Credential agent crashes LSASS

[palousermatthew]

Setup a 2016 RODC so I could use the Credential Agent.

As soon as I try starting the agent as system, the server pops a message that I will be force restarted in 1 minute. It non-gracefully reboots in 1 minute. I tried agent v10 and v9. Perms and settings appear fine afaik, and suppressing a/v didn't help. Palo sent me a suggestion to roll back patches before Jan or even before July of last year but that doesn't seem right, plus Jan is the baseline in my template. Has anyone experienced a similar issue and had any luck?

Faulting application name: lsass.exe, version: 10.0.14393.4704, time stamp: 0x615be0cd
Faulting module name: samsrv.dll, version: 10.0.14393.4886, time stamp: 0x61d5262e
Exception code: 0xc0000096
Fault offset: 0x000000000000bac6
Faulting process id: 0x298
Faulting application start time: 0x01d82bfd507c5710
Faulting application path: C:\Windows\system32\lsass.exe
Faulting module path: C:\Windows\SYSTEM32\samsrv.dll
Report Id: bf2a0ead-8af1-4d85-b595-2509ddf94f46
Faulting package full name:
Faulting package-relative application ID:

----------

The process wininit.exe has initiated the restart of computer RODC-3 on behalf of user for the following reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code -1073741674. The system will now shut down and restart.

----------------

A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000096. The machine must now be restarted.

[Magnus_App]

Latest from palo:

"This issue will be fixed with the next software release and we do not have any updates for the ETR yet.
I will let you know when we have an update."

[summands]

Thanks for the update @Magnus_App. 

By chance did you capture whether Palo mean tPAN-OS release or credential agent release?

[Eric_Ratermann]

Waiting on an updated UserID/Credential agent. 10.0.5 is the target release for the fix.  

[Magnus_App]

No but I'm assuming it will be a new agent release

[Brandon89]

Running into this exact issue, any solutions out there or updates?

[brucegarlock]

The last news I have on my ticket which was escalated, just says they are aware and working on a fix, but no timeline.  There are a number of teams involved, which is also why it is taking a long time for a fix.  

Since MS likely made changes to making getting creds more difficult, I am sure this is a good challenge for PAN.  I am guessing PAN may have to work directly with MS somehow.

This is such a great feature, and I hope they come up with a solution soon.

[mdepalmaevr]

Just had the issue again on our side. Will be monitoring for this new version.

[JonathanFonner]

Has anyone had any success or updates on this? I have a case open with TAC but no response yet.

[andrey11]

Hello Guys,

some update on this? I see that WINAGENT-830 ist still not fixed in User-ID Agent 10.0.5 according to Release Notes.

Thanks,

Andrey

 

[AndreasThanner]

have heard that the bugfix is currently in QA. Its planned to fix this with the next release

[Jay_Moock]

New agent has been released. Looks like it requires the RODCs to be Server 2019. 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000sZCACA2

[andrey11]

Jay, thanks for the info, i will check it with my customer 👌

[andrey11]

Got feedback from my customer, with new Version thats working like expected. Thanks!

[palousermatthew]

I've been running the new version for a couple weeks now without issue on 2019