I'm running vmware server 1.0.1 in a Windows XP host. The host crashes with a message saying that lsass.exe has exited and the machine will be rebooted in 60 seconds (not a BSOD). The windows event log always shows an error from vmauthd occurring immediately before the lsass.exe crash.
The problem usually occurred within a few hours of starting a vmware guest, but has gone away since I disabled hyperthreading on the host.
Has anyone else seen anything like this? I realize that XP is not a supported host OS, but I'm wondering if this might occur on the Windows server systems as well.
Host information:
\- Lenovo ThinkCentre A52 (BIOS at latest revision, from mid-september 2006)
\- 2 GB of RAM
\- 3.0 GHz dual-core Xeon processor
Guest information:
\- two Win2k3 servers, each with 384 MB of RAM
The host and guess operating systems will normally run without problems for anywhere from a few minutes to a few hours. When the problem occurs, the first event to occur is a message in the host application log saying something like:
Source: vmauthd
Type: Error
Event ID: 100
"Request by process to open '
.\vmx86': unrecognized pid"
Immediately after the error from vmauthd, another error is logged:
Source: winlogon
Type: Error
Event ID: 1015
"A critical system process, C:\WINDOWS\system32\lsass.exe", failed with status code c0000005. The machine must now be restarted"
At the same time, this error is logged in the host System log:
Source: USER32
Category: NONE
Event ID: 1074
User: NT AUTHORITY\SYSTEM
"The process winlogon.exe has initiated the restart of for the following reason: No title for this reason could be found
Minor reason: 0x6
Shutdown type: reboot
Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code -1073741819. The system will now shut down and restart."
Data (bytes): 06 00 05 00
When this happens, an alert appears on the desktop saying that lsass.exe has crashed with status code -1073741819. The alert counts down from 60 seconds, and then the machine reboots.
I'm aware that certain viruses/worms exploiting problems in Windows can cause lsass.exe to crash in this fashion. I'm pretty sure this isn't a virus, because:
a) I'm running up-to-date AV, and I've done a full scan.
b) The crash only occurs when vmware is running.
c) The crash always occurs immediately after errors from vmauthd
d) Disabling hyperthreading makes the problem go away.