Critical Windows Server Update Causing Crashes and Reboots

A recently released Windows Server update (KB5036909) has been discovered to cause severe issues, including unexpected system reboots. The issue primarily affects Windows Server 2022 systems utilizing NTLM authentication, but other Windows Server versions are also reportedly impacted.

Affected Windows Server Versions:

• Windows Server 2022 – KB5036909
• Windows Server 2019 – KB5036896
• Windows Server 2016 – KB5036899
• Windows Server 2012 R2 – KB5036960
• Windows Server 2012 – KB5036969
• Windows Server 2008 R2 – KB5036967
• Windows Server 2008 – KB5036932

Issue Details:

The problem arises when NTLM authentication is employed on Windows Server 2022 machines following the installation of update KB5036909. A surge in NTLM traffic triggers the crash of the Local Security Authority Subsystem Service (LSASS.exe), leading to an abrupt server reboot.

Impact on Business Operations:

These unexpected reboots can severely disrupt business operations, particularly for servers serving as domain controllers (DCs) and relying on NTLM authentication. Upon reboot, NTLM authentication services become unavailable until the server completes its restart cycle.

Alternative Measures:

For servers that don't function as DCs or don't utilize NTLM, no action is required. For affected servers, consider switching to a different authentication protocol, such as Kerberos, as a temporary workaround.

Microsoft is actively working on a resolution to address this critical update issue. Users are encouraged to monitor Microsoft's official channels for updates and promptly install the forthcoming patch once available. In the meantime, removing the problematic update (KB5036909) is the recommended course of action to prevent server disruptions.