Faulting application name: lsass.exe

Question

Hi,

When I start my application, the system is getting restarted. I am on Windows 11 Pro 22H2 Build 22621.3447.

Looked into the event logs, in application event log I see this:

Application event log at 15:26:38:

==================START===========

Faulting application name: lsass.exe, version: 10.0.22621.3235, time stamp: 0xf73de5da

Faulting module name: msv1_0.DLL, version: 10.0.22621.3374, time stamp: 0xf6a92be2

Exception code: 0xc0000005

Fault offset: 0x000000000000c99f

Faulting process id: 0x0x3C4

Faulting application start time: 0x0x1DA97171344C34F

Faulting application path: C:\Windows\system32\lsass.exe

Faulting module path: C:\Windows\system32\msv1_0.DLL

Report Id: 508e1c73-5064-4720-bd2a-8170e2aa67b0

Faulting package full name: 

Faulting package-relative application ID: 

EventData

AppName lsass.exe

AppVersion 10.0.22621.3235

AppTimeStamp f73de5da

ModuleName msv1_0.DLL

ModuleVersion 10.0.22621.3374

ModuleTimeStamp f6a92be2

ExceptionCode c0000005

FaultingOffset 000000000000c99f

ProcessId 0x3c4

ProcessCreationTime 0x1da97171344c34f

AppPath C:\Windows\system32\lsass.exe

ModulePath C:\Windows\system32\msv1_0.DLL

IntegratorReportId 508e1c73-5064-4720-bd2a-8170e2aa67b0

==================END=================

System event log at 15:26:37

==================START==========

The security package NTLM generated an exception. The exception information is the data.

===================END==========

My application uses NTLM and I suspect it is raising an exception because lsass.exe has crashed.

I also see these warning in the system event logs but at different time than the crash:

LSA package is not signed as expected. This can cause unexpected behavior with Credential Guard.

PackageName: wdigest

Kindly let me know what could be causing lsass crash. Let me know how can I share the event logs.

Answer 1

lsass is a core Windows service that is responsible for authentication and related user management. If it is corrupt then the system will crash. It is heavily used and would most likely crash your system pretty quickly if corrupted. It is unlikely that your application is actually causing it an issue. Does it crash if you right click some random process (like notepad) and use Run As to run as a different user?

The error code indicates an access violation which means a memory issue. lsass does have integration points so it is possible a third-party component has hooked into Windows security and is ultimately failing. If you have any third party "login" apps installed then remove them.

If this is the only place you're seeing problems then it could be a corrupt file which leads me to believe you may have a bad drive. But I would expect more errors. You could try running the sfc tool to have it check the system files and repair them if needed. If your drive is old then you might want to chkdsk it as well.

Another cause could be bad memory but this tends to cause sporadic crashes throughout the system. Running a memory test would check this pretty fast though.

Yet another possibility is that you simply need to ensure your system is updated with the latest patches. Barring that then malicious software can try to circumvent the process for whatever reasons so it never hurts to do a malicious software scan.

If nothing seems to work then it might be necessary to repair the OS. It really doesn't seem like a corrupt lsass process to me but this would be a last resort to recover the system.