Re: LSASS.exe process near 100% usage

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: David Everett [MSFT] (deverett_at_online.microsoft.com)
Date: 03/19/04 

Date: Fri, 19 Mar 2004 16:11:18 -0600

By any chance do your workstations have a prefix on the computer names that
match the domain name?

For example you domain is called Domain and your workstations are called
Domain-wks1, Domain-wks2. 

-- 
David Everett
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
"David Everett [MSFT]" <deverett@online.microsoft.com> wrote in message
news:#Hoih1dDEHA.2768@tk2msftngp13.phx.gbl...
> Does the spike happen at particular time intervals, like every 12 hours?
>
> Were there any schema modifications recently or have you done any large
> migrations recently?
> -- 
> David Everett
> Microsoft Corporation
>
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
> "JA" <none@nospam.com> wrote in message
> news:O1dPPqWDEHA.3852@TK2MSFTNGP10.phx.gbl...
> > i have windows 2000 service pack 4 installed.
> >
> > two out of three DC's have this problem where the lsass.exe process
would
> > go to near 100% usage.
> >
> > the client machines are either xp pro or windows 2000 pro.
> >
> > no sims or sms installed.
> >
> > i seem to be getting a lot of the following event log errors:
> > event id: 1000
> > source: userenv
> > desc: windows cannot determine the user or computer name. return value
> (14)
> >
> > and
> > event id: 213
> > source: licenseservice
> > desc: replication of license information failed because the license
> logging
> > service on server servername.company.com could not be contacted
> >
> > that server has been taken out of the domain and cannot be put back
> > into the domain. i guess it probably wasn't gracefully demoted? how
would
> > one correct that and i'm not sure if that could be the cause of the
> > lsass.exe
> > to spike up like that.
> >
> >
> > "David Everett [MSFT]" <deverett@online.microsoft.com> wrote in message
> > news:eJ2hOmRDEHA.2076@TK2MSFTNGP09.phx.gbl...
> > > What Service Pack is installed on the DCs?
> > >
> > > Are you getting any errors in the Directory Services event logs of the
> > DCs?
> > > If so, what is the Event ID, Source and Description of these events?
> > >
> > > If this DC is the only one that has the problem and others do not, try
> > > Transferring the PDC role to a different DC and see if the CPU spike
> moves
> > > with the role.
> > >
> > > What OS do the client machines have installed?
> > >
> > > Is SIMS or another third-party solution that works like SMS in the
> > > environment?
> > >
> > > Follow the steps outlined in 251343 on the problem DC and see if the
"DS
> > > Security Propagation Events" counter returns to baseline in perfmon or
> if
> > it
> > > stays spiked.  If the process stays spiked you may need to examine
> > > membership of Protected Groups.
> > >
> > > 251343 Manually Initializing the SD Propagator Thread to Evaluate
> > Inherited
> > > http://support.microsoft.com/?id=251343
> > >
> > > 811172 Lsass.exe Spikes at 100 Percent CPU Usage and Then Shows a
> Typical
> > > Load
> > > http://support.microsoft.com/?id=811172
> > > -- 
> > > David Everett
> > > Microsoft Corporation
> > >
> > > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> > >
> > > "JA" <none@nospam.com> wrote in message
> > > news:O6JYajIDEHA.3692@tk2msftngp13.phx.gbl...
> > > > i have a windows 2000 advanced server. it is a domain controller, as
> > well
> > > as
> > > > a
> > > > fsmo roles holder and a dns server. i have 2 other domain
controllers
> > and
> > > a
> > > > secondary dns server.
> > > >
> > > > at least once a week, this server's cpu usage (in task manager) goes
> > near
> > > > 100%
> > > > and the culprit thats taking up so much cpu usage is LSASS.exe. why
is
> > > that?
> > > > when i reboot, its okay again.
> > > >
> > > > i believe that process handles logons? not really sure. can anyone
> tell
> > me
> > > > why
> > > > this process goes 100% on occassions and i need to reboot? thanks.
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Relevant Pages

  • Re: LSASS.exe process near 100% usage
    ... For example you domain is called Domain and your workstations are called ... This posting is provided "AS IS" with no warranties, and confers no rights. ... replication of license information failed because the license ... >> to spike up like that. ...
    (microsoft.public.windows.server.general)
  • Re: LSASS.exe process near 100% usage
    ... For example you domain is called Domain and your workstations are called ... This posting is provided "AS IS" with no warranties, and confers no rights. ... replication of license information failed because the license ... >> to spike up like that. ...
    (microsoft.public.windows.server.active_directory)
  • Re: anti virus for sbs
    ... the two-user license for the corporate product was ... If it is Norton Antivirus, ... It is server-based and pushes out to the workstations (if you ... That's less than $200 per year to protect the server ...
    (microsoft.public.windows.server.sbs)
  • Re: Domain Controller and Workgroup
    ... This posting is provided "AS IS" with no warranties, and confers no rights. ... differently configured workstations with different versions of MS ... I need to install Windows Server 2008 R2 on the server test machine ...
    (microsoft.public.windows.server.setup)
  • Re: Unable to add workstation to domain
    ... Authenticated Users with Domain Admin in the Add Workstations to Domain user ... full controll for computer objects) - users of your Add Workstations group ... > of the GPO under User Account Rights) and 3) editing the Domain security ...
    (microsoft.public.win2000.active_directory)