| Event Id | 5000 |
| Source | LsaSrv |
| Description | The security package Package Name generated an exception. The package is now disabled. The exception information is the data. Data: 0000: c0000005 00000000 00000000 78566df3 ... |
| Event Information | CAUSE: This issue may occur if there is an exception to an authentication package. RESOLUTION: To resolve this problem, restart the computer. STATUS: Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. MORE INFORMATION: The Local Security Authentication Subsystem (LSASS) process is designed to help protect itself from bugs in authentication packages. It identifies the exception that the bug causes and then terminates the thread that caused the exception. Additionally, the package is not loaded again in the same instance of LSASS. Because exceptions are generally access violations, the integrity of the LSASS process cannot be guaranteed, and therefore Microsoft recommends that you restart the domain controller. The exception does not create a memory dump file, and the context of the exception is lost after the event is logged. |
| Reference Links | LsaSrv Event 5000 Disables Authentication Packages Your Windows 2000 domain controller stops authenticating users and you see LsaSrv event 5000 in Event Viewer |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.