Windows Server 2003. Accessing Local Users/Groups causes reboot

if try go local users , groups , manage accounts, lsass.exe crashes , system reboots.  can stop reboot "shutdown -a" command, still cannot manage users/groups.  also, user/group list appears blank.  when use "net user," can see users, if attempt manage them through command line, "system error 2 has occurred system cannot find file specified."

in system under event viewer:


event type:    information
event source:    user32
event category:    none
event id:    1074
date:        6/17/2010
time:        3:05:57 pm
user:        nt authority\system
computer:    myserver2003
description:
process winlogon.exe has initiated restart of computer myserver2003 on behalf of user  following reason: no title reason found
 reason code: 0x50006
 shutdown type: restart
 comment: system process 'c:\windows\system32\lsass.exe' terminated unexpectedly status code 0.  system shut down , restart.

more information, see , support center @ http://go.microsoft.com/fwlink/events.asp.


in application under event viewer:

event type:    error
event source:    winlogon
event category:    none
event id:    1015
date:        6/17/2010
time:        3:05:56 pm
user:        n/a
computer:    myserver2003
description:
critical system process, c:\windows\system32\lsass.exe, failed status code 00000000.  machine must restarted.

more information, see , support center @ http://go.microsoft.com/fwlink/events.asp.

 

first off, not sasser virus, many google searches suggest.  i've run multiple antivirus , malware removal kits insure machine not affected.  not 1 virus instance has shown up.  secondly, machine not domain controller, comes lot error.

i've tried following:

--removing , re-applying sp 2.

--sfc /scannow

--sfc /purgecache followed run of sfc/scannow

very open suggestions.  thanks.

hi,

i suspect problem caused anti-virus software or other safety software. narrow down cause, suggest testing in safe mode first. there progress?

if not, please collect following information research:

1. when did issue start occur?
2. is there change made on system?
3. on system, open mmc, click file, click add/remove snap-in, select local users , groups, , try access remotely problematic system. what’s result?

thanks.

---

this posting provided "as is" no warranties, , confers no rights. please remember click "mark answer" on post helps you, , click "unmark answer" if marked post not answer question. can beneficial other community members reading thread.

Windows Server  >  Windows Server General Forum