NT 4.0 Post-SP6a Bug Fixes; NTFS Bug Fix

Lsass.exe access violation. You might receive a Dr. Watson error message when you run lsass.exe on an NT 4.0 server in a Windows 2000-based mixed-mode domain—specifically, when lsass.exe performs SID lookups. According to Microsoft article Q267578, the problem occurs when a deleted domain SID is the first entry in a list of permissions or local groups on the member server and a Local Security Authority (LSA) Lookup SID is requested from the domain controller. Call Microsoft Support for the bug fix, a new version of lsass.exe released July 10.

Cluster access violation. According to Microsoft article Q266782, when you run a script that contains the command

cluster group "service resource" /off /wait 

to move cluster resources between nodes, cluster.exe might commit an access violation. The problem occurs when the function that runs the command fails to check its parameters properly. Microsoft has a June 27 version of cluster.exe that eliminates the problem. Contact Microsoft Support directly to get the bug fix.

Cmd.exe access violation. Microsoft article Q264076 indicates that in some cases, cmd.exe fails with an access violation when you use the FOR /F statement in a script. This behavior can occur if you use a statement similar to the following and the first argument (the %1 parameter) contains a line with more than 256 characters:

for /f "tokens=2,3,5,8,10 delims=," %%i in (%1) do if %%k==10 call :loop %%i    %%j %%l "%%m"

The problem is that cmd.exe corrupts the heap while reading the token file. Call Microsoft Support for the bug fix, a new version of cmd.exe released June 9.

Remote procedure call (RPC) service access violation. The Remote Procedure Call Server service (RPCSS) might, in certain situations, cause an access violation. A problem occurs when the system sends a corrupted RPC packet to the RPC service, and the code that unpacks the data fails. Microsoft article Q261298 (http://support.microsoft.com/support/kb/articles/q261/2/98.asp) documents the RPCSS failure and indicates that you can call Microsoft Support for the bug fix, which requires updated versions of rpcrt4.dll and rpcss.exe released April 25.

LPC blue screen. If an NT 4.0 server tries to use a local procedure call (LPC) and the server process responds with an NtReplyPort function call instead of the NtAcceptConnectPort and NtCompletePort function calls, the server might hang and display the blue-screen error message

"Stop 0x00000050 PAGE_FAULT_IN_NONPAGED_AREA." To solve the problem, call Microsoft Support for an April 25 update of two kernel components, ntkrnlmp.exe and ntoskrnl.exe. See Microsoft article Q259773 (http://support.microsoft.com/support/kb/articles/q259/7/73.asp) for more information.

C2 security blue screen. When you change the domain password with the C2 security Registry entry enabled, your system might crash and display the blue-screen error message "Stop 0x1E." The problem occurs if you have installed SP6a and set the following Registry entry:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession ManagerValue: EnhancedSecurityLevel (REG_DWORD)Data: 1