for the following reason: No title
>> for this
>> reason could be found.
>> Reason Code: 0x50006
>> Shutdown Type: restart
>> Comment: The system process C:|WINDOWS\System32\lsass.exe terminated
>> unexpectedly with status code - 1073740972. The system will now
>> shutdown
>> and restart"
>> Previously the server has 1 NIC that connects to the router, it serves
>> both local and remote users perfectly.
>>
>> Now, we have installed additional NIC to handle the other broadband
>> line for VPN access. that's when the problem started.
>
>
> Did you check that you have the correct and new drivers for the NIC?
>
>
> Here's my
>> configuration:
>>
>> NIC1 (connected to the router)
>> ip: 192.168.1.xxx
>> sm: 255.255.255.0
>> gw: none
>> NIC2 (connects directly to the broadband modem)
>> It has the IP address, Subnet Mask & Gateway given by our ISP.
>> Please help,
>>
>> Thanks in advance,
>> Garry
>
>

Hello Garry,

You're welcome.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.

> I had the hotfix installed and the server is seems behaving now.
>
> Thanks a lot for your help.
>
> Regards,
> Garry
> "Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
> news:(E-Mail Removed) .com...
>
>> Hello Garry,
>>
>> see inline
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>>> Hi all,
>>>
>>> Our win2k3 with VPN server works perfectly until we decided to
>>> install a separate broadband line to cater the VPN access. Now, it
>>> restarts by itself randomly and we get these in the event log:
>>>
>>> Source: LsaSrv
>>> Event ID: 5000
>>> "The security package NTLM generated an exception. The exception
>>> information is the data."
>>> followed by,
>> http://support.microsoft.com/kb/838656
>>
>>> Source: USER32
>>> Ivent ID: 1074
>>> "The prrocess winlogon.exe has initiated the restart of computer
>>> <<servername>> on behalf of user for the following reason: No title
>>> for this
>>> reason could be found.
>>> Reason Code: 0x50006
>>> Shutdown Type: restart
>>> Comment: The system process C:|WINDOWS\System32\lsass.exe terminated
>>> unexpectedly with status code - 1073740972. The system will now
>>> shutdown
>>> and restart"
>>> Previously the server has 1 NIC that connects to the router, it
>>> serves
>>> both local and remote users perfectly.
>>> Now, we have installed additional NIC to handle the other broadband
>>> line for VPN access. that's when the problem started.
>>>
>> Did you check that you have the correct and new drivers for the NIC?
>>
>> Here's my
>>
>>> configuration:
>>>
>>> NIC1 (connected to the router)
>>> ip: 192.168.1.xxx
>>> sm: 255.255.255.0
>>> gw: none
>>> NIC2 (connects directly to the broadband modem)
>>> It has the IP address, Subnet Mask & Gateway given by our ISP.
>>> Please help,
>>> Thanks in advance,
>>> Garr

Hi Meinolf,

The server restarted again after 2 days. Now it restarts whenever a remote
user connects to via VPN.

Please help.

Regards,
Garry
"Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
news:(E-Mail Removed) .com...
> Hello Garry,
>
> see inline
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
>
>> Hi all,
>>
>> Our win2k3 with VPN server works perfectly until we decided to install
>> a separate broadband line to cater the VPN access. Now, it restarts
>> by itself randomly and we get these in the event log:
>>
>> Source: LsaSrv
>> Event ID: 5000
>> "The security package NTLM generated an exception. The exception
>> information is the data."
>> followed by,
>
>
> http://support.microsoft.com/kb/838656
>
>
>>
>> Source: USER32
>> Ivent ID: 1074
>> "The prrocess winlogon.exe has initiated the restart of computer
>> <<servername>> on behalf of user for the following reason: No title
>> for this
>> reason could be found.
>> Reason Code: 0x50006
>> Shutdown Type: restart
>> Comment: The system process C:|WINDOWS\System32\lsass.exe terminated
>> unexpectedly with status code - 1073740972. The system will now
>> shutdown
>> and restart"
>> Previously the server has 1 NIC that connects to the router, it serves
>> both local and remote users perfectly.
>>
>> Now, we have installed additional NIC to handle the other broadband
>> line for VPN access. that's when the problem started.
>
>
> Did you check that you have the correct and new drivers for the NIC?
>
>
> Here's my
>> configuration:
>>
>> NIC1 (connected to the router)
>> ip: 192.168.1.xxx
>> sm: 255.255.255.0
>> gw: none
>> NIC2 (connects directly to the broadband modem)
>> It has the IP address, Subnet Mask & Gateway given by our ISP.
>> Please help,
>>
>> Thanks in advance,
>> Garry
>
>

Hello Garry,

Can you see additional entrys in the event viewer except the unexpected reboot?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.

> Hi Meinolf,
>
> The server restarted again after 2 days. Now it restarts whenever a
> remote user connects to via VPN.
>
> Please help.
>
> Regards,
> Garry
> "Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
> news:(E-Mail Removed) .com...
>> Hello Garry,
>>
>> see inline
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>>> Hi all,
>>>
>>> Our win2k3 with VPN server works perfectly until we decided to
>>> install a separate broadband line to cater the VPN access. Now, it
>>> restarts by itself randomly and we get these in the event log:
>>>
>>> Source: LsaSrv
>>> Event ID: 5000
>>> "The security package NTLM generated an exception. The exception
>>> information is the data."
>>> followed by,
>> http://support.microsoft.com/kb/838656
>>
>>> Source: USER32
>>> Ivent ID: 1074
>>> "The prrocess winlogon.exe has initiated the restart of computer
>>> <<servername>> on behalf of user for the following reason: No title
>>> for this
>>> reason could be found.
>>> Reason Code: 0x50006
>>> Shutdown Type: restart
>>> Comment: The system process C:|WINDOWS\System32\lsass.exe terminated
>>> unexpectedly with status code - 1073740972. The system will now
>>> shutdown
>>> and restart"
>>> Previously the server has 1 NIC that connects to the router, it
>>> serves
>>> both local and remote users perfectly.
>>> Now, we have installed additional NIC to handle the other broadband
>>> line for VPN access. that's when the problem started.
>>>
>> Did you check that you have the correct and new drivers for the NIC?
>>
>> Here's my
>>
>>> configuration:
>>>
>>> NIC1 (connected to the router)
>>> ip: 192.168.1.xxx
>>> sm: 255.255.255.0
>>> gw: none
>>> NIC2 (connects directly to the broadband modem)
>>> It has the IP address, Subnet Mask & Gateway given by our ISP.
>>> Please help,
>>> Thanks in advance,
>>> Garry

Here's an event thread of the previous shutdown,:

Time: 1:47:20PM
Type: Error
Source: WMIxWDM
Event ID: 107
Description:
"Machine Check Event reported is a fatal error.

Time: 1:49:35 PM
Type: Information
Source: USER32
Event ID: 1074
Description:
"The prrocess winlogon.exe has initiated the restart of computer.....etc.."

Time: 1:51:09 PM
Type: Error
Source: EventLog
Event ID: 6008
Description:
"The previous system shutdown at 1:50:25PM on 9/24/2007 was unexpected."

Regards,
Garry

"Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
news:(E-Mail Removed) .com...
> Hello Garry,
>
> Can you see additional entrys in the event viewer except the unexpected
> reboot?
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
>
>> Hi Meinolf,
>>
>> The server restarted again after 2 days. Now it restarts whenever a
>> remote user connects to via VPN.
>>
>> Please help.
>>
>> Regards,
>> Garry
>> "Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
>> news:(E-Mail Removed) .com...
>>> Hello Garry,
>>>
>>> see inline
>>>
>>> Best regards
>>>
>>> Meinolf Weber
>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>>> confers no rights.
>>>> Hi all,
>>>>
>>>> Our win2k3 with VPN server works perfectly until we decided to
>>>> install a separate broadband line to cater the VPN access. Now, it
>>>> restarts by itself randomly and we get these in the event log:
>>>>
>>>> Source: LsaSrv
>>>> Event ID: 5000
>>>> "The security package NTLM generated an exception. The exception
>>>> information is the data."
>>>> followed by,
>>> http://support.microsoft.com/kb/838656
>>>
>>>> Source: USER32
>>>> Ivent ID: 1074
>>>> "The prrocess winlogon.exe has initiated the restart of computer
>>>> <<servername>> on behalf of user for the following reason: No title
>>>> for this
>>>> reason could be found.
>>>> Reason Code: 0x50006
>>>> Shutdown Type: restart
>>>> Comment: The system process C:|WINDOWS\System32\lsass.exe terminated
>>>> unexpectedly with status code - 1073740972. The system will now
>>>> shutdown
>>>> and restart"
>>>> Previously the server has 1 NIC that connects to the router, it
>>>> serves
>>>> both local and remote users perfectly.
>>>> Now, we have installed additional NIC to handle the other broadband
>>>> line for VPN access. that's when the problem started.
>>>>
>>> Did you check that you have the correct and new drivers for the NIC?
>>>
>>> Here's my
>>>
>>>> configuration:
>>>>
>>>> NIC1 (connected to the router)
>>>> ip: 192.168.1.xxx
>>>> sm: 255.255.255.0
>>>> gw: none
>>>> NIC2 (connects directly to the broadband modem)
>>>> It has the IP address, Subnet Mask & Gateway given by our ISP.
>>>> Please help,
>>>> Thanks in advance,
>>>> Garry
>
>

Hello Garry,

Check out this article:
http://support.microsoft.com/kb/889249

Seems theire is a hardware error with the processor.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.

> Here's an event thread of the previous shutdown,:
>
> Time: 1:47:20PM
> Type: Error
> Source: WMIxWDM
> Event ID: 107
> Description:
> "Machine Check Event reported is a fatal error.
> Time: 1:49:35 PM
> Type: Information
> Source: USER32
> Event ID: 1074
> Description:
> "The prrocess winlogon.exe has initiated the restart of
> computer.....etc.."
> Time: 1:51:09 PM
> Type: Error
> Source: EventLog
> Event ID: 6008
> Description:
> "The previous system shutdown at 1:50:25PM on 9/24/2007 was
> unexpected."
> Regards,
> Garry
> "Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
> news:(E-Mail Removed) .com...
>
>> Hello Garry,
>>
>> Can you see additional entrys in the event viewer except the
>> unexpected reboot?
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>>> Hi Meinolf,
>>>
>>> The server restarted again after 2 days. Now it restarts whenever a
>>> remote user connects to via VPN.
>>>
>>> Please help.
>>>
>>> Regards,
>>> Garry
>>> "Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
>>> news:(E-Mail Removed) .com...
>>>> Hello Garry,
>>>>
>>>> see inline
>>>>
>>>> Best regards
>>>>
>>>> Meinolf Weber
>>>> Disclaimer: This posting is provided "AS IS" with no warranties,
>>>> and
>>>> confers no rights.
>>>>> Hi all,
>>>>>
>>>>> Our win2k3 with VPN server works perfectly until we decided to
>>>>> install a separate broadband line to cater the VPN access. Now,
>>>>> it restarts by itself randomly and we get these in the event log:
>>>>>
>>>>> Source: LsaSrv
>>>>> Event ID: 5000
>>>>> "The security package NTLM generated an exception. The exception
>>>>> information is the data."
>>>>> followed by,
>>>> http://support.microsoft.com/kb/838656
>>>>
>>>>> Source: USER32
>>>>> Ivent ID: 1074
>>>>> "The prrocess winlogon.exe has initiated the restart of computer
>>>>> <<servername>> on behalf of user for the following reason: No
>>>>> title
>>>>> for this
>>>>> reason could be found.
>>>>> Reason Code: 0x50006
>>>>> Shutdown Type: restart
>>>>> Comment: The system process C:|WINDOWS\System32\lsass.exe
>>>>> terminated
>>>>> unexpectedly with status code - 1073740972. The system will now
>>>>> shutdown
>>>>> and restart"
>>>>> Previously the server has 1 NIC that connects to the router, it
>>>>> serves
>>>>> both local and remote users perfectly.
>>>>> Now, we have installed additional NIC to handle the other
>>>>> broadband
>>>>> line for VPN access. that's when the problem started.
>>>> Did you check that you have the correct and new drivers for the
>>>> NIC?
>>>>
>>>> Here's my
>>>>
>>>>> configuration:
>>>>>
>>>>> NIC1 (connected to the router)
>>>>> ip: 192.168.1.xxx
>>>>> sm: 255.255.255.0
>>>>> gw: none
>>>>> NIC2 (connects directly to the broadband modem)
>>>>> It has the IP address, Subnet Mask & Gateway given by our ISP.
>>>>> Please help,
>>>>> Thanks in advance,
>>>>> Garry

Hi,

I have reformatted the server but still im still getting the same problem.
The event ID below is no longer present in the event viewer but it is still
restarting when a user connects to the VPN.

Time: 1:47:20PM
Type: Error
Source: WMIxWDM
Event ID: 107
Description:
"Machine Check Event reported is a fatal error.

These is what I get in the event before the restart:

Event ID: 1074
Source: USER32
Description:
The process winlogon.exe has initiated the restart of computer
<<servername>> on behalf of user for the following reason: No title for this
reason could be found:
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated
unexpectedly with status code: 1073740972. The system will now shutdown and
restart.

I have re-applied the hotfix but it dindt help to fix the problem.

Please help. I'm really spending too much time already on this problem.

Regards,
Garry
"Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
news:(E-Mail Removed) .com...
> Hello Garry,
>
> Check out this article:
> http://support.microsoft.com/kb/889249
>
> Seems theire is a hardware error with the processor.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
>
>> Here's an event thread of the previous shutdown,:
>>
>> Time: 1:47:20PM
>> Type: Error
>> Source: WMIxWDM
>> Event ID: 107
>> Description:
>> "Machine Check Event reported is a fatal error.
>> Time: 1:49:35 PM
>> Type: Information
>> Source: USER32
>> Event ID: 1074
>> Description:
>> "The prrocess winlogon.exe has initiated the restart of
>> computer.....etc.."
>> Time: 1:51:09 PM
>> Type: Error
>> Source: EventLog
>> Event ID: 6008
>> Description:
>> "The previous system shutdown at 1:50:25PM on 9/24/2007 was
>> unexpected."
>> Regards,
>> Garry
>> "Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
>> news:(E-Mail Removed) .com...
>>
>>> Hello Garry,
>>>
>>> Can you see additional entrys in the event viewer except the
>>> unexpected reboot?
>>>
>>> Best regards
>>>
>>> Meinolf Weber
>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>>> confers no rights.
>>>> Hi Meinolf,
>>>>
>>>> The server restarted again after 2 days. Now it restarts whenever a
>>>> remote user connects to via VPN.
>>>>
>>>> Please help.
>>>>
>>>> Regards,
>>>> Garry
>>>> "Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
>>>> news:(E-Mail Removed) .com...
>>>>> Hello Garry,
>>>>>
>>>>> see inline
>>>>>
>>>>> Best regards
>>>>>
>>>>> Meinolf Weber
>>>>> Disclaimer: This posting is provided "AS IS" with no warranties,
>>>>> and
>>>>> confers no rights.
>>>>>> Hi all,
>>>>>>
>>>>>> Our win2k3 with VPN server works perfectly until we decided to
>>>>>> install a separate broadband line to cater the VPN access. Now,
>>>>>> it restarts by itself randomly and we get these in the event log:
>>>>>>
>>>>>> Source: LsaSrv
>>>>>> Event ID: 5000
>>>>>> "The security package NTLM generated an exception. The exception
>>>>>> information is the data."
>>>>>> followed by,
>>>>> http://support.microsoft.com/kb/838656
>>>>>
>>>>>> Source: USER32
>>>>>> Ivent ID: 1074
>>>>>> "The prrocess winlogon.exe has initiated the restart of computer
>>>>>> <<servername>> on behalf of user for the following reason: No
>>>>>> title
>>>>>> for this
>>>>>> reason could be found.
>>>>>> Reason Code: 0x50006
>>>>>> Shutdown Type: restart
>>>>>> Comment: The system process C:|WINDOWS\System32\lsass.exe
>>>>>> terminated
>>>>>> unexpectedly with status code - 1073740972. The system will now
>>>>>> shutdown
>>>>>> and restart"
>>>>>> Previously the server has 1 NIC that connects to the router, it
>>>>>> serves
>>>>>> both local and remote users perfectly.
>>>>>> Now, we have installed additional NIC to handle the other
>>>>>> broadband
>>>>>> line for VPN access. that's when the problem started.
>>>>> Did you check that you have the correct and new drivers for the
>>>>> NIC?
>>>>>
>>>>> Here's my
>>>>>
>>>>>> configuration:
>>>>>>
>>>>>> NIC1 (connected to the router)
>>>>>> ip: 192.168.1.xxx
>>>>>> sm: 255.255.255.0
>>>>>> gw: none
>>>>>> NIC2 (connects directly to the broadband modem)
>>>>>> It has the IP address, Subnet Mask & Gateway given by our ISP.
>>>>>> Please help,
>>>>>> Thanks in advance,
>>>>>> Garry
>
>