ClickCease Windows Server updates causes LSASS memory leaks

Join Our Popular Newsletter

Join 4,500+ Linux & Open Source Professionals!

2x a month. No spam.

Windows Server updates causes LSASS memory leaks

December 8, 2022 - TuxCare PR Team

A memory leak bug on Local Security Authority Subsystem Service (LSASS), a service that allows users to manage local security, user logins, and permissions, is being investigated by Microsoft.

It is in charge of enforcing security policies on Windows machines, and its memory leak bugs are caused by Windows Server updates released during the November Patch Tuesday, which may cause freezes and restarts on some domain controllers.

“After installing KB5019966 or later updates on Domain Controllers (DCs), you might experience a memory leak with Local Security Authority Subsystem Service (LSASS,exe). Depending on the workload of your DCs and the amount of time since the last restart of the server, LSASS might continually increase memory usage with the up time of your server and the server might become unresponsive or automatically restart,” Microsoft explained.

Windows Server versions 2008 SP2 and R2 SP1, 2012 and 2012 R2, 2016, and 2019 are affected. It accomplishes this by crashing and causing logged-in users to immediately lose access to Windows accounts on the machine, after which they are presented with a system restart error followed by a system reboot.

While Microsoft works to resolve the LSASS memory leak issue on domain controllers, there is a temporary workaround solution that will assist IT professionals in resolving the issue in enterprise environments. To accomplish this, launch the command prompt as administrator and execute the following command to set the registry key: “KrbtgtFullPacSignature” value to 0: After opening Command Prompt as Administrator, they can use the command:
reg add “HKLM\System\CurrentControlSet\services\KDC” -v “KrbtgtFullPacSignature” -d 0 -t REG_DWORD

“Once this known issue is resolved, you should set KrbtgtFullPacSignature to a higher setting depending on what your environment will allow,” Microsoft wrote. “It is recommended to enable Enforcement mode as soon as your environment is ready.”

The sources for this piece include an article in BleepingComputer.

Windows Server updates causes LSASS memory leaks
Article Name
Windows Server updates causes LSASS memory leaks
Microsoft is investigating a Windows server bug in Local Security Authority Subsystem Service (LSASS) following recent security updates.
Publisher Name
Publisher Logo

Looking to automate vulnerability patching without kernel reboots, system downtime, or scheduled maintenance windows?

Learn About Live Patching with TuxCare

Become a TuxCare Guest Writer

Get started




Linux & Open Source

Subscribe to
our newsletter