I created an IPSec GPO to encrypt traffic between one server and one workstation. Both are in same AD domain. Whenever I apply the policy to the server, every 3 hrs the server reboots with events 1000, 1015, 4097. LSASS.ex generates the error. As soon as I disable the policy from applying to the server, the reboots stop. I have an identical policy applied to a Win2000 server with no issues. What am I missing? Thanks!

Be sure to expand on the events to see if MS has more detailed info. Someone may have correct solution. I just wanted to point out the many virus use lsass.exe too. The real program is in the proper directory. Malware lsass.exe is usually hidden in user home. "Best Practices", Event viewer, host file, perfmon, antivirus, anti-spyware, Live CD's, backups, are in my top 10

The real lsass.exe is in C:\windows\system32 It's a fugazy if it's anywhere else.

The server is brand new with a CD OS build, Win2k3 sp2....no viruses. I have rebuilt the OS multiple times and applied the GPO to a completely patched OS and an OS with only sp2 applied....same results.

Search the event IDs on eventid.net Uncheck automatic restart in system properties, advanced, startup & recovery. Tell us what happens.