Skip to main content

LSASS Process Terminated

To collect real-time activity data, the Agent hooks into (intercepts) specific Microsoft APIs in the LSASS process. Note the following:

  • Occasionally Microsoft issues KBs (hot-fixes) that alter the LSASS components. Most of these hot-fixes don't alter the APIs in terms of the number or type parameters passed into them or values returned which are monitored by the Agent, and therefore don't impact operation of the Agent.
  • Infrequently Microsoft issues a KB that changes one of these APIs in a way that can result in interfering with the Agent instrumentation. This in turn can result in an exception which causes the LSASS process to terminate. Historically, an update resulting in this type of exception is released less than once a year. When it does occur, such a conflict is typically manifested within a minute of boot up, often before the GINA allowing interactive login is initialized. When the Windows operating system (OS) detects such a situation, it will initiate a reboot of the OS. The end result can be an OS reboot loop which is resolved by either applying a ‘counter’ patch from Netwrix to adapt to the Microsoft change or by setting the Threat Prevention Agent service from its default ‘automatic start’ to ‘disabled’ or ‘manual start’ so that on the next reboot the Threat Prevention hooks aren't deployed.

The Agent can detect if the LSASS process has terminated. If an LSASS termination is observed within the first five minutes from last reboot, then the Agent assumes it is due to the above situation and will take the following two actions well before the OS shuts down for the first time:

  • First, it sends an alert to the Enterprise Manager, “LSASS shutdown detected”
  • Second, it sets itself to “manual start” so that the Agent instrumentation isn't loaded on reboot

While this suspends further Threat Prevention event monitoring and blocking on the affected domain controller, it ensures the domain controller continues to operate normally. After Netwrix deploys a counter patch, you can restart the Agent from the Administration Console. The console will first check if the Agent is set to ‘manual start’ mode and, if so, set it back to ‘automatic start’ mode and restart it, restoring normal operation.

note

Register a primary and a secondary technical contact for your organization with Netwrix. Netwrix will send notifications to these contacts about Microsoft-issued KBs affecting LSASS and relevant counter patches. Contact your Netwrix Sales Representative or Netwrix Support to ensure that these contacts are registered.

Before Microsoft releases a KB that alters the LSASS components in a way that conflicts with the Agent, Netwrix sends a notification to registered technical contacts with detailed instructions for obtaining and applying the Agent counter patch. Counter patches are typically made available 24 hours or more before Microsoft issues the incompatible KB.

Since this requires the Threat Prevention administrator to take action, there is an Operations alert specific to this event.

info

Enable the LSASS process terminated alert under Operations on the System Alerting Window.

The Agent can be enabled with a safe mode, which would prevent the Active Directory monitoring module of the Agent from loading if any LSASS change is detected. See the Agent Safe Mode topic for additional information.

Enable the 'LSASS Process Terminated' Email Alert​

note

These steps require the Threat Prevention administrator user role. They also assume that the SMTP host information has been configured and email alerts have been enabled. See the Configure SMTP Host Information topic for additional information

Step 1 – Click Configuration > Alerts on the menu to open the System Alerting Window.

Step 2 – On the Email tab, click Configure.

Step 3 – Create a Message Profile for the LSASS notification with the recipients to be notified when the LSASS process terminates. See the Create Message Profiles topic for additional information.

System Alerting window - LSASS Process Terminated alert

Step 4 – On the Email tab, click Events, and then click Operations in the left pane. Check the LSASS process terminated event alert and select the Message Profile created in Step 3 from the dropdown menu. See the Email Tab topic for additional information.

Step 5 – Ensure that the email alerts are enabled, as indicated by the Enabled toggle button, and click OK.

When the LSASS process terminated event alert is triggered, an email notification is sent to the assigned (step 3) recipients.