I have a Windows server (2008 R2 with SP1) that runs as a domain controller, and uses Network Policy Server to authenticate Wireless 802.1X devices. There are two access points available.
Suddenly for some reason whenever one of the access points creates a RADIUS request for a wireless device trying to authenticate LSA (lsass.exe) crashes with code 255, then the system has to restart. The RADIUS request also eventually fails (code 4). I can provide a Wireshark dump of the RADIUS session if wanted.
These system events get logged:
**USER32** (ID 1074) The process wininit.exe has initiated the restart of computer SERVER on behalf of user for the following reason: No title for this reason could be found Reason Code: 0x50006 Shutdown Type: restart Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code 255. The system will now shut down and restart.
**LSA (LsaSrv)** (ID 5000) The security package Kerberos generated an exception. The exception information is the data.
**LSA (LsaSrv)** (ID 5000) *Two events with exactly the same data are created.* The security package Kerberos generated an exception. The exception information is the data.
I found this article of which appeared to be the exact issue (what with Windows 7 and server 2008 R2 using the same kernel), so I applied the hotfix. Unfortunately that fixed nothing.
I've also tried some other common checks like running CHKDSK, SFC, a virus scan (MSE), and a rootkit revealer.
It looks like this chap is having exactly the same problem, though he never replied to say if the issue got resolved or not. (I hate people doing that)