New CryWiper data wiper targets Russian courts, mayor’s offices

FBI: Cuba ransomware raked in $60 million from over 100 victims Microsoft Window 10 Pro

Samsung, LG, Mediatek certificates compromised to sign Android malware

Android malware infected 300,000 devices to steal Facebook accounts

SIM swapper gets 18-months for involvement in $22 million crypto heist

Hackers use new, fake crypto app to breach networks, steal cryptocurrency

Train to become a cyber security professional for just $59

The Week in Ransomware - December 2nd 2022 - Disrupting Health Care

Remove the Theonlinesearch.com Search Redirect

Remove the Smartwebfinder.com Search Redirect

How to remove the PBlock+ adware browser extension

Remove the Toksearches.xyz Search Redirect

Remove Security Tool and SecurityTool (Uninstall Guide)

How to remove Antivirus 2009 (Uninstall Instructions)

How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo

How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller

Locky Ransomware Information, Help Guide, and FAQ

CryptoLocker Ransomware Information Guide and FAQ

CryptorBit and HowDecrypt Information Guide and FAQ

CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ

How to open a Windows 11 Command Prompt as Administrator

How to make the Start menu full screen in Windows 10

How to install the Microsoft Visual C++ 2015 Runtime

How to open an elevated PowerShell Admin prompt in Windows 10

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Microsoft is investigating LSASS memory leaks (caused by Windows Server updates released during the November Patch Tuesday) that might lead to freezes and restarts on some domain controllers.

LSASS (short for Local Security Authority Subsystem Service) is responsible for enforcing security policies on Windows systems, and it handles access token creation, password changes, and user logins.

If this service crashes, logged-in users immediately lose access to Windows accounts on the machine, and they're shown a system restart error followed by a system reboot.

"LSASS might use more memory over time and the DC might become unresponsive and restart," Microsoft explains on the Windows Health dashboard.

"Depending on the workload of your DCs and the amount of time since the last restart of the server, LSASS might continually increase memory usage with the up time of your server and the server might become unresponsive or automatically restart."

Redmond says that out-of-band Windows updates pushed out to address authentication problems on Windows domain controllers might also be affected by this known issue.

The complete list of affected Windows versions includes Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2 SP1, and Windows Server 2008 SP2.

Microsoft is working on a resolution and says it will provide an update with an upcoming release.

Until a fix is available to address this LSASS memory leak issue, the company also provides a temporary solution to allow IT admins to work around domain controller instability. 

This workaround requires admins to set the KrbtgtFullPacSignature registry key (used to gate CVE-2022-37967 Kerberos protocol changes) to 0 using the following command:

"Once this known issue is resolved, you should set KrbtgtFullPacSignature to a higher setting depending on what your environment will allow," Microsoft added.

"It is recommended to enable Enforcement mode as soon as your environment is ready. For more information on this registry key, please see KB5020805: How to manage Kerberos protocol changes related to CVE-2022-37967."

In March, Redmond addressed another known issue leading to Windows Server domain controller reboots due to LSASS crashes.

Earlier this month, Microsoft fixed domain controller sign-in failures and other authentication problems also caused by November Patch Tuesday Windows updates with emergency out-of-band (OOB) updates.

Microsoft warns of Remote Desktop freezes on Windows 11 22H2

Microsoft fixes bug behind Windows 10 freezes, desktop issues

Windows Kerberos authentication breaks after November updates

Microsoft fixes Windows DirectAccess connectivity issues

Microsoft fixes Windows vulnerable driver blocklist sync issue

Not a member yet? Register Now

Rackspace: Ongoing Exchange outage caused by security incident

Google Chrome emergency update fixes 9th zero-day of the year

To receive periodic updates and news from BleepingComputer, please use the form below.

Terms of Use - Privacy Policy - Ethics Statement

Copyright @ 2003 - 2022 Bleeping Computer® LLC - All Rights Reserved

Not a member yet? Register Now

Windows 11 Product Key Read our posting guidelinese to learn what content is prohibited.