Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're moving to Google Apps and have just installed Google Apps Password Sync. We have yet to roll this out to users and are experiencing some problems.

Occasionally after a user changes their password an error message pops up on a domain controller:

Microsoft Visual C++ Debug Library

Debug Error!

Program: C:\WINDOWS\system32\lsass.exe

HEAP CORRUPTION DETECTED: after Normal block(#1234) at 0x00000000A123456E. CRT detected that the application wrote to memory after end of heap buffer.

Press Retry to debug the application

Abort Retry Ignore

This message only shows up on the console session (will not show up through an RDP session.) If left unanswered, RDP eventually stops responding. The domain controller also stops replicating and cannot be shut down normally (a You do not have permissions to shutdown error appears).

I've had to perform a hard shutdown on DCs because of this error.

One of the requirements to activate a user account on Google Apps is a password change. I do not want to implement our new password policy and reset every user account until I know this problem is fixed.

What is causing this error and how can I fix it?

share|improve this question
    
Thanks for this, we've been evaluating migration to GAPS. We have a specific requirement for 6 character minimums so this was a good thing to find before we made the jump. –  jscott Feb 28 '13 at 19:19

1 Answer 1

up vote 4 down vote accepted

These errors only occur when the password length is below eight characters.

Eight characters also happens to be the password length required by Google Apps. If you replace your terribly short and insecure password policy with a proper one, lsass will stop crashing.

You can do this now without forcing all your users to change their passwords immediately, as per the accepted answer in this question.

This also might only affect Windows Server 2003 (the only search result I found on this said the error occured only on their 2003 install and not their 2008.)

It seems the errors happen more frequently as the password gets shorter. Setting a one character or blank password will crash lsass.exe every time. I got through 20,000 password changes using an eight character password before giving up on trying to crash it.

Trying to Google this error sucks. This is a self answer in hopes that I can help some poor soul from the future.

share|improve this answer
1  
We're using hashing password filter, which allows us to use a 6 character minimum. Also worth noting, GAM can also set a Google Apps password to a minimum of 6 characters. –  jscott Feb 28 '13 at 19:16
    
Do you happen to have any detail as for why this is happening? Is it a bug which got fixed eventually by a service pack or in newer versions of Windows / Google Apps Password Sync? –  the-wabbit Oct 8 '13 at 17:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.