Credential agent crashes LSASS

[palousermatthew]

Setup a 2016 RODC so I could use the Credential Agent.

As soon as I try starting the agent as system, the server pops a message that I will be force restarted in 1 minute. It non-gracefully reboots in 1 minute. I tried agent v10 and v9. Perms and settings appear fine afaik, and suppressing a/v didn't help. Palo sent me a suggestion to roll back patches before Jan or even before July of last year but that doesn't seem right, plus Jan is the baseline in my template. Has anyone experienced a similar issue and had any luck?

Faulting application name: lsass.exe, version: 10.0.14393.4704, time stamp: 0x615be0cd
Faulting module name: samsrv.dll, version: 10.0.14393.4886, time stamp: 0x61d5262e
Exception code: 0xc0000096
Fault offset: 0x000000000000bac6
Faulting process id: 0x298
Faulting application start time: 0x01d82bfd507c5710
Faulting application path: C:\Windows\system32\lsass.exe
Faulting module path: C:\Windows\SYSTEM32\samsrv.dll
Report Id: bf2a0ead-8af1-4d85-b595-2509ddf94f46
Faulting package full name:
Faulting package-relative application ID:

----------

The process wininit.exe has initiated the restart of computer RODC-3 on behalf of user for the following reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code -1073741674. The system will now shut down and restart.

----------------

A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000096. The machine must now be restarted.

[NaheedVisram]

We have had the issue with both the January and February CU updates 

[JeffCrowell33]

We are experiencing this same issue. We tried to patch the server in Jan and Feb. This caused the server to go into a loop. Once the User-ID Agent service launches it triggers the server to reboot in 1 min. I disabled the User-ID agent so the server is now stable. I looked at the patch and the logs on the server. The windows patch has an update to the Lsass.exe in it. The error log right after the User-ID Agent is triggered it give the error "A Critical system process, C:\windows\system32\lsass.exe, failed with status code c0000096. The machine much now be restarted." When I rolled back the patches on the RODC server I kept getting a BSOD and had to disable the driver on the boot to get the server to load. Once this was up I had to turn the nic back on and I was allowed to launch the User-ID service. I'm trying the March patch now. I'll update what happens after the March patches are installed.

[NaheedVisram]

we had the same issues with the march patches as well

[JeffCrowell33]

Still no good after the March update. If I remove the updates the server give a BSOD on boot but I can get the paloalto UserID agent to run. Apply the updates and the server boots normal but once I turn on the UserID agent the server crashes. Hope Paloalto is looking into this. 

[btroudy]

We are having the same issue, we also have an open support ticket on this.  Only resolution at this point is to remove Jan/Feb/Mar CU.