Microsoft confirmed {that a} reminiscence leak launched with the March 2024 Home windows Server safety updates is behind a widespread challenge inflicting Home windows area controllers to crash.
As BleepingComputer first reported on Wednesday and as many admins have warned over the past week, affected servers are freezing and restarting unexpectedly as a result of a Native Safety Authority Subsystem Service (LSASS) course of reminiscence leak launched with this month’s cumulative updates.
“Since set up of the march updates (Trade in addition to common Home windows Server updates) most of our DCs present consistently rising lsass reminiscence utilization (till they die),” one admin said.
“Our signs had been ballooning reminiscence utilization on the lsass.exe course of after putting in KB5035855 (Server 2016) and KB5035857 (Server 2022) to the purpose that every one bodily and digital reminiscence was consumed and the machine hung,” one other Home windows admin instructed BleepingComputer.
The recognized challenge impacts all area controller servers with the most recent Home windows Server 2012 R2, 2016, 2019, and 2022 updates.
It additionally solely impacts enterprise methods utilizing the impacted Home windows Server platform; dwelling customers aren’t affected.
“Following set up of the March 2024 safety replace, launched March 12, 2024 (KB5035857), Native Safety Authority Subsystem Service (LSASS) might expertise a reminiscence leak on area controllers (DCs),” Microsoft says.
“That is noticed when on-premises and cloud-based Lively Listing Area Controllers service Kerberos authentication requests. Excessive reminiscence leaks might trigger LSASS to crash, which triggers an unscheduled reboot of underlying area controllers (DCs).”
Microsoft has recognized the foundation trigger and is engaged on a repair, which can be launched quickly.
Short-term workaround
Till Microsoft releases a repair for this extreme reminiscence leak challenge and in the event that they’re unwilling to observe affected methods’ reminiscence utilization and reboot them when wanted, Home windows admins are suggested to take away the troublesome updates from their area controllers.
“Microsoft Assist has really useful that we uninstall the replace in the intervening time,” the identical admin instructed BleepingComputer.
To take away these buggy updates, open an elevated command immediate from the Begin menu by typing ‘cmd,’ right-clicking the Command Immediate software, after which clicking ‘Run as Administrator.’
Subsequent, relying on what replace you’ve put in on affected area controllers, run one of many following instructions:
wusa /uninstall /kb:5035855
wusa /uninstall /kb:5035849
wusa /uninstall /kb:5035857
In December 2022, Microsoft resolved another LSASS memory leak affecting area controllers. After putting in Home windows Server updates launched through the November 2022 Patch Tuesday, impacted servers would freeze and restart.
Moreover, in March 2022, Microsoft mounted one more LSASS crash that brought about surprising reboots of Home windows Server area controllers.
