What Causes Domain Controller Restarts After KB5035855 Installation?
KB5035855 can cause an LSASS memory leak on domain controllers servicing Kerberos requests. A severe leak can crash LSASS, which triggers an unscheduled reboot of the domain controller.
Microsoft released KB5035855 on March 12, 2024 for Windows Server 2016, and KB5035857 for Windows Server 2022 the same day. Both affected on-premises and cloud-based Active Directory domain controllers. While a controller is down or restarting, it cannot answer Kerberos or LDAP requests, so sign-ins that depend on it fail or move to another domain controller. Microsoft shipped out-of-band replacements on March 22, 2024. For Server 2016 that is KB5037423; for Server 2022 it is KB5037422. Microsoft says to install these instead of the March security update on domain controllers.
If the update is already installed, install the out-of-band update or uninstall the faulty update using the steps below.
How Do LSASS Memory Leaks Affect Windows Server 2022 Domain Controllers?
KB5035857 can cause LSASS memory leaks on Windows Server 2022 domain controllers. Authentication and directory access can be interrupted when LSASS crashes and the server reboots.
Microsoft's KB5035857 page describes the known issue: LSASS may leak memory on domain controllers that handle Kerberos authentication requests, and in extreme cases the leak crashes LSASS and forces a reboot. Microsoft's guidance for domain controllers is to install the out-of-band update KB5037422 (OS Build 20348.2342, released March 22, 2024) instead of KB5035857.
The practical effect is that Kerberos and LDAP requests to the affected controller fail while it restarts. Watch how lsass.exe memory changes over time and compare it with authentication failures in the Security log.
Website monitoring is a downstream signal here. Uptime Monitoring tells you when a site that depends on Active Directory sign-in stops responding, and Performance Monitoring shows when its pages slow down. Neither measures LSASS memory directly; that needs process monitoring on the server.
What Symptoms Indicate Domain Controller Crashes from Security Updates?
Symptoms can include unexpected reboots, relevant Event Viewer errors and rising lsass.exe memory usage. Compare authentication failures with those observations, and check the date the update was installed.
Updates such as KB5035855 and KB5035857 appear in update history. You can also check from an elevated PowerShell prompt with Get-HotFix -Id KB5035855 (or KB5035857). Match the installed update to the operating system, then look at the System and Security logs around each restart.
In Task Manager, the Details tab shows the memory used by lsass.exe. Record a baseline on a healthy controller. On an affected one the value keeps climbing until LSASS stops responding and the controller restarts.
Firewall-profile problems on Server 2025 are a separate issue, covered further down.
How Can Sysadmins Troubleshoot LSASS-Related Domain Controller Restarts?
Check which update is installed, then either install Microsoft's out-of-band fix or uninstall the faulty update with wusa /uninstall. Hide the update afterwards so it is not offered again.
Step-by-Step Uninstallation Process
Step 1: Confirm the update. Open Settings > Update & Security and review update history for KB5035855 or KB5035857, or run Get-HotFix -Id KB5035855 in PowerShell. Match the update to the installed operating system.
Step 2: Uninstall it from an elevated command prompt (right-click Command Prompt and choose Run as administrator). Run wusa /uninstall /kb:5035855 on Windows Server 2016, or wusa /uninstall /kb:5035857 on Windows Server 2022, then restart when prompted. If a controller reboots too fast to finish, administrators reported stopping the reboots by disconnecting its network connection, uninstalling the update, rebooting and then reconnecting the network.
Step 3: Stop the update coming back. Use Microsoft's Show or Hide Updates troubleshooter to hide the faulty update, then install the out-of-band update instead: KB5037423 for Server 2016 or KB5037422 for Server 2022.
Step 4: Test before you roll out. Apply the fix to one domain controller first, confirm it stays up, and then do the rest.
Website Checker checks a website endpoint, which is a quick way to confirm that sites depending on Active Directory sign-in respond again after the fix.
What Protocols Are Essential for Domain Controller Uptime Monitoring?
Check Kerberos for authentication, LDAP for directory queries, WMI for process and performance counters, and ICMP (ping) for reachability. Each tells you something different.
- Kerberos: confirms that the controller can issue tickets. A timeout or failure here is what users feel as failed sign-ins.
- LDAP: confirms that directory queries are answered. A controller can respond to ping and still fail LDAP.
- WMI: lets a monitoring tool read counters on the server, such as the working set of lsass.exe (the Win32_Process class exposes a WorkingSetSize property). Use it to catch a rising lsass.exe before it crashes.
- ICMP/Ping: shows the server is reachable on the network. It does not show that authentication or directory queries work.
- SNMP: an alternative way to read system metrics on Windows Server if you already run SNMP tooling.
DNS Monitoring checks supported DNS records on a schedule, which matters because Active Directory depends on DNS. Choose checks and intervals for the services you want to observe: a network response alone does not prove that authentication or directory queries are healthy.
How Does Visual Sentinel Monitor Domain Controller Restarts in 2026?
Visual Sentinel checks website uptime, performance, SSL, DNS, screenshots and content. It does not log in to Active Directory or read LSASS memory, WMI counters or LDAP changes on a domain controller.
Integrating with Active Directory
What it does for an AD outage is watch the websites and web apps that depend on the domain controller. If an internal portal or login page stops responding when a controller reboots, Visual Sentinel alerts you.
Visual Sentinel checks website uptime as often as every 1 minute on Business and Agency, or every 5 minutes on Solo and Starter.
Performance Monitoring reports website performance.
Visual checks compare screenshots of monitored pages. Content checks inspect supported website content; they do not track LDAP directory modifications.
Use a tool that reads Windows counters (see the comparison below) for LSASS and domain-controller health, and use Visual Sentinel for the sites that sit on top of it.
What Check Intervals Optimize LSASS Memory Detection in Domain Controllers?
Poll lsass.exe memory about once a minute and alert when it keeps rising across several polls. This is an example setup you tune for your environment, not a Microsoft-published threshold.
A leak shows up as a steady climb, not a single spike, so one reading above a number tells you less than a trend. For example, read the lsass.exe working set every minute through WMI or performance counters and alert when it keeps rising across several polls. Pick the threshold for your own servers. Tighten the interval if your controllers run close to their memory limit.
Kerberos timeouts should be set to what your environment needs; a timeout is a threshold you choose. SSL Monitoring checks supported website certificates.
Test the interval and timeout settings on one domain controller before you roll them out, then review the alerts you get and adjust. Document the chosen values and apply them consistently.
How Do Domain Controller Monitoring Tools Compare?
Tools that read Windows counters (WMI, performance counters or an agent) can watch lsass.exe directly. Pure website monitors cannot. Visual Sentinel vs Pingdom provides a website-monitoring comparison, and UptimeRobot is another uptime option. Datadog offers an Active Directory integration through its agent.
Published plan details from each vendor's pricing page:
| Tool | Free plan | Paid entry point | Notes |
|---|---|---|---|
| Pingdom | Free trial | Smallest tier is 10 uptime checks | Uptime and web checks |
| UptimeRobot | 50 monitors, 5-minute checks | Solo $13/month ($12 billed yearly): 10 monitors at 60 seconds. Team $46/month ($39 billed yearly): 100 monitors at 30 seconds | Uptime checks |
| Datadog | Up to 5 hosts | Pro $15 per host per month, billed annually | Agent-based infrastructure monitoring |
| Better Stack | 10 monitors and heartbeats, 1 status page | Responder license $34/month ($29 yearly), 30-second checks on paid plans | Uptime and incident management |
| Grafana Cloud | 10k series, 50 GB logs | Pro $19/month platform fee plus usage | Metrics and dashboards |
| Site24x7 | Free tier up to 50 resources (uptime) | Server monitoring from $2.50 per VM per month | Web and server monitoring |
More articles cover comparisons. Check each vendor's documentation for Windows, Kerberos and LDAP support before you pick one.
What Workarounds Address Firewall Profile Bugs in Windows Server 2025 DCs?
Windows Server 2025 can show the network as public on a new domain controller. Microsoft fixed that in the May 28, 2025 preview update KB5058499 (OS Build 26100.4202), which the June 10, 2025 security update KB5060842 includes, so install KB5060842 or any later cumulative update. The fix checks for a domain controller name before using loopback addresses for LDAP binding.
Visual Monitoring can compare screenshots of a website interface to catch pages that stop loading when a service is blocked.
Actionable Steps for Domain Controller Stability
- Check update history for KB5035855 (Server 2016) or KB5035857 (Server 2022).
- If present, install Microsoft's out-of-band update (KB5037423 or KB5037422), or uninstall the faulty one with
wusa /uninstalland hide it. - Confirm that each controller survives a restart and that lsass.exe memory stays flat.
- On Server 2025, install KB5060842 or a later cumulative update. That update includes the May 28, 2025 fix for a new domain controller showing its network as public.
- Add website uptime and DNS checks for the sites that depend on Active Directory. Website checks complement the investigation, but they do not monitor every domain-controller protocol.
Test domain-controller patches on isolated systems before wider deployment. DNS Checker checks supported DNS records. Test backups before you need them.
Check your site while you read
Run a free check for regional reachability, response time, redirect handling, TLS evidence, and DNS resolution. No account is required.
Check a site freeCommon questions
What Causes Domain Controller Restarts After KB5035855 Installation?
KB5035855 can cause an LSASS memory leak on domain controllers servicing Kerberos requests. A severe leak can crash LSASS and trigger an unscheduled restart. Microsoft recommends installing the out-of-band update KB5037423 instead on Windows Server 2016 domain controllers.
How Do LSASS Memory Leaks Affect Windows Server 2022 Domain Controllers?
KB5035857 can cause LSASS memory leaks on Windows Server 2022 domain controllers. Authentication and directory access can be interrupted when LSASS crashes and the server reboots. Microsoft recommends the out-of-band update KB5037422 instead.
What Symptoms Indicate Domain Controller Crashes from Security Updates?
Look for unexpected reboots, relevant Event Viewer errors and rising lsass.exe memory usage in Task Manager. Check whether KB5035855 or KB5035857 is installed with Get-HotFix or update history, and compare the install date with the first restart.
How Can Sysadmins Troubleshoot LSASS-Related Domain Controller Restarts?
From an elevated prompt, run wusa /uninstall /kb:5035855 on Windows Server 2016 or wusa /uninstall /kb:5035857 on Windows Server 2022, then restart. Hide the update with Microsoft's Show or Hide Updates troubleshooter and install the out-of-band update (KB5037423 or KB5037422) instead.
What Protocols Are Essential for Domain Controller Uptime Monitoring?
Kerberos and LDAP checks test authentication and directory access, WMI counters track process memory such as lsass.exe, and ICMP (ping) tests network reachability. Each answers a different question, so use more than one.
How Does Visual Sentinel Monitor Domain Controller Restarts in 2026?
Visual Sentinel checks website uptime, performance, SSL, DNS, screenshots and content. These website checks do not directly monitor Active Directory authentication, LSASS memory, WMI counters or LDAP changes, but they alert you when sites that depend on a domain controller stop responding.
