• After the VDA installation finishes, the machine goes into Reboot loop and admin is unable to login.
• The machine boots fine in Safe Mode or if VDA software is uninstalled.
• Booted the VDA in Safe Mode and from event logs, found Kerberos Error from LsaSrv and lsass.exe termination and crash errors causing an unexpected reboot.

SYSTEM EVENT LOGS

Log Name:      System
Source:        LsaSrv
Event ID:      5000
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      xxx
Description:
The security package Kerberos generated an exception. The exception information is the data.


Log Name:      System
Source:        User32
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      xxx
Description:
The process wininit.exe has initiated the restart of computer xxx on behalf of user  for the following reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819.  The system will now shut down and restart.

APPLICATION EVENT LOGS

Log Name:      Application
Source:        Application Error
Event ID:      1000
Task Category: Application Crashing Events
Level:         Error
Keywords:      Classic
User:          N/A
Computer:     xxx
Description:
Faulting application name: lsass.exe, version: 10.0.17763.1, time stamp: 0xf1beaffa
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000000000000000

Log Name:      Application
Source:        Microsoft-Windows-Wininit
Event ID:      1015
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      xxx
Description:
A critical system process, C:\Windows\system32\lsass.exe, failed with status code c0000005.  The machine must now be restarted.




 

Open a ticket with Citrix Support and provide full crash dumps of lsass.exe.

If the crash dump stack matches the known issue then a private fix will be provided for ctxauth.dll to address this issue.

A public fix for this issue is yet to be released. 

---

Problem Cause

From crash dumps of lsass.exe, it was found that Ctxaut.dll was calling a null pointer causing Window's DEP (Data Execution Prevention) to kick in and crash lsass.exe