Windows reboots – critical error in lsass.exe?

Forum / NoMachine for Windows / Windows reboots – critical error in lsass.exe?

Viewing 10 posts - 1 through 10 (of 10 total)
  • Author
    Posts
  • #14190
    piotr
    Participant

    hi,

    i’m using latest NoMachine client 5.2.11_1 to connect from Win7 to my corporate Linux terminal server.

    Recently i’ve started to encourage spontaneous reboots of Win7 system preceded by message about critical exception in system. after checking of system logs it appears the reason of exception is access violation in lsass.exe caused by nxlsa.dll:

    A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.

    Faulting application name: lsass.exe, version: 6.1.7601.23642, time stamp: 0x586e813b
    Faulting module name: nxlsa.DLL, version: 0.0.0.0, time stamp: 0x53eb4648
    Exception code: 0xc0000005
    Fault offset: 0x0000000000005727
    Faulting process id: 0x31c
    Faulting application start time: 0x01d2a90e319e1e40
    Faulting application path: C:\Windows\system32\lsass.exe
    Faulting module path: C:\Windows\system32\nxlsa.DLL

    i’ve checked and lsass.exe process is not run in protected mode so it’s not related to TR03O07676 (by checking in ProcessExplorer->lsass.exe->Security:Protected).

    Additionally, something what might be important, this started to happen to me after months of usage of NoMachine in at least version 5.1. recently (to be precise 20170328) some troubleshooting of other issue was done on my machine and for this gpupdate /force and gpupdate /sync has been issued in adm cmd shell. not far after that i’ve cross mention issue (critical exception) for the first time and after reboot i was no longer able to login to my machine. at windows logon screen, after providing login and password instead of normal spinning welcome circle the cursor goes to login field and after few seconds reboot was initiated. checking logs in safe mode directed to same reason what described above.

    I’ve managed to overcome it by disabling nxserver64 daemon. however after starting client only this happen as well after some time. Also i’ve disabled most client fancy preferences like access to devices, audio, usb but it does not help. Of course reinstallations and reboots has been issued dozen amount of times during troubleshooting this.

    As requested in similar problems i’m providing nomachine logs and win registry entries related to lsa. if anything more needed please contact me directly.

    br/piotr

    Attachments:
    #14203
    piotr
    Participant

    As a workaround to prevent reboots I’ve removed problematic lib from system directory
    C:\Windows\system32\nxlsa.DLL and the client is working up to my needs.

    #14205
    Cato
    Participant

    Hello piotr,

    We can try to extract more information from memory dumps generated during lsass.exe crash. You should be able to find them in ‘C:/Windows/Minidump/‘. We’re interested in recent *dmp file.

    Please contact us via email at forums[at]nomachine[dot]com on details about uploading memory dump. Include link to forum thread in subject.

    In the meantime, you can uninstall nxlsa module, if you don’t need server’s functionalities.
    This command needs to be executed with Administrator’s rights:

    \bin\nxservice64.exe –uninstall nxlsa

    Problems with lsass should be gone after reboot.

    #14235
    piotr
    Participant

    hi Cato,

    i’ve sent you the crashDump for lsass.exe in email.

    #14321
    Britgirl
    Keymaster

    Just to confirm that we received the crashDump. We’ll update the topic once with the results of any further investigation.

    #14359
    roberto16900
    Participant

    Hi piotr,

    it happened to me on a Windows 7 pc (64bit) too. The reason was that I had a LAN to USB server installed on this machine. NoMachine uses its own USB service and therefor I had this issue. After stopping this server the problem was gone.

     

    Ciao

    Roberto

    #14378
    Britgirl
    Keymaster

    For everyone’s info the Trouble Report related to this forum topic is available here: https://www.nomachine.com/TR12N07462.

    #14381
    Britgirl
    Keymaster

    Come and download 5.2.21. A fix has been released.

    #14754
    piotr
    Participant

    hi,

    installed 5.2.21 and same issue, unable to login because of lsass.exe crash due to nxlsa.DLL.

    how have u fixed this as nxlsa.DLL library is same size/dated as from 5.2.11_1?

    Log Name: Application
    Source: Application Error
    Date: 2017-05-10 18:57:27
    Event ID: 1000
    Task Category: (100)
    Level: Error
    Keywords: Classic
    User: N/A
    Computer: xyz
    Description:
    Faulting application name: lsass.exe, version: 6.1.7601.23714, time stamp: 0x58bf80a6
    Faulting module name: nxlsa.DLL, version: 0.0.0.0, time stamp: 0x53eb4648
    Exception code: 0xc0000005
    Fault offset: 0x0000000000007292
    Faulting process id: 0x318
    Faulting application start time: 0x01d2c9ae7a5d19e0
    Faulting application path: C:\Windows\system32\lsass.exe
    Faulting module path: C:\Windows\system32\nxlsa.DLL
    Report Id: bf0c7181-35a1-11e7-a022-e4b318ec9487
    Event Xml:

    1000
    2
    100
    0x80000000000000
    108357
    Application
    xyz

    lsass.exe
    6.1.7601.23714
    58bf80a6
    nxlsa.DLL
    0.0.0.0
    53eb4648
    c0000005
    0000000000007292
    318
    01d2c9ae7a5d19e0
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\nxlsa.DLL
    bf0c7181-35a1-11e7-a022-e4b318ec9487

    #15179
    Britgirl
    Keymaster

    There is a new TR related to the recent findings above.  Please sign up to know when a fix has been released using ‘notify me’.

    https://www.nomachine.com/TR06O07893

Viewing 10 posts - 1 through 10 (of 10 total)

This topic was marked as solved, you can't post.