Windows 10: Reason Code: 0x50006 The system process 'C:\WINDOWS\system32\lsass.exe' terminated...

Hi, after update a lot of computers Lenovo M800 member of domain with Windows 10 2004 to Windows 10 20H2 we began to receive this message and restart of computers...


Error 100% happened when we trying to enter Computer Management\Local Users and Groups\Users


also error happened after usage Rufus 3.12



The process wininit.exe has initiated the restart of computer on behalf of user for the following reason: No title for this reason could be found

Reason Code: 0x50006

Shutdown Type: restart

Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code -1073740940. The system will now shut down and restart.

:)

 

Silent Process Exit: process '?' was terminated by the process 'C:\Windows\System32\svchost.exe' with termination code 1067

We have a serious issue with a C# application being terminated silently at random and infrequent points in time on a Windows 10 32-bit installation.
E.g. it might be a month between occurrences. Or sometimes just a day.

Basic system specifications:

Using Configuring Silent Process Exit Monitoring - Windows drivers we have configured silent process exit monitoring. And we finally have a few samples of this:

Looking at the dumps for this, which was setup for the monitoring we got a process ID for the svchost. This service was still running at the system, and it shows the following list of services:





Which seems to be a list of "netsvcs" for Windows. Opening the dump from the svchost.exe and looking at this a single thread was found with an interesting call stack:

UBPM is the Unified Background Process Manager. But how can this be terminating our application? And why? And what does the termination code 1067tell us?

Below is the log entry from Silent Process Monitoring:

NOTES: The PC is not being shut down at the moment the app terminates nor are there any other indications in event logs as to why the process was terminated.

UPDATE 1: Here a few extra details (trying to answer as many as in comments):

• Process is (sometimes) started via TaskScheduler when Windows is started yes. Other times by user. Not entirely sure problem only occurs when started via TaskScheduler. But interesting point? Could windows kill a task for some reason? Note that times between process exiting can be up to a month.
  
• We have the source for the main program, but would have problems running it inside a debugger since this is running at a customer, but maybe. We can't run it compiled for Debug though. Not at all, due to performance. This is live production.
  
• Application is a normal WPF application without any child processes or any other inter-process communication. It does use a few third party devices e.g. libraries and drivers.
  
• We have setup event handling of appdomain exceptions and application exceptions etc. None of these occur. The process exits without any indication of an exception occurring. It is a hard process exit.
  
• We have suspected perhaps a third party driver being the source, but how? And how could we determine whether this was the case?
  

UPDATE 2: We use the nuget package TaskScheduler to setup the task via code. Note we do not set the ExecutionTimeLimit, which should therefore be Nothing and hence infinite.

UPDATE 3: Perhaps the above statement was wrong, the default in the TaskScheduler library seems to be 3 days or 72 hours.

UPDATE 4: Only thing is we observe silent process exits after the process has been running for much longer than 3 days, e.g. 30 days so not sure it is this after all.

UPDATE 5: The longer than 3 days was not correctly observed, so after everything it is now clear this was due to incorrect settings for the task scheduler task. The wrong settings shown below:





Correct settings being:

 

stupid system idle process

im guessing software! its a big ass report, so il post whats relevant? would you like services report too, its pretty long mind,,

--------[ Processes ]---------------------------------------------------------------------------------------------------

AppleMobileDeviceService.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 32-bit 2260 KB 1724 KB
avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe 32-bit 396 KB 2688 KB
avgcc.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe 32-bit 344 KB 3832 KB
avgemc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe 32-bit 1888 KB 2432 KB
avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe 32-bit 676 KB 780 KB
everest.exe C:\Program Files\Lavalys\EVEREST Corporate + Ultimate Edition\everest.exe 32-bit 7768 KB 26612 KB
Explorer.EXE C:\WINDOWS\Explorer.EXE 32-bit 28036 KB 18992 KB
iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe 32-bit 12360 KB 26448 KB
lsass.exe C:\WINDOWS\system32\lsass.exe 32-bit 1520 KB 3864 KB
nvsvc32.exe C:\WINDOWS\system32\nvsvc32.exe 32-bit 4504 KB 2732 KB
RTHDCPL.EXE C:\WINDOWS\RTHDCPL.EXE 32-bit 22704 KB 17812 KB
RUNDLL32.EXE C:\WINDOWS\system32\RUNDLL32.EXE 32-bit 5324 KB 2808 KB
services.exe C:\WINDOWS\system32\services.exe 32-bit 3508 KB 1808 KB
smss.exe C:\WINDOWS\System32\smss.exe 32-bit 400 KB 168 KB
svchost.exe C:\WINDOWS\System32\svchost.exe 32-bit 22108 KB 14392 KB
svchost.exe C:\WINDOWS\system32\svchost.exe 32-bit 5008 KB 3220 KB
uTorrent.exe C:\Program Files\uTorrent\uTorrent.exe 32-bit 35840 KB 42188 KB
winlogon.exe C:\WINDOWS\system32\winlogon.exe 32-bit 3364 KB 6128 KB
wscntfy.exe C:\WINDOWS\system32\wscntfy.exe 32-bit 2396 KB 680 KB

 

Silent Process Exit: process '?' was terminated by the process 'C:\Windows\System32\svchost.exe' with termination code 1067

I think that the information you supply in your post is all from after the fact.

For one, termination code 1067 just
means
"ERROR_PROCESS_ABORTED - The process terminated unexpectedly".

For another, the stack trace you gave is in my opinion just the processing of the event
of your program termination, which is the thread that did the silent reporting,
so has no information to add.

I think we will know more if the problem happens again after having
separated the bundled services on svchost as
described here.
But again, designing svchost as the cause might be misleading.

In my own experience, the easiest sure way of finding the problem,
requiring the full control of the product's sources,
is compiling the product for debug and running it in the debugger,
setting breakpoints on all the system termination routines.
For C these are _exit and _abort, but there may be others.

If the program stops in the debugger, you will be able to see why by examining
the call stack and global/local variables.

If you cannot use the debugger, we will need much more data about the program
to be able to offer a meaningful opinion.

EDIT

Even compiling for production, you are at least able to create a symbols-file which can help in debug and analysis.

You should examine the Event Viewer - if the program crashes then there may
be some info in there, and also in User-Mode Dump Files.

For better analyzing the crashes, you may parameter user dumps in
Control Panel > System >
Advanced system settings > Advanced tab >
Startup and Recovery > Settings >
Write debugging information, set it to
"Complete memory dump" and OK.

You may use those dumps together with the symbols file in a debugger.
You may do so on another computer, usually where you have compiled the
executable, but there are some gotchas if you are using Visual Studio :

• The dump and symbols file must have been generated by the same executable
  version
  
• The dump must be located when being analyzed in exactly the same folder
  as when it was generated (C:\some-path\ etc.)