Incorrect results in LDAP query, domain controller restarts, or user logons are denied in Windows Server 2012 R2

Issue 1

If you run a date-based Lightweight Directory Access Protocol (LDAP) query that includes comparison on a time-typed attribute (LDAP Syntax 2.5.5.11), Active Directory Domain Services may return incorrect results.

For example, an LDAP query with a query filter like (&(objectClass=*)(whenChanged<=19410404161039.0Z)) that queries for any object class modified prior to calendar year 1941 that predates the release of the operating system incorrectly returns all entries for ObjectClass=*. The expected result is that such a query should return 0 objects.

Issue 2

A domain controller restarts automatically. This issue occurs because the Local Security Authority Server Service (LSASS) process crashes if universal group membership caching is enabled. At the time of the domain controller restart, an event ID 1173 similar to the following one is logged:The significant data items in the event are the exception code and the "Internal ID". It is likely to be this problem when the three starting digits are "e00" and the lower four digits are close to "03fb".

Issue 3

Users can't log on to the computer after their password is changed. This issue occurs because of a latency in password synchronization between the branch domain controller and the primary domain controller (PDC).