Microsoft: KB5035857 woes causing Windows Server DC reboots due to LSASS memory leak

Last week, Microsoft released its Patch Tuesday updates for March 2024 (Windows 10 / Windows 11). The latter fixes a 0x800F0922 error, which was an artifact of a previous buggy update.

While the tech giant has not confirmed any major issues related to its Windows 10 and 11 Patch Tuesday updates, it has documented a major issue with the Server release. The company has confirmed an LSASS (Local Security Authority Subsystem Service) memory leak bug on domain controllers (DCs) while carrying out Kerberos authentication requests.

Microsoft says that in extreme scenarios, the memory leak bug can lead to the crashing of LSASS, which means an unscheduled reboot is triggered, much to the annoyance of IT and system administrators and users alike.

The LSASS helps authenticate users for local and remote sign-ins and enforce local security policies to prevent code injection that could lead to the compromise of credentials. It is part of the Local Security Authority (LSA) process.

On its Windows health dashboard website, Microsoft explains:

Following installation of the March 2024 security update, released March 12, 2024 (KB5035857), Local Security Authority Subsystem Service (LSASS) may experience a memory leak on domain controllers (DCs). This is observed when on-premises and cloud-based Active Directory Domain Controllers service Kerberos authentication requests.

 

Extreme memory leaks may cause LSASS to crash, which triggers an unscheduled reboot of underlying domain controllers (DCs).

 

Note: This issue does not occur on Home devices. It affects only environments in organizations using some Windows Server platforms.

The good news is that the root cause has been identified, says Microsoft, and that it is working on a fix, which should be out in a few days.

Next steps: The root cause has been identified and we are working on a resolution that will be released in the coming days. This text will be updated as soon as the resolution is available.

You may find more details about the issue on this page on Microsoft's Windows health website.

Source