How to fix this shutdown error - "lsass.exe, failed with status code c0000409. The machine must now be restarted"

The error message referencing lsass.exe (Local Security Authority Subsystem Service) indicates a critical issue with a core Windows process responsible for authentication and security policies. The specific status code c0000409 generally points to a stack buffer overflow, which can be caused by corrupted system files, misconfigured third-party software, malware, or hardware issues.

To resolve this issue, follow these step-by-step troubleshooting methods based on Microsoft guidance:

---

1. Boot into Safe Mode

Since the error may prevent normal operation, booting into Safe Mode ensures minimal interference from third-party applications or drivers.

• Steps to enter Safe Mode:
  1. Restart the system, and before Windows boots, repeatedly press the F8 key (or as applicable if your system uses a different method).
     1. Select Safe Mode with Networking from the options.
        1. Log in and proceed with the following troubleshooting steps.

For detailed instructions, see: Start your PC in Safe Mode.

---

2. Run System File Checker (SFC) and DISM Commands

Corrupted system files can cause issues with lsass.exe. Use the SFC and DISM tools to repair system integrity.

Run System File Checker (SFC):

1. Open Command Prompt as Administrator.
   1. Type the following command and press Enter:cmd

         sfc /scannow
   

   1. Allow the scan to complete and fix any detected issues.
   Run DISM to repair system image:

     1. In the same Command Prompt window, run these commands one at a time:cmd
   
     ```
     DISM /Online /Cleanup-Image /CheckHealth
   

DISM /Online /Cleanup-Image /ScanHealth DISM /Online /Cleanup-Image /RestoreHealth ```

           1. Restart the system after repair.
           

For more information, refer to: Use the System File Checker tool to repair missing or corrupted system files.

---

3. Check for Pending Updates

A missing Windows update or corrupted installation can also lead to instability.

• Open Settings > Update & Security > Windows Update.
• Click Check for updates.
• Install all pending updates, especially security fixes.

For more details, visit: Windows Update: FAQ.

---

4. Scan for Malware

Malware infections may target system processes like lsass.exe. Perform a full scan using Microsoft Defender.

• Open Settings > Privacy & Security > Windows Security.
• Click Virus & threat protection > Scan options > Full scan.
• If malware is detected, follow prompts to remove it.

For official guidance: Help protect my PC with Microsoft Defender.

---

5. Check Event Viewer for Details

Use Event Viewer to identify additional details that might help pinpoint the underlying cause.

• Press Win + X and select Event Viewer.
• Navigate to Windows Logs > System or Application, and look for related errors around the time of the failure.

---

6. Perform a Clean Boot

If third-party software is interfering with lsass.exe, a clean boot can isolate the issue.

• Steps to perform a clean boot:
  1. Open Run (Win + R), type msconfig, and press Enter.
     1. Under the Services tab, select Hide all Microsoft services, then click Disable all.
        1. Go to the Startup tab, click Open Task Manager, and disable all startup items.
           1. Restart the computer.

For instructions, see: How to perform a clean boot in Windows.

---

7. Perform an In-Place Upgrade Repair

If other methods fail, consider performing an in-place upgrade to repair system files without deleting your apps or data.

• Steps:
  1. Create installation media using the Media Creation Tool (Download link).
     1. Run the tool and select Upgrade this PC now.
        1. Follow the prompts and choose to keep personal files and apps.

For more information, see: How to perform an in-place upgrade.

---

8. Additional Help

If the issue persists, request assistance from Microsoft Support:

• Visit: Get support.

Let me know if you need further details or assistance with any of the above steps!The error message referencing lsass.exe (Local Security Authority Subsystem Service) indicates a critical issue with a core Windows process responsible for authentication and security policies. The specific status code c0000409 generally points to a stack buffer overflow, which can be caused by corrupted system files, misconfigured third-party software, malware, or hardware issues.

To resolve this issue, follow these step-by-step troubleshooting methods based on Microsoft guidance:

---

1. Boot into Safe Mode

Since the error may prevent normal operation, booting into Safe Mode ensures minimal interference from third-party applications or drivers.

• Steps to enter Safe Mode:
  1. Restart the system, and before Windows boots, repeatedly press the F8 key (or as applicable if your system uses a different method).
     1. Select Safe Mode with Networking from the options.
        1. Log in and proceed with the following troubleshooting steps.

For detailed instructions, see: Start your PC in Safe Mode.

---

2. Run System File Checker (SFC) and DISM Commands

Corrupted system files can cause issues with lsass.exe. Use the SFC and DISM tools to repair system integrity.

Run System File Checker (SFC):

1. Open Command Prompt as Administrator.
   1. Type the following command and press Enter:cmd

         sfc /scannow
   

   1. Allow the scan to complete and fix any detected issues.
   Run DISM to repair system image:

     1. In the same Command Prompt window, run these commands one at a time:cmd
   
     ```
     DISM /Online /Cleanup-Image /CheckHealth
   

DISM /Online /Cleanup-Image /ScanHealth DISM /Online /Cleanup-Image /RestoreHealth ```

           1. Restart the system after repair.
           

For more information, refer to: Use the System File Checker tool to repair missing or corrupted system files.

---

3. Check for Pending Updates

A missing Windows update or corrupted installation can also lead to instability.

• Open Settings > Update & Security > Windows Update.
• Click Check for updates.
• Install all pending updates, especially security fixes.

For more details, visit: Windows Update: FAQ.

---

4. Scan for Malware

Malware infections may target system processes like lsass.exe. Perform a full scan using Microsoft Defender.

• Open Settings > Privacy & Security > Windows Security.
• Click Virus & threat protection > Scan options > Full scan.
• If malware is detected, follow prompts to remove it.

For official guidance: Help protect my PC with Microsoft Defender.

---

5. Check Event Viewer for Details

Use Event Viewer to identify additional details that might help pinpoint the underlying cause.

• Press Win + X and select Event Viewer.
• Navigate to Windows Logs > System or Application, and look for related errors around the time of the failure.

---

6. Perform a Clean Boot

If third-party software is interfering with lsass.exe, a clean boot can isolate the issue.

• Steps to perform a clean boot:
  1. Open Run (Win + R), type msconfig, and press Enter.
     1. Under the Services tab, select Hide all Microsoft services, then click Disable all.
        1. Go to the Startup tab, click Open Task Manager, and disable all startup items.
           1. Restart the computer.

For instructions, see: How to perform a clean boot in Windows.

---

7. Perform an In-Place Upgrade Repair

If other methods fail, consider performing an in-place upgrade to repair system files without deleting your apps or data.

• Steps:
  1. Create installation media using the Media Creation Tool (Download link).
     1. Run the tool and select Upgrade this PC now.
        1. Follow the prompts and choose to keep personal files and apps.

For more information, see: How to perform an in-place upgrade.

---

8. Additional Help

If the issue persists, request assistance from Microsoft Support:

• Visit: Get support.

Let me know if you need further details or assistance with any of the above steps!

Hi,

The error code c0000409 indicates a stack-based buffer overrun in the lsass.exe process, which is a critical system service. This error causes the system to shut down and restart. The failure could be due to Winsock initialization errors. Please try resetting winsock by running the following command

netsh winsock reset

Then reboot the computer to see if the issue persists.

Best Regards,

Ian Xue

---

If the Answer is helpful, please click "Accept Answer" and upvote it.