Microsoft acknowledged a new known issue leading to Local Security Authority Subsystem Service (LSASS) critical system process crashes and forced reboots on some Windows 10 devices.
LSASS is responsible for security policy enforcing on Windows systems and it is used by the system to add entries to the security log, as well as to handle user logins, password changes, and access token creation.
When LSASS fails, the user will immediately lose access to any accounts available on the machine, an error will be displayed, and the machine is forced to restart.
Devices running Windows 10 1809 or later affected
Microsoft explains that “[t]he Local Security Authority Subsystem Service (LSASS) file (lsass.exe) might fail on some devices with the error message:
A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000008. The machine must now be restarted.
The known issue was added today by Microsoft on the entries of the KB4557957 and KB4560960 cumulative updates published as part of this month’s Patch Tuesday, on June 9, 2020, as well as on the entries of KB4567512 and KB4567523 optional updates that fixed a previous issue causing printing problems.
While these updates can only be applied to Windows 10 versions 1903 or later, users have also reported experiencing the same issue devices running fully updated Windows 10, version 1809 installations.
“We have some machines on our domain that’s crashing upon login,” one user said. “They get the ‘Your PC Will Automatically Restart in One Minute’ then they are forced to restart. After the restart, they’re able to login again and continue working until the next day.”
Another one said that he was experiencing restarts after his laptop running Windows 10 1809 Enterprise was being powered on.
Microsoft is working on an official fix
Microsoft has not yet formally acknowledged this issue (no new support document has been published or new known issues have been added to the Windows 10 health dashboard so far) and an official fix for this problem is not yet available.
However, as the company explains, Redmond’s developers are working on a resolution to be provided to affected customers as part of an upcoming release.
While an official fix for this is not available, users who can’t use their devices because of LSASS continuously failing can get rid of the issue by uninstalling the June 2020 cumulative updates.
Before uninstalling the two Cumulative Updates, you should first know that you are also removing mitigation for security issues impacting your Windows 10 device.
Microsoft says in the two updates’ details (1, 2) that they can be removed “by selecting View installed updates in the Programs and Features Control Panel.”
If you are willing to downgrade your computer’s security defense, you need to follow this procedure:
1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
2. On the Settings/View update history dialog window, Select Uninstall Updates.
3. On the Installed Updates dialog window, find and select KB4560960 or KB4557957, and select the Uninstall button.
4. Restart your device.
The information contained in this website is for general information purposes only. The information is gathered from Bleeping Computer, while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk. Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them. Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control.