Windows Server March ’24: Challenges with Domain Controller Crashes

Recently, Microsoft confirmed a critical issue affecting domain controllers worldwide. A memory leak introduced with the March 2024 security updates for Windows Server is causing unexpected crashes and restarts. Here is an overview of what every IT professional and Windows administrator needs to know:

• The Cause: A memory leak in the Local Security Authority Subsystem Service (LSASS) process caused by the March 2024 cumulative updates.
• The Impact: Servers freeze and reboot unexpectedly, directly impacting business continuity and operational efficiency.
• Who Is Affected: The problem affects all domain controllers that have installed the latest updates for Windows Server 2012 R2, 2016, 2019, and 2022. Home users fall outside this impact zone.
• Microsoft Statement: After installing the March 2024 security update (KB5035857) on March 12, LSASS may experience a memory leak on domain controllers, Microsoft says .
• Temporary Solution: Microsoft advises administrators to remove the problematic updates until a final fix is available. This can be done through an elevated command prompt.

Bullet Points for Quick Overview 📌

• 🚨 Critical Memory Leak: LSASS process affected by March 2024 updates.
• 🔄 Unexpected Restarts: Major service interruptions due to server crashes.
• 🏢 Business Impact: Mainly enterprise systems affected; home users not affected.
• 🔧 Temporary Solution: Removal of updates recommended until further instructions.

Depending on the specific update installed on the affected domain controllers, administrators can run one of the following commands in an elevated command prompt to remove the problematic updates:

wusa /uninstall /kb:5035855 #Server 2016

wusa /uninstall /kb:5035857 #Server 2022

wusa /uninstall /kb:5035849

Closure and Reflection

The recent Windows Server update challenge highlights the importance of update planning and proactive monitoring. Remote Monitoring and Management (RMM) plays a crucial role in this, by enabling rapid detection and response to such problems. Alta-ICT’s RMM solutions provide essential insights and security, essential for maintaining business continuity and minimizing downtime.

While we wait for a solution from Microsoft, this situation underscores the need for IT administrators to stay alert and act proactively. With the right RMM tools, like those provided by Alta-ICT, we can keep our IT infrastructure robust and responsive, ready to meet the challenges of software updates.