Event ID 5000 Message Is Logged After You Restart Your Windows 2000 Server Computer (306748)
The information in this article applies to:
- Microsoft Windows 2000 Server SP1
- Microsoft Windows 2000 Server SP2
- Microsoft Windows 2000 Advanced Server SP1
- Microsoft Windows 2000 Advanced Server SP2
This article was previously published under Q306748 SYMPTOMS Your Windows 2000 Server computer stops responding, and
after you restart the server computer, the following event ID message is logged
in the System log: Source:
LsaSrv
Category: (1)
Type: Error
Event ID: 5000
Description: "The security package NTLM generated an exception. The
package is now disabled. The exception information is the data." You
may also receive an error message that the Lsass service has experienced an
access violation.
CAUSEThis problem occurs because a user who belongs to more than
1,024 Active Directory directory service groups tries to connect to a Windows
2000 member server or to an Internet Information Services (IIS) server by using
NTLM authentication. The Lsass service may experience an error and report that
the NTLM service has been disabled. The server does not permit the log on, and
the event ID message is logged.
RESOLUTION To resolve this problem, obtain the latest
service pack for Windows 2000. For additional information, click the following
article number to view the article in the Microsoft Knowledge Base: 324953 List of Security Fixes in Windows 2000 Service Pack 3
STATUSMicrosoft
has confirmed that this is a problem in the Microsoft products that are listed
at the beginning of this article.
| Modification Type: | Major | Last Reviewed: | 8/7/2006 |
|---|
| Keywords: | kbQFE kbbug kbpending KB306748 |
|---|
|