*** An Access Violation occurred in C:\Windows\system32\lsass.exe:
The instruction at 000007FEFCB24AE3 tried to write to a NULL pointer
*** enter .exr 000000000115EB50 for the exception record
*** enter .cxr 000000000115E660 for the context
*** then kb to get the faulting stack
Break instruction exception - code 80000003 (first chance)
0033:00000000`772236a1 cc int 3
1: kd> .exr 000000000115EB50
ExceptionAddress: 000007fefcb24ae3
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000000000000
Attempt to write to address 0000000000000000
1: kd> .cxr 000000000115E660
rax=0000000001dc29b0 rbx=0000000000158468 rcx=0000000000000000
rdx=0000000000000000 rsi=000000000115ec01 rdi=00000000000000c8
rip=000007fefcb24ae3 rsp=000000000115ec20 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=000007fefcbc9500
r11=0000000000000000 r12=00000000000e29a8 r13=0000000000020385
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
0033:000007fefcb24ae3 488901 mov qword ptr [rcx],rax ds:002b:0000000000000000=???
1: kd> kb
RetAddr : Args to Child : Call Site
0000000076fd9460 : 000000000115dee0 00000000771baf20 00000000000626dc fffffffffffffffe : ntdll!RtlUnhandledExceptionFilter2+0x361 0000000077223f85 : 000000000115dee0 0012000000000006 0000000100000000 0000000000000001 : kernel32!UnhandledExceptionFilter+0x160
0000000077224365 : 000000000115dee0 000000000115fb40 0002001b00000003 0002000001640068 : ntdll!TppExceptionFilter+0xa5 00000000771f35af : 0000000077280948 000007fefd5b5d59 0000000000c158d0 0000000000c17b00 : ntdll!TppWorkerpInnerExceptionFilter+0x15
00000000771785c8 : 000000007717ff2f 0000000077189b6e 0000000e00000003 0000000000000000 : ntdll! ?? ::FNODOBFM::string’+0x25d0
00000000771f16cd : 0000000077280c10 000000000115fb40 000000000115eb50 000000000115fb40 : ntdll!_C_specific_handler+0x8c 0000000077189d2d : 0000000001160000 000000000115fb40 00000000772a1978 0000000001154000 : ntdll!_GSHandlerCheck_SEH+0x75
00000000771791cf : 0000000001160000 000000007729ff80 0000000000012f00 0000000000000014 : ntdll!RtlpExecuteHandlerForException+0xd 00000000771b1248 : 000000000115eb50 000000000115e660 0000000000000000 0000000000000000 : ntdll!RtlDispatchException+0x45a
000007fefcb24ae3 : 0000000000000040 0000000000158468 000000000115ec01 000000000115f501 : ntdll!KiUserExceptionDispatch+0x2e 000007fefcb24a23 : 0000000000115220 000000000115ecf8 00000000000b3f50 00000000000b3f50 : SAMSRV!SampGetAccessAttribute+0x71
000007fefcb2439d : 0000000000010002 0000000000115220 0000000000000101 0000000000000d38 : SAMSRV!SampGetObjectSD+0x53 000007fefcb241f6 : 0000000000000001 0000000000114ef0 0000000000000448 0000000000115220 : SAMSRV!SampValidateObjectAccess2+0x190
000007fefcb23fe8 : 0000000000000001 0000000000c1cc90 0000000000114ef0 0000000000000000 : SAMSRV!SampOpenDomain+0x208 000007fefd5cff85 : 0000000000000004 000000000115ef80 000000000115f350 000000000115ef80 : SAMSRV!SamrOpenDomain+0x58
000007fefd67b68e : 0000000000000005 0000000000000007 000007fefcbacf90 00000000016e44b0 : RPCRT4!Invoke+0x65 000007fefd5b92e0 : 0000000000000000 0000000000000000 0000000000000000 0000000000000001 : RPCRT4!Ndr64StubWorker+0x61b
000007fefd5c3254 : 230100ef00000001 00000000ac896745 0000df479e94c3f3 0000000000000001 : RPCRT4!NdrServerCallAll+0x40 000007fefd5c33b6 : 00000000016e4350 0000000000000000 000000000115f780 0000000000c0e080 : RPCRT4!DispatchToStubInCNoAvrf+0x14
000007fefd5bbf39 : 0000000000ab6400 000007fefd5cbce4 0000000000000001 0000000000000001 : RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x146 000007fefd5bbd9e : 00000000016e4350 00000000016e4350 0000000000000003 0000000000000000 : RPCRT4!OSF_SCALL::DispatchHelper+0x159
000007fefd5bbbb9 : 0000000000000038 0000000000000000 0000000001c79280 00000000016e4350 : RPCRT4!OSF_SCALL::ProcessReceivedPDU+0x18e 000007fefd5bb6e3 : 00000000016e4298 00000000016e42f0 0000000000000000 0000000000000000 : RPCRT4!OSF_SCONNECTION::ProcessReceiveComplete+0x3e9
000007fefd5bb7c3 : 0000000000c00240 000000000115fd30 000000000115fc48 000000000115fc48 : RPCRT4!CO_ConnectionThreadPoolCallback+0x123 000007fefd2685ff : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : RPCRT4!CO_NmpThreadPoolCallback+0x3f
000000007717097a : 00000000000d09e0 0000000000000000 0000000077264da0 0000000077180073 : KERNELBASE!BasepTpIoCallback+0x4b 000000007717ff2f : 0000000000000001 0000000000000000 00000000016e42f0 000000000115fd30 : ntdll!TppIopExecuteCallback+0x1ff
0000000076f5652d : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : ntdll!TppWorkerThread+0x3f8 000000007718c541 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : kernel32!BaseThreadInitThunk+0xd
0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d