• Warning: Win10 20H2 lsass.exe has an issue

    Author
    Topic
    #2306472

    After updating to 20H2, if you try to edit a user’s permissions using Computer Management as soon as you click on “user” to choose the user to edit, the cursor shows “working” and shortly after the system will request to restart.

    “A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000374. The machine must now be restarted”

    The system reboots after 1 minute.

    It seems an old bug has been reintroduced.

    https://www.bleepingcomputer.com/news/microsoft/windows-10-june-2020-updates-cause-forced-reboots-lsass-crashes/

    1 user thanked author for this post.
    Viewing 15 reply threads
    Author
    Replies
    • #2306552

      I can edit a user in Computer Management on 20H2 without a crash.

      MODS: Could we have a forum folder for version 20H2 please?

      • #2306557

        MODS: Could we have a forum folder for version 20H2 please?

        Already requested – already in the pipeline. Be patient.

    • #2306909

      I have the same issue as RayG. After updating to 20H2 my computer forced a restart when i try to change the user in drive/ folder and/ or file permission.

    • #2307307

      Facing the same issue:
      “A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000374. The machine must now be restarted”

      Happens when I try to access Users and Groups via Computer management or Accounts in Windows settings.

      I have another system with the same update but its not affected.

      Not sure if this is related, but the affected system has just one user account.

    • #2307433

      Hello,

       

      I am also having this issue on two workstations that were recently updated to 20H2. No solution as of yet. Disabled fast-boot, removed A/V, etc. Still no luck unfortunately.

    • #2307545

      Okay to narrow down the issue I tried removing the AV etc too but since this happens in safe mode too I’ve run out of ideas 🙁

    • #2307829

      Hello,

      I also have the exact same issue. It happens on both local users of my pc. I have run a procdump of lsass.exe and a more detailed error was:

      In SystemSettings.exe_201028_144833.dmp the assembly instruction at KERNELBASE!RaiseFailFastException+15c in C:\Windows\System32\KERNELBASE.dll from Microsoft Corporation has caused an unknown exception 0xc000027b on thread 24

      Still no idea on what is causing the issue, nor how to solve it.

      Moderator note
      Edit to remove HTML
      . Please use the “Text” tab in the entry box when you copy/paste.

    • #2307933

      Found this page from a search, having the same issue here. If it helps I’m using a Lenovo ThinkPad T440, with all updates installed.

      I ran into this issue when trying to install Veeam, my guess is it was trying to modify a user or group and it triggered the error.

      After it restarted I tried to manually trigger the reboot by going into local users and groups and was able to confirm it crashes when trying to view the users.

    • #2308122

      Received KB4580364 today and i installed it to see if it would resolve the issue but no joy.

    • #2308985

      Thought I’ve posted it already here – but probably got lost. I’ve summarized that within the blog post: Windows 10 20H2: lsass.exe crashes (Oct. 2020) a few days ago. Then I forwarded the links to Microsoft’s social media teams responsible for Windows Update and WindowsITPro, and I’ve escalated a MS answer case to all MS moderators and asked to forward the case to developers. But I haven’t any feedback.

      Ex Microsoft Windows (Insider) MVP, Microsoft Answers Community Moderator, Blogger, Book author

      https://www.borncity.com/win/

      6 users thanked author for this post.
    • #2310008

      Cause

      After upgrading to Windows 10, version 20H2, you might receive the error in LSASS.exe with the text “Your PC will automatically restart in one minute” when interacting with any dialog window that lists users, for example accessing the sign-in options settings app page or the users folder in the Local user and groups MMC snap-in. This issue only affects devices in which any of the local built-in accounts have been renamed, such as Administrator or Guest. You might also receive an error in the Application Event log with Event ID 1015 that LSASS.EXE failed with status code C0000374.

      To safeguard your update experience, we have applied a compatibility hold on these devices from installing or being offered Windows 10, version 2004 or Windows 10, version 20H2. If your organization is using Update Compliance, the safeguard IDs is 30103339.

      Workaround

      If you have already encountered this issue on your device, you can mitigate it within the uninstall window by going back to your previous version of Windows using the instructions here. The uninstall window might be 10 or 30 days depending on the configuration of your environment and the version you’re updating to. You will then need to update to the later version of Windows 10 after the issue is resolved. Note Within the uninstall window, you can increase the number of days you have to go back to your previous version of Windows 10 by using the DISM command /Set-OSUninstallWindow. You must make this change before the default uninstall window has lapsed. For more information, see DISM operating system uninstall command-line options.

      To prevent the issue and not receive the safeguard hold, you will need to name all built-in user counts back to their default name before attempting to update to Windows 10, version 2004 or Windows 10, version 20H2.

      Next Steps

      We are working on a resolution and will provide an update in an upcoming release. In the coming weeks, we will also provide updated bundles and refreshed media to prevent the issue.

      Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until you have installed newer drivers or have performed the workaround above.

      After updating to Windows 10, version 20H2, you might receive an error when accessing the sign-in options or users MMC snap-in

      1 user thanked author for this post.
    • #2310076

      I saw the post from Microsoft and I can confirm the affected systems have the local administrator renamed.
      Unfortunately I am not able to roll back to the previous installation so I tried to rename the account via group policy but receive an error: An extended error has occurred. Failed to save the local policy database.

      • #2310079

        If you can’t roll back you will have to wait for MS to release a fix.

        cheers, Paul

        • #2320059

          Or boot into recovery and use CMD (SHIFT+F10) and try to rename it manually?

          for example put it back this way:
          wmic useraccount where name='NewAdminName' rename administrator

          Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise

          HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29

          PRUSA i3 MK3S+

    • #2311190

      OK So I got a notification of the feature update via windows update and decided to give it another try and this time there is no issue with lsass.exe. I can view and change security options with no issues.

      There may be other issues I have yet to stumble across but so far so good.

    • #2311328

      Okay so even I installed KB4586781 and can confirm this has to some extent resolved the issue (no more reboots) but I am not able to see any local users via lusrmgr.msc, trying to rename the local administrator account via netplwiz also isnt working.

      Is anyone else facing this?

    • #2315394

      Hi,

      We have had the issue trying to update to 20H2, we have a renamed admin account. A few of our test devices did get the update so maybe they added this SafeGuard hold on after the release. I have changed the Safeguard hold to allow on a test device but its still not getting this feature update.

      Its pretty frustrating as we have been tasked to test 20H2 and obviously can’t until this is resolved.

      https://support.microsoft.com/en-us/help/4592802/error-when-accessing-the-sign-in-options-or-users-mmc-snap-in

      Regards

      • #2315413

        Set TargetReleas..on the test PC to 2010.

        • #2315450

          That value of “2010” may not work any more. I was testing the other day with a fully updated (including the November updates) version of W10 Pro x64, and I wasn’t offered the 20H2 update with the TargetReleaseVersion value set to “2010” nor to “2009”, I had to set it to “20H2”.

          For the purposes of the testing, I wasn’t clicking on “Check for Updates” but was using wushowhide instead. The 20H2 update didn’t show up in wushowhide unless I changed the Feature Update value to 20H2. As mentioned in the paragraph above, no other value produced the 20H2 Feature Update in wushowhide.

          For further information, I didn’t change  the number I have set for Feature Update deferral days, since that setting is overridden by the Feature Update version setting.

          Also, I noticed that the title has now changed in GPEdit to “Select the target Feature Update version” from what it was before.

          All this on Windows 10 Pro x64 version 2004 build 19041.630.  🙂

           

          2 users thanked author for this post.
          • #2315481

            I managed to get 20H2 with TargetRelease.. 2010 at the start of the month.
            Maybe Nov. updates changed that to 20H2.

    • #2320048

      Have they fixed it yet?

      • #2320058

        status-windows-10-20h2 reports it’s mitigated
        Section
        You might receive an error when accessing the sign-in options or users MMC snap-in

        Windows - commercial by definition and now function...
      • #2320133

        try installing the KB4592438 update (build 19042.685) and reboot to see if the lsass.exe problem is fixed or not

        • This reply was modified 4 years, 6 months ago by EP.
    • #2326630

      Microsoft now claims this lsass.exe issue in 20H2 has been “resolved”

      https://docs.microsoft.com/en-us/windows/release-information/resolved-issues-windows-10-20h2#1514msgdesc

      appears to be fixed using refreshed 20H2 install media with at least build 19042.631 or greater

      1 user thanked author for this post.
      b
    Viewing 15 reply threads
    Reply To: Reply #2310076 in Warning: Win10 20H2 lsass.exe has an issue

    You can use BBCodes to format your content.
    Your account can't use all available BBCodes, they will be stripped before saving.

    Your information:




    Cancel