Windows Server updates causes LSASS memory leaks

December 8, 2022 - TuxCare PR Team

A memory leak bug on Local Security Authority Subsystem Service (LSASS), a service that allows users to manage local security, user logins, and permissions, is being investigated by Microsoft.

It is in charge of enforcing security policies on Windows machines, and its memory leak bugs are caused by Windows Server updates released during the November Patch Tuesday, which may cause freezes and restarts on some domain controllers.

“After installing KB5019966 or later updates on Domain Controllers (DCs), you might experience a memory leak with Local Security Authority Subsystem Service (LSASS,exe). Depending on the workload of your DCs and the amount of time since the last restart of the server, LSASS might continually increase memory usage with the up time of your server and the server might become unresponsive or automatically restart,” Microsoft explained.

Windows Server versions 2008 SP2 and R2 SP1, 2012 and 2012 R2, 2016, and 2019 are affected. It accomplishes this by crashing and causing logged-in users to immediately lose access to Windows accounts on the machine, after which they are presented with a system restart error followed by a system reboot.

While Microsoft works to resolve the LSASS memory leak issue on domain controllers, there is a temporary workaround solution that will assist IT professionals in resolving the issue in enterprise environments. To accomplish this, launch the command prompt as administrator and execute the following command to set the registry key: “KrbtgtFullPacSignature” value to 0: After opening Command Prompt as Administrator, they can use the command:
reg add “HKLM\System\CurrentControlSet\services\KDC” -v “KrbtgtFullPacSignature” -d 0 -t REG_DWORD

“Once this known issue is resolved, you should set KrbtgtFullPacSignature to a higher setting depending on what your environment will allow,” Microsoft wrote. “It is recommended to enable Enforcement mode as soon as your environment is ready.”

The sources for this piece include an article in BleepingComputer.

Summary