LSASS Crash on member servers - Windows 2016

Question

I'm seeing the error below on randomly on member servers. Once it starts, this error occurs every few seconds. This is been happening for 2 weeks now. Only solution is too reboot the server. What is the cause of this? I have run sfc /scannow. All servers are fully patched.

Faulting application name: lsass.exe, version: 10.0.14393.2580, time stamp: 0x5bbdaebc
Faulting module name: KERNELBASE.dll, version: 10.0.14393.3659, time stamp: 0x5e9140ed
Exception code: 0xe06d7363
Fault offset: 0x0000000000034f38
Faulting process id: 0x324
Faulting application start time: 0x01d65aa548820609
Faulting application path: C:\Windows\system32\lsass.exe
Faulting module path: C:\Windows\System32\KERNELBASE.dll
Report Id: b86918f2-eb10-4bbb-b457-d6a2be782772
Faulting package full name:
Faulting application name: lsass.exe, version: 10.0.14393.2580, time stamp: 0x5bbdaebc
Faulting module name: KERNELBASE.dll, version: 10.0.14393.3659, time stamp: 0x5e9140ed
Exception code: 0xe06d7363
Fault offset: 0x0000000000034f38
Faulting process id: 0x324
Faulting application start time: 0x01d65aa548820609
Faulting application path: C:\Windows\system32\lsass.exe
Faulting module path: C:\Windows\System32\KERNELBASE.dll
Report Id: b86918f2-eb10-4bbb-b457-d6a2be782772
Faulting package full name:

Answer 1

Hi,

Does the issue occur after a specific action such as a long sleep before startup?
If yes, try to turned off the "Fast Startup" option as some customers resolved on their side.

In addition, Windows update package KB4565511 resolved a issue related with lsass.exe, please check if it works for you after installed.

Bests,

Answer 2

These are all production web, adfs proxy and database servers so they never go to sleep. KB4565511 is installed.

Answer 3

I am having a similar issue (except on a domain controller). KB4565511 is installed, it does address lsass but only when it crashes with exception code 0xc0000374. Johar and my exception is 0xe06d7363. It does not appear to be a CNF issue.

Answer 4

This is happening on 15+ servers for me still. Only cure is the reboot servers weekly in order to avoid production issues with .NET applications.