I've just tracked down a crasher in cc_msla.c: the code calls LsaConnectUntrusted() to obtain a connection to the LSA server which returns a HANDLE instance. Unfortunately, the wrong routine is used to free this handle after it has been used: see here - http://msdn.microsoft.com/en-us/library/aa378265(v=VS.85).aspx.
--
Jamie Kirkpatrick
07818 422311