ClickCease Windows Server updates causes LSASS memory leaks

Join Our Popular Newsletter

Join 4,500+ Linux & Open Source Professionals!

2x a month. No spam.

Windows Server updates causes LSASS memory leaks

Obanla Opeyemi

December 8, 2022 - TuxCare expert team

A memory leak bug on Local Security Authority Subsystem Service (LSASS), a service that allows users to manage local security, user logins, and permissions, is being investigated by Microsoft.

It is in charge of enforcing security policies on Windows machines, and its memory leak bugs are caused by Windows Server updates released during the November Patch Tuesday, which may cause freezes and restarts on some domain controllers.

“After installing KB5019966 or later updates on Domain Controllers (DCs), you might experience a memory leak with Local Security Authority Subsystem Service (LSASS,exe). Depending on the workload of your DCs and the amount of time since the last restart of the server, LSASS might continually increase memory usage with the up time of your server and the server might become unresponsive or automatically restart,” Microsoft explained.

Windows Server versions 2008 SP2 and R2 SP1, 2012 and 2012 R2, 2016, and 2019 are affected. It accomplishes this by crashing and causing logged-in users to immediately lose access to Windows accounts on the machine, after which they are presented with a system restart error followed by a system reboot.

While Microsoft works to resolve the LSASS memory leak issue on domain controllers, there is a temporary workaround solution that will assist IT professionals in resolving the issue in enterprise environments. To accomplish this, launch the command prompt as administrator and execute the following command to set the registry key: “KrbtgtFullPacSignature” value to 0: After opening Command Prompt as Administrator, they can use the command:
reg add “HKLM\System\CurrentControlSet\services\KDC” -v “KrbtgtFullPacSignature” -d 0 -t REG_DWORD

“Once this known issue is resolved, you should set KrbtgtFullPacSignature to a higher setting depending on what your environment will allow,” Microsoft wrote. “It is recommended to enable Enforcement mode as soon as your environment is ready.”

The sources for this piece include an article in BleepingComputer.

Summary
Windows Server updates causes LSASS memory leaks
Article Name
Windows Server updates causes LSASS memory leaks
Description
Microsoft is investigating a Windows server bug in Local Security Authority Subsystem Service (LSASS) following recent security updates.
Author
Publisher Name
TuxCare
Publisher Logo

Looking to automate vulnerability patching without kernel reboots, system downtime, or scheduled maintenance windows?

Learn About Live Patching with TuxCare

Related Articles

How GPT models can be...

According to CyberArk researchers, GPT-based models like ChatGPT can be...

January 30, 2023

Attackers actively exploit Unpatched Control...

Malicious hackers have started exploiting a critical vulnerability CVE-2022-44877 in...

January 27, 2023

Attackers distribute malware via malicious...

Deep Instinct researchers reported that RATs like StrRAT and Ratty...

January 26, 2023

CircleCI partners AWS to identify...

According to CircleCI’s CTO, Rob Zuber, CircleCI is working with...

January 25, 2023

Cisco warns of authentication bypass...

A remote attacker could exploit multiple vulnerabilities in four Cisco...

January 24, 2023

IceID malware infiltrates Active Directory...

In a notable IcedID malware attack, the assailant impacted the...

January 23, 2023