Re: LSASS.exe process near 100% usage

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: David Everett [MSFT] (deverett_at_online.microsoft.com)
Date: 03/19/04 

Date: Fri, 19 Mar 2004 16:33:41 -0600

If you open Eventvwr.exe on one of the DCs and you click on the Directory
Services log and then right-click the Directory Services log and choose View
> Filter and enter the number 1168 in the Event ID: field.

Click OK and see if you have any of these events double-click on it, click
the Copy button just below the down Arrow and paste the event in a reply
post

Repeat this step and filter for Event ID 1173 and see if you have any of
these events copy this event into the reply post as well.

To turn off the filter of events just right-click Directory Services log and
choose View > All Records.

As for the DC that went way, see if it still has a Server object in Active
Directory Sites and Services under Sites > Default-First-Site-Name > Servers 

-- 
David Everett
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
"JA" <none@nospam.com> wrote in message
news:eg1533fDEHA.2424@TK2MSFTNGP09.phx.gbl...
> it seems to happen about once a week or so... every 7-10 days.
>
> one of my DC's who was the FMSO role holder had a major problem with
> 2 of the 3 hard drives and because you can rebuild the drives with only
> one good drive in a raid-5 configuration, i had to basically wipe that
> server
> out and restore from a backup. but before i scratched the drives i did
> transfer the fsmo roles to another DC which is one of the one's that is
> giving me the lsass.exe spike problems. not sure if that helps. maybe i
> should
> re-transfer the fsmo roles back to that original server?
>
>
> "David Everett [MSFT]" <deverett@online.microsoft.com> wrote in message
> news:%23Hoih1dDEHA.2768@tk2msftngp13.phx.gbl...
> > Does the spike happen at particular time intervals, like every 12 hours?
> >
> > Were there any schema modifications recently or have you done any large
> > migrations recently?
> > -- 
> > David Everett
> > Microsoft Corporation
> >
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> >
> > "JA" <none@nospam.com> wrote in message
> > news:O1dPPqWDEHA.3852@TK2MSFTNGP10.phx.gbl...
> > > i have windows 2000 service pack 4 installed.
> > >
> > > two out of three DC's have this problem where the lsass.exe process
> would
> > > go to near 100% usage.
> > >
> > > the client machines are either xp pro or windows 2000 pro.
> > >
> > > no sims or sms installed.
> > >
> > > i seem to be getting a lot of the following event log errors:
> > > event id: 1000
> > > source: userenv
> > > desc: windows cannot determine the user or computer name. return value
> > (14)
> > >
> > > and
> > > event id: 213
> > > source: licenseservice
> > > desc: replication of license information failed because the license
> > logging
> > > service on server servername.company.com could not be contacted
> > >
> > > that server has been taken out of the domain and cannot be put back
> > > into the domain. i guess it probably wasn't gracefully demoted? how
> would
> > > one correct that and i'm not sure if that could be the cause of the
> > > lsass.exe
> > > to spike up like that.
> > >
> > >
> > > "David Everett [MSFT]" <deverett@online.microsoft.com> wrote in
message
> > > news:eJ2hOmRDEHA.2076@TK2MSFTNGP09.phx.gbl...
> > > > What Service Pack is installed on the DCs?
> > > >
> > > > Are you getting any errors in the Directory Services event logs of
the
> > > DCs?
> > > > If so, what is the Event ID, Source and Description of these events?
> > > >
> > > > If this DC is the only one that has the problem and others do not,
try
> > > > Transferring the PDC role to a different DC and see if the CPU spike
> > moves
> > > > with the role.
> > > >
> > > > What OS do the client machines have installed?
> > > >
> > > > Is SIMS or another third-party solution that works like SMS in the
> > > > environment?
> > > >
> > > > Follow the steps outlined in 251343 on the problem DC and see if the
> "DS
> > > > Security Propagation Events" counter returns to baseline in perfmon
or
> > if
> > > it
> > > > stays spiked.  If the process stays spiked you may need to examine
> > > > membership of Protected Groups.
> > > >
> > > > 251343 Manually Initializing the SD Propagator Thread to Evaluate
> > > Inherited
> > > > http://support.microsoft.com/?id=251343
> > > >
> > > > 811172 Lsass.exe Spikes at 100 Percent CPU Usage and Then Shows a
> > Typical
> > > > Load
> > > > http://support.microsoft.com/?id=811172
> > > > -- 
> > > > David Everett
> > > > Microsoft Corporation
> > > >
> > > > This posting is provided "AS IS" with no warranties, and confers no
> > > rights.
> > > >
> > > > "JA" <none@nospam.com> wrote in message
> > > > news:O6JYajIDEHA.3692@tk2msftngp13.phx.gbl...
> > > > > i have a windows 2000 advanced server. it is a domain controller,
as
> > > well
> > > > as
> > > > > a
> > > > > fsmo roles holder and a dns server. i have 2 other domain
> controllers
> > > and
> > > > a
> > > > > secondary dns server.
> > > > >
> > > > > at least once a week, this server's cpu usage (in task manager)
goes
> > > near
> > > > > 100%
> > > > > and the culprit thats taking up so much cpu usage is LSASS.exe.
why
> is
> > > > that?
> > > > > when i reboot, its okay again.
> > > > >
> > > > > i believe that process handles logons? not really sure. can anyone
> > tell
> > > me
> > > > > why
> > > > > this process goes 100% on occassions and i need to reboot? thanks.
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>
Quantcast