Past SP2 lsass.exe High Utilization

From: Stingray (Stingray_at_discussions.microsoft.com)
Date: 12/08/04


Date: Tue, 7 Dec 2004 16:39:02 -0800

I now have 2 systems post SP2 with a very odd problem. The symptoms vary; one
user reports Outlook slows down, the other noticed that the Windows+L key
combination did not work to lock his machine and he could not shutdown the
system. He would get the shutdown menu and select either shutdown or restart
but nothing would happen after clicking OK.

When I went to look at the machines while they were doing these odd things I
found that the lsass service in the TaskManager was running at anywhere from
25 to 60% utilization. The only solution was to either kill the process,
which forced a reboot anyway, or to power off the system, as a shutdown
command would not work.

I scanned both systems thoroughly for malware or virus' and found nothing. I
checked specifically for sasser and it's relatives but the systems were
completely clean. Both machines are XP Pro with SP2 in a Windows 2000 domain.
The domain is behind a firewall and the machines are protected with
TrendMicro OfficeScan that is fully up-to-date.

I'd appreciate any suggestions on solving or even just troubleshooting these
issues before they become more widespread.



Relevant Pages

  • Re: Giving shutdown rights to somebody
    ... ]but it is not my decision to take the machines down on weekend. ... Unfortunately the command is to power off all machines at ... Why do you not just write a cron to run the shutdown script at say 6PM ... Use either shutdown -h or halt to do so. ...
    (comp.os.linux.security)
  • Re: Install Patch at shutdown
    ... The same Desktop Authority's inactivity ... programs when shutdown even will happen on client computer. ... can create a list which software you want to install for your students ... and it will be automatically installed on their machines when they'll ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Scheduled task, ran interactively ?
    ... clients request) around 7pm each night. ... shutdown till next Monday, don't shutdown until, or "never ... It's interactive and users have control over their machines, ... interact with the currently logged on user. ...
    (microsoft.public.windows.server.general)
  • Re: Problem: Kernel Panic/Oops on shutdown with 2.6.9 and Dell Optiplex SX280
    ... > Are you running some kind of sniffer tool on these machines. ... > into the shutdown scripts which may help the search. ... In fact there are 5 init scripts which could trigger the bug. ...
    (Linux-Kernel)
  • Re: Install Patch at shutdown
    ... To do this on multiple machines you can use ... If your shutdown script doesn't work try running gpresult, ... should choose 'Install Updates and Shut Down' option within Computer ...
    (microsoft.public.windowsxp.security_admin)