Yo Motherboard

Anyone seeing LSASS crashes on a Server 2025 app server?

November 13, 2026 3 answers
Asked by uppercase optional

Our Windows Server 2025 app server is in an AD environment but doesn't have domain controller roles. LSASS started crashing after the April patch, forcing reboots, and the issue continued after the June patch. The dump shows access violation c0000005.

Crashes happen at varying times, sometimes days apart, with no obvious load spike. The server handles around 1,500 to 2,000 cryptographic operations per minute, mostly from one service account. Could this be related to the reported LSASS issue on domain controllers, or should we be looking elsewhere?

System Operations Windows Server 2025 LSASS crashes Active Directory access violation

Answers

slot9_for_marbles

It could be related, but the reported domain controller issue doesn't establish the cause on an app server. Similar symptoms aren't enough to tell whether it's the same defect. The crash dump and the modules involved are the better place to start.

uppercase optional:

That distinction is what I'm stuck on. I found reports involving domain controller roles, but no clear fix for a server without them.

Reply to this answer
not_quite_a_lecture

I'd open a Microsoft support case and provide the LSASS dump, patch history, and timestamps of the crashes. Include the fact that it survived the June patch and that the workload hasn't obviously changed. Ask them to identify the faulting component and whether the dump matches a known issue.

The c0000005 code tells you there was an access violation, not what caused it. It doesn't by itself prove a memory leak or point to a particular application.

Reply to this answer
no-fuss-just-fuzz

Check LSASS memory over time rather than just looking for leaks in the applications. Also compare the event logs and any available dumps across several crashes. A recurring faulting module or call stack would be a more useful lead than the time of day.

The crypto activity is worth including in the investigation, but the operation count alone doesn't show that it's responsible. Avoid changing the service account or disabling security components just to test a theory on the production server.

Reply to this answer

Add your answer

Answers are reviewed before publication.

Related Discussions