Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The “critical system process, C:WindowsSystem32lsass.exe, failed” message means Windows lost its Local Security Authority Subsystem Service (LSASS). LSASS authenticates users, enforces local security policy and translates account names into security identifiers, so Windows treats a crash as a security-critical failure and restarts the computer.
There is no single fix. The hexadecimal status code, faulting module, Windows build, recent updates and whether the computer is a domain controller determine the correct response. Capture those details first, then use Safe Mode or Windows Recovery Environment, install the cumulative update for the exact release, repair system files and investigate third-party authentication software. Domain controllers need a separate, role-aware procedure.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What does the critical LSASS process error mean?
LSASS is a protected Windows security process, not an ordinary application. Microsoft describes the Local Security Authority Server Service as the process that keeps track of the security policies and accounts in effect on a computer. It authenticates and logs users, maintains local security policy and translates names to security identifiers.
When lsass.exe stops unexpectedly, Windows cannot reliably maintain sign-in and security state. The operating system therefore records a forced restart rather than allowing the session to continue. The path in the message normally appears as C:WindowsSystem32lsass.exe; do not download another copy or delete this one.
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Why doesn’t the message itself identify the cause?
The wording is the same for unrelated failures. Microsoft has documented LSASS crashes caused by a Windows client update issue, an LDAP-over-TLS race on Windows Server 2019 domain controllers, Kerberos code on Windows Server 2012 R2, an Active Directory replication conflict and a third-party Citrix authentication DLL. Treat the status code and faulting module as the beginning of the diagnosis, not as interchangeable error labels.
| Signature or context | What Microsoft or the vendor documented | What it tells you to check |
|---|---|---|
Windows 10 build 19042.388 era; status c0000008 |
Microsoft reported a fix for an lsass.exe failure with this status in that build. |
Windows edition, build number and cumulative-update history. |
Windows Server 2019 domain controller; LDAP over TLS; status 0xc0000409 |
KB5016690 addresses an LSASS race when simultaneous LDAP-over-TLS requests fail to decrypt. | Server role, LDAP-over-TLS traffic and whether the server has the applicable update. |
Windows Server 2019 or read-only domain controller; status c0000602; ESENT.dll |
Microsoft documented a restart pattern with Wininit Event 1015 and User32 Event 1074, with ESENT.dll shown as the faulting module. | The exact server build, event timing and ESENT-related crash details. |
Windows Server 2012 R2; status c0000005; kerberos.DLL |
Microsoft identified Kerberos.DLL in one unexpected-restart case. | The operating-system generation and Kerberos-related authentication activity. |
Active Directory replication conflict; status 255 |
A conflicting CNF NTDS Settings object can crash LSASS and reboot a domain controller. | Replication metadata and duplicate or conflict-renamed NTDS Settings objects. |
| Citrix Virtual Delivery Agent installed | Citrix found ctxauth.dll calling a null pointer and requested a full LSASS crash dump for stack matching. |
Recently changed VDA or authentication components and a complete dump for vendor support. |
These are documented examples, not a promise that every computer showing the same sentence has one of these causes. No reliable prevalence or affected-device percentage has been established for this error.
Free tools Windows power users keep installed
One-click scans. No signup required.
What information should I collect before trying repairs?
If Windows stays running long enough, collect the evidence before changing drivers or uninstalling updates. If it is in a restart loop, enter Safe Mode through Windows Recovery Environment and collect the same information there.
- Open Event Viewer and inspect Windows Logs > System and Windows Logs > Application around the restart time.
- Record Microsoft-Windows-Wininit Event 1015, User32 Event 1074 and Application Error Event 1000 when they are present. Note the timestamp and the process or module named in each event.
- Copy the complete hexadecimal status code exactly, including leading zeroes and the
0xprefix if Event Viewer displays one. Examples documented by Microsoft includec0000409,c0000008,c0000005,c0000602and255. - Write down the Windows edition, build number, whether it is a client, member server, read-only domain controller or writable domain controller, and the last cumulative update installed.
- Capture the faulting module name, such as
kerberos.DLL,ESENT.dll,ctxauth.dllor another DLL. A module name is often more useful than the generic LSASS wording.
Export the relevant event entries as files rather than relying on screenshots. Keep the original timestamps and do not edit the event text; support engineers need the exact code and module relationship.
How do I stop a Windows client from rebooting long enough to troubleshoot it?
Use Windows Recovery Environment (WinRE) to start Safe Mode when normal startup immediately restarts. Safe Mode loads a minimal set of drivers and services, which can separate a third-party authentication or filter component from a Windows servicing problem.
Also popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
- From the recovery screen, choose Troubleshoot > Advanced options > Startup Settings > Restart.
- After the restart, choose the Safe Mode option. If networking is required to obtain an update or export logs, use the networking variant only when necessary.
- In Safe Mode, copy the event details, check the installed update list and note recently added security, VPN, virtualization or network-filter software.
- If Safe Mode is stable, perform a clean boot to isolate non-Microsoft services and startup items. Re-enable items in groups after testing so that the component associated with the crash can be identified.
A clean boot is an isolation method, not proof that LSASS itself has been repaired. If the restart returns when a particular service is re-enabled, preserve its name and version for the software vendor.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Which repair sequence should I use on a Windows client?
Apply the steps in order, keeping the collected status code and build information with every change. The sequence below is appropriate for a workstation or non-domain server that can boot normally or in Safe Mode.
1. Install the cumulative update for the exact release
Check the Windows edition and build, then install the latest cumulative update that explicitly applies to that release. Microsoft has shipped LSASS fixes in specific updates; a package for another Windows generation may not contain the relevant correction and can create a new servicing problem. The Windows 10 c0000008 fix documented for build 19042.388 and the Server 2019 fixes are separate examples, not interchangeable packages.
2. Repair the component store and protected files
When Windows can remain running, open an elevated Command Prompt and run the standard Microsoft repair workflow:
DISM.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannowAllow each command to finish and record its result. These tools can repair component-store or protected-file corruption, but Microsoft community guidance does not establish them as a cure for every LSASS status code. A clean result does not rule out an update race, directory conflict or third-party DLL.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
3. Review software that authenticates or filters network traffic
Examine security agents, VPN clients, smart-card or credential providers, virtualization additions and network-filter drivers installed or updated shortly before the first crash. The documented Citrix case shows why this matters: ctxauth.dll made a null-pointer call inside the authentication path. Do not remove security software blindly on a production machine; coordinate a rollback or vendor-approved update and keep the event evidence.
4. Test after each controlled change
Restart normally, reproduce the sign-in or workload that previously triggered the failure and check Event Viewer for a new Event 1015, 1074 or 1000. If the problem returns, compare the new timestamp, status and module with the original record instead of assuming the last change caused it.
What is different when the affected computer is a domain controller?
Do not treat a domain controller like a desktop. Repeated forced restarts can interrupt authentication and replication, and uninstalling an update without checking the documented failure signature can remove an unrelated security fix. First preserve the events, dump files and server build, then investigate the role-specific paths below.
LDAP-over-TLS failures on Windows Server 2019
Microsoft documented an LSASS race when simultaneous LDAP-over-TLS requests fail to decrypt, producing exception 0xc0000409. Confirm that the server is Windows Server 2019, review LDAP-over-TLS activity around the crash and verify whether KB5016690 or a superseding cumulative update applicable to that build is installed. A client-only update will not address a server-role race.
ESENT.dll and status c0000602
On Windows Server 2019 and read-only domain controllers, Microsoft described restart events that include User32 Event 1074, Wininit Event 1015 and ESENT.dll as the faulting module. Preserve those three records together with the dump and exact build before changing the server, because the combination distinguishes this pattern from a generic LSASS crash.
Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Kerberos.DLL on Windows Server 2012 R2
One Microsoft unexpected-restart case on Server 2012 R2 names kerberos.DLL and status c0000005. Check the operating-system generation and Kerberos-related events rather than applying a Server 2019 remedy. The age and role of the server are part of the diagnosis.
Conflicting NTDS Settings objects
A status of 255 can accompany an Active Directory replication conflict in which a CNF NTDS Settings object causes LSASS to crash and reboot the domain controller. Have an Active Directory administrator inspect replication metadata and the NTDS Settings objects before deleting or renaming anything. Directory-topology changes should be made with a recovery plan for the remaining domain controllers.
When does third-party authentication software require vendor support?
If a Citrix Virtual Delivery Agent is installed and the event names ctxauth.dll, treat the crash as a potential vendor component failure rather than replacing Windows files. Citrix’s documented investigation found a null-pointer call and requested a full lsass.exe crash dump so its engineers could match the stack to a known remediation.
For a support case, provide the dump in the format requested by the vendor, the event exports, exact status code, faulting module, Windows build, VDA version and a timeline of recent changes. Avoid posting a dump publicly; it can contain authentication and system information.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should I do if the reboot loop continues after updates and repairs?
Stop experimenting once Safe Mode, the matching cumulative update and the built-in repair workflow have failed. Preserve the event logs, any available full crash dump, update history and a written timeline, then contact Microsoft support for a Windows or Active Directory signature, or the relevant software vendor when a third-party DLL is implicated.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Do not download a replacement lsass.exe, copy one from another computer or delete the file in C:WindowsSystem32. LSASS is a protected part of Windows; an unofficial binary can prevent startup and create a security incident. Likewise, do not infer that antivirus removal, a random driver updater or a generic “registry cleaner” addresses a status code that Microsoft has tied to a specific update, server role or directory condition.
How can I avoid losing the evidence during recovery?
- Use Safe Mode or WinRE to copy event exports to an external, trusted location before repeated restarts overwrite context.
- Record the first failure time, not only the latest reboot; the earliest event often identifies the update or service that changed the behavior.
- Keep the status code and faulting module together. A code without its module, or a module without the Windows build, is insufficient to select a documented fix.
- For domain controllers, coordinate changes with the directory team and confirm replication health after service is restored.
- When a vendor requests a full crash dump, create and transfer it through the vendor’s approved support channel rather than trimming the file or uploading it to a public forum.
What is the practical decision path?
For a non-domain Windows client, collect Event Viewer evidence, enter Safe Mode if necessary, apply the cumulative update that matches the build, run DISM and SFC, and isolate recently changed authentication or filtering software. For a domain controller, preserve the same evidence but branch immediately into the LDAP-over-TLS, ESENT, Kerberos or Active Directory replication signature that matches the server. If no documented signature fits, a complete dump and Microsoft or vendor analysis are safer than speculative file replacement.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Frequently Asked Questions
Could this error mean the computer is infected with malware?
The restart message alone cannot establish malware. Microsoft’s documented causes include update defects, authentication races, Kerberos processing, Active Directory metadata conflicts and a vendor DLL, so investigate the status code, module and recent changes before drawing a security conclusion.
Should I uninstall the newest Windows update immediately?
Not before recording the build, events and status code. LSASS fixes are release-specific, and removing an update from the wrong Windows edition or server role can discard unrelated security fixes; use the documented signature to decide whether rollback is appropriate.
What if the computer restarts before Event Viewer opens?
Use WinRE to start Safe Mode, then inspect the System and Application logs from the previous boot. Export the relevant entries and note their timestamps before testing another restart, so the evidence is not reduced to a screenshot of the final message.
What should I include in a Microsoft or vendor support ticket?
Send the exact status code, faulting module, Windows edition and build, update history, Event 1015/1074/1000 exports, whether the machine is a domain controller and a timeline of recent software changes. If requested, add a full LSASS crash dump through the provider’s secure upload process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
