Credential agent crashes LSASS

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Credential agent crashes LSASS

L1 Bithead

Setup a 2016 RODC so I could use the Credential Agent.

As soon as I try starting the agent as system, the server pops a message that I will be force restarted in 1 minute. It non-gracefully reboots in 1 minute. I tried agent v10 and v9. Perms and settings appear fine afaik, and suppressing a/v didn't help. Palo sent me a suggestion to roll back patches before Jan or even before July of last year but that doesn't seem right, plus Jan is the baseline in my template. Has anyone experienced a similar issue and had any luck?


Faulting application name: lsass.exe, version: 10.0.14393.4704, time stamp: 0x615be0cd
Faulting module name: samsrv.dll, version: 10.0.14393.4886, time stamp: 0x61d5262e
Exception code: 0xc0000096
Fault offset: 0x000000000000bac6
Faulting process id: 0x298
Faulting application start time: 0x01d82bfd507c5710
Faulting application path: C:\Windows\system32\lsass.exe
Faulting module path: C:\Windows\SYSTEM32\samsrv.dll
Report Id: bf2a0ead-8af1-4d85-b595-2509ddf94f46
Faulting package full name:
Faulting package-relative application ID:


The process wininit.exe has initiated the restart of computer RODC-3 on behalf of user for the following reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code -1073741674. The system will now shut down and restart.


A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000096. The machine must now be restarted.


L1 Bithead

We have had the issue with both the January and February CU updates 

L1 Bithead

We are experiencing this same issue. We tried to patch the server in Jan and Feb. This caused the server to go into a loop. Once the User-ID Agent service launches it triggers the server to reboot in 1 min. I disabled the User-ID agent so the server is now stable. I looked at the patch and the logs on the server. The windows patch has an update to the Lsass.exe in it. The error log right after the User-ID Agent is triggered it give the error "A Critical system process, C:\windows\system32\lsass.exe, failed with status code c0000096. The machine much now be restarted." When I rolled back the patches on the RODC server I kept getting a BSOD and had to disable the driver on the boot to get the server to load. Once this was up I had to turn the nic back on and I was allowed to launch the User-ID service. I'm trying the March patch now. I'll update what happens after the March patches are installed.

L1 Bithead

we had the same issues with the march patches as well

Still no good after the March update. If I remove the updates the server give a BSOD on boot but I can get the paloalto UserID agent to run. Apply the updates and the server boots normal but once I turn on the UserID agent the server crashes. Hope Paloalto is looking into this. 


L0 Member

We are having the same issue, we also have an open support ticket on this.  Only resolution at this point is to remove Jan/Feb/Mar CU. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!