Last week I have seen an interesting behaviour, and this has happened to two of our client. The lsass.exe causes reboot of SQL Server. LSASS.exe as you would have known probably is an executable in Windows Operating system that is responsible for forcing security policy for the system. What will happen if there is a fault in lsaas.exe or lsass.exe is forced to terminate? Well, it will result in restart of the machine. And, that is what I mean here, lsaas.exe causes reboot of SQL Server.
Log Name: System Source: User32 Date: 11/30/2017 4:52:38 AM Event ID: 1074 Task Category: None Level: Information Keywords: Classic User: SYSTEM Computer: SQL03 Description: The process wininit.exe has initiated the restart of computer SQL03 on behalf of user for the following reason: No title for this reason could be found Reason Code: 0x50006 Shutdown Type: restart Comment: The system process 'C:Windowssystem32lsass.exe' terminated unexpectedly with status code 8. The system will now shut down and restart.
Looking at the above details it is not really very much clear as why the restart is initiated. I have tried to dig in and did some research but it did not lead me to exact issue. However, there are few that forcible terminate lsass.exe causes reboot of SQL Server, they are:
- A faulty application
- password change (lsass.exe handles password change as well and tokens too)
At the client server, we have few third-party apps that have crashed around the time of reboot happened. We haven’t established the reason yet as RCA is still pending. Have you seen this kind of error for any of your server? Were you able to establish the reason? Do let me know in the comment section.
