Microsoft Confirms Windows Server Security Update Caused Memory Leak, 'Unscheduled' Reboots

'Microsoft confirmed that a memory leak introduced with the March 2024 Windows Server security updates is behind a widespread issue causing Windows domain controllers to crash,' BleepingComputer reported Thursday.

Friday Microsoft wrote that the issue 'was resolved in the out-of-band update KB5037422,' only available via the Microsoft Update Catalog. (The update 'is not available from Windows Update and will not install automatically.')

BleepingComputer reported the leak only affected 'enterprise systems using the impacted Windows Server platform,' and home users were not affected. But Microsoft confirmed it impacted all domain controller servers with the latest Windows Server 2012 R2, 2016, 2019, and 2022 updates:

As BleepingComputer first reported on Wednesday and as many admins have warned over the last week, affected servers are freezing and restarting unexpectedly due to a Local Security Authority Subsystem Service (LSASS) process memory leak introduced with this month's cumulative updates.

'Since installation of the March updates (Exchange as well as regular Windows Server updates) most of our DCs show constantly increasing lsass memory usage (until they die),' one admin said.

'Our symptoms were ballooning memory usage on the lsass.exe process after installing KB5035855 (Server 2016) and KB5035857 (Server 2022) to the point that all physical and virtual memory was consumed and the machine hung,' another Windows admin told BleepingComputer.

The leak 'is observed when on-premises and cloud-based Active Directory Domain Controllers service Kerberos authentication requests,' Microsoft wrote. 'Extreme memory leaks may cause LSASS to crash, which triggers an unscheduled reboot of underlying domain controllers...'

'We strongly recommend you do not apply the March 2024 security update on DCs and install KB5037422 instead...'

Read more of this story at Slashdot.