Directly from Microsoft
- Modem
Lsass.exe Quits Unexpectedly with Status Code -1073741819
View products that this article applies to.
This article was previously published under Q300038
SYMPTOMS
After you install Windows 2000 Service Pack 2 (SP2) on a Windows 2000-based domain controller, you may receive the following error message:
The system process lsass.exe terminated unexpectedly with status code -1073741819. The system will now shut down and restart.
This error message occurs after every subsequent reboot, usually within 15 minutes of the reboot.
CAUSE
This behavior is caused by an invalid replInterval value in the Configuration container in the properties of a site link.
RESOLUTION
To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
260910 How to Obtain the Latest Windows 2000 Service Pack
To resolve this issue, use either of the following methods:
Change the Replicate every value by using the user interface on the site link to be greater than or equal to 15 and less than or equal to 10,080.
Use Ldp.exe or Adsiedit.exe to modify the replInterval value. Set the value within the range that is specified above.
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.
MORE INFORMATION
By default, site links are assigned a value of 180 minutes for the Replicate every value and 100 for the Cost value. Prior to Windows 2000 Service Pack 1 (SP1), you can modify the Replicate every value to less than 15 minutes and more than 10,080 minutes. Setting this value outside of the previously stated range produces an invalid value of 65551 for the replInterval value on each site link that is not using a valid value. If this value is changed before SP1 is installed, and is not updated by using the Site Link user interface after SP1 is applied, the value may be invalid and may cause an access violation in Lsass.exe
Although the Site Link user interface may show a value of 15 minutes, you can verify the value by using Ldp.exe to run the following query against the Configuration container for a given domain:
(&(objectclass=siteLink)(replInterval>=10081))
For additional information, click the article number below to view the article in the Microsoft Knowledge Base:
251057 You Can Add Invalid Replication Interval and Cost Values for Site Link Properties
The site link properties, specifically the replInterval value, are stored in the following location:
CN=siteLink Name,CN=IP,CN=Inter-Site Transports,CN=Sites,DC=Configuration,DC=domain,DC=suffix
NOTE: If the message box appears before you are able to log on, Ctrl-Alt-Del will NOT work and you will NOT be able to log on. You will, therefore, not be able to implement the workaround. If this occurs, see the following Microsoft Knowledge Base article for additional information:
306497 Lsass.exe System Process Unexpectedly Quits with a -1073741819 Status Code