-
Title
Dirsync: Password Sync causes Domain Controller to Restart -
Description
A situation can occur when during Password Sync running, the Domain Controller being accessed will reboot. The following will be logged in the System Log on the Domain Controller
The process wininit.exe has initiated the restart of computer XXXXX-DC01 on behalf of user for the following reason: No title for this reason could be found
Reason Code: 0x50006Shut-down Type: restartComment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code 255. The system will now shut down and restart. -
Cause
The reason for this that there are multiple applications accessing LSASS.exe simultaneously and this results in Windows performing a System Restart.
The following Password Policy Tools we have encountered issues causing a Domain Controller reboot when a password change occurs are:
- nFront Password Filter
- Change Auditor
- One Identity Password Manager
This conflict only occurs when using ODM Directory Sync legacy password sync that relies on BTPass.
-
Resolution
There are three options available to resolve this particular issue:
- Switch to Password Propagation Service.
- The benefit here is that RC4 is no longer a requirement.
- Switch to Modern Password sync within ODM Directory Sync
- RC4 is still required which this option
- This moves away from using BTPass and uses a dll that is injected to LSASS to not interfere with other solutions
- Remove any other password filter software from the DC to allow BTPass sole access to LSASS.exe
- Switch to Password Propagation Service.