lsass.exe causes reboot of SQL Server

Last week I have seen an interesting behaviour, and this has happened to two of our client. The lsass.exe causes reboot of SQL Server. LSASS.exe as you would have known probably is an executable in Windows Operating system that is responsible for forcing security policy for the system. What will happen if there is a fault in lsaas.exe or lsass.exe is forced to terminate? Well, it will result in restart of the machine. And, that is what I mean here, lsaas.exe causes reboot of SQL Server.

Log Name:      System
Source:        User32
Date:          11/30/2017 4:52:38 AM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      SQL03
Description:
The process wininit.exe has initiated the restart of computer SQL03 on behalf of user  for the following reason: No title for this reason could be found
 Reason Code: 0x50006
 Shutdown Type: restart
 Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code 8.  The system will now shut down and restart.

Looking at the above details it is not really very much clear as why the restart is initiated. I have tried to dig in and did some research but it did not lead me to exact issue. However, there are few that forcible terminate lsass.exe causes reboot of SQL Server, they are:

  • A faulty application
  • password change (lsass.exe handles password change as well and tokens too)

At the client server, we have few third-party apps that have crashed around the time of reboot happened. We haven’t established the reason yet as RCA is still pending. Have you seen this kind of error for any of your server? Were you able to establish the reason? Do let me know in the comment section.

Leave a comment