Password Change Causes Problems with LSASS and forces System Reboot

We are currently experiencing a problem with one of our Windows 2003 servers.

The server is a new machine, a Dell PowerEdge 1850.  It has the Dell Factory install of Windows 2003 on it.  The server is also running MSSQL 2000, ColdFusion MX 6.1 and Plesk 7.5.

When a user logs in through Terminal Service (Administration mode) and changes their password, the machine is rebooted. (Windows Security, Change Password, Enter current and new passwords, and then the server reboots.  The server doesn’t seem to reboot if the password change is done through the computer management MMC.)

The following error is shown on screen:

The system is shutting down.  Please save all work in progress and log off.  Any unsaved changes will be lost.  This shutdown was initiated by NT AUTHORTY\SYSTEM.  Shutdown will begin in 58 seconds.  Shutdown message: The system process ‘C:\windows\system32\lsass.exe’ terminated unexpectedly with status code -1073740972.  The system will now shut down and restart.

The following items can also be found in the Application error log around this time:

Event ID: 1004
Reporting queued error: faulting application winlogon.exe, version 0.0.0.0, faulting module msgina.dll, version 5.2.3790.0, fault address 0x000118e6.

Event ID: 1004
Reporting queued error: faulting application lsass.exe, version 5.2.3790.0, faulting module ntdll.dll, version 5.2.3790.0, fault address 0x0003c10b.

Event ID: 1000
Faulting application , version 0.0.0.0, faulting module msgina.dll, version 5.2.3790.0, fault address 0x000118e6.

Event ID: 1015
A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000354.  The machine must now be restarted.

Event ID: 1000
Faulting application lsass.exe, version 5.2.3790.0, faulting module ntdll.dll, version 5.2.3790.0, fault address 0x0003c10b.

Errors in System Error Log:
Event ID: 26
Application popup: System Shutdown : The system is shutting down.  Please save all work in progress and log off.  Any unsaved changes will be lost.  This shutdown was initiated by NT AUTHORITY\SYSTEM.  Shutdown will begin in 58 seconds.  Shutdown message: The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code -1073740972.  The system will now shut down and restart..

Event ID: 1074
The process winlogon.exe has initiated the restart of computer KRYTON on behalf of user  for the following reason: No title for this reason could be found
 Reason Code: 0x50006
 Shutdown Type: restart
 Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code -1073740972.  The system will now shut down and restart.

Event ID: 5000
The security package ACRONIS_RELOGON_AUTHENTICATION_PACKAGE generated an exception.  The exception information is the data.

I have looked at a few MS KB articles, that seem to be similar, but not exactly the same as the problem that we are experiencing: http://support.microsoft.com/default.aspx?scid=kb;en-us;818080

I know that a lost of LSASS.exe reboots are caused by the SASSER virus.  I’ve scanned our machine with AV software, and also run the removal tool from Symantec – the machine has shown to be clean of this virus.

It seems like some other Dell users are having a similar problem:  http://x220.win2ktest.com/forum/topic.asp?TOPIC_ID=9021轲

Has anyone else experienced this problem?  Can anyone offer any suggestions for a resolution to this problem.

Thank you for your help.

Kind regards,

Roland