When you force a restart after your Windows 2000 stops responding, the System event log contains:
Event ID: 5000
Description: "The security package NTLM generated an exception. The package is now disabled. The exception information is the data."
NOTE: An error message stating that the Lsass service had an access violation may also be displayed.
The error will occur if the user belongs to more than 1,024 domain groups.
The error was fixed in the latest Windows 2000 Service Pack.