JSI Tip 6194. Windows 2000 Server hangs and the System event log contains event ID 5000 after you restart?

When you force a restart after your Windows 2000 stops responding, the System event log contains:

Source: LsaSrv
Category: (1)
Type: Error
Event ID: 5000
Description: "The security package NTLM generated an exception. The package is now disabled. The exception information is the data."

NOTE: An error message stating that the Lsass service had an access violation may also be displayed.

The error will occur if the user belongs to more than 1,024 domain groups.

The error was fixed in the latest Windows 2000 Service Pack.

See How do I obtain the latest Service Pack for Windows 2000?