Unresolved Error: Server 2012 – Event 1000, Application Error

I came across an issues with my Windows Server 2012 / Exchange 2013 RU2 Server. After an unexpected shutdown message I was able to find out the faulting application which caused the reboot was LSASS.

There was an event message in the system event log of:

The process wininit.exe has initiated the restart of computer EXSERVER on behalf of user for the following reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process ‘C:Windows\system32\lsass.exe‘ terminated unexpectedly with status code 255. The system will now shut down and restart.

Later found in the application log event 1000 application error::

Faulting application name: lsass.exe, version: 6.2.9200.16384, time stamp: 0x50108ab2
Faulting module name: schannel.DLL, version: 6.2.9200.16384, time stamp: 0x5010892c
Exception code: 0xc0000409
Fault offset: 0x000000000001a73a
Faulting process id: 0x224
Faulting application start time: 0x01ce7f8a27d7e7ff
Faulting application path: C:Windowssystem32lsass.exe
Faulting module path: C:Windowssystem32schannel.DLL
Report Id: c2142447-f4f2-11e2-9404-000c299625b9
Faulting package full name:
Faulting package-relative application ID:

Looking into the Exception code: 0xc0000409 only tells me that the application experienced an event it could not handle and crashed causing windows to reboot.

Another bit of info I will keep in mind is right before this issue there were several Application Events, Event 4002, MSExchangeIS that reads:

Microsoft Exchange Information Store service has promoted the following properties (65F3, 65E9, 0E99, 0E9A) for mailbox (59bfe395-06d4-4407-8d6c-4f763e37e698) and folder (Inbox <hidden>) with session client type (Migration).

This so happens to be during a migration period where I am moving mailboxes from Exchange 2010 to Exchange 2013 RU2. It has me also wondering if items from one of the legacy mailboxes has some form of corruption within them which may be the root cause of this.

For now this is unresolved and I will keep an eye on it.  If you know of this issues please hit me up via email jermsmit ( at ) gmail (dot) (com).

Thanks