KnowledgeBase: LSASS on Windows 10 version 20H2 crashes and reboots unexpectedly on systems with renamed built-in administrator or guest accounts

Windows 10

On October 20th, 2020, Microsoft released Windows 10, version 20H2 build 19042 to Visual Studio Subscribers and organizations with access to the Software Download Center and the Volume Licensing Service Center. This version is also known as Windows 10 ‘October 2020 Update’.

Last week, Microsoft acknowledged an issue causing forced restarts on devices running Windows 10 20H2 due to the Local Security Authority Subsystem Service (LSASS) system process crashing.

 

The situation

You have in-place upgraded devices to Windows 10 version 20H2 from a previous version of Windows.

 

The issue

When you interact with any functionality that lists usersor their permissions, for example accessing the sign-in options page in the Settings app, or the users folder in the Local users and groups MMC snap-in (lusrmgr.msc), you receive the following error:

Your PC will automatically restart in one minute

In the application log in Event Viewer (eventvwr.exe), an event is logged with event ID 1015 reporting:

LSASS.EXE failed with status code C0000374

 

The cause

This issue appears because on the device either or both the built-in Administrator or Guest accounts have been renamed.

 

The solution

To remedy the situation, you can:

  • Roll back the Windows 10 upgrade to the previous version of Windows, or;
  • Remove the Group Policy setting that renames either or both the built-in Administrator or Guest accounts and reboot when the device is domain-joined, or manually rename either or both the built-in Administrator or Guest accounts and reboot when the device is not domain-joined.

 

Concluding

After my previous run-in with LSASS rebooting Domain Controllers, now it’s apparently time for freshly upgraded devices running Windows 10 version 20H2…

One Response to KnowledgeBase: LSASS on Windows 10 version 20H2 crashes and reboots unexpectedly on systems with renamed built-in administrator or guest accounts

  1.  

    Current Setup.exe also blocks if you try to upgrade when accounts are renamed, leaving an error in the compatreport in c:$WINDOWS.~BTSourcesPanther

    Error links to https://go.microsoft.com/fwlink/?LinkId=2147561

    (yes, you are late writing this blog.. ran into this last friday)

leave your comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.