Re: LSASS.exe process near 100% usage

From: David Everett [MSFT] (deverett_at_online.microsoft.com)
Date: 03/20/04 

Date: Fri, 19 Mar 2004 18:33:24 -0600

Can you download and run the DS version of MPSReports on one of these DCs?

When it finishes it will place a "servername_MPSReports.CAB file in the
%systemroot%\MPSReports\DirSvc\Logs\cab folder. If you like you can send
the CAB file to my temporary hotmail address TemporaryOneX@hotmail.com.

The MPSReports utility can be downloaded from:
http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd915706/MPSRPT_DirSvc.EXE 

-- 
David Everett
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
"JA" <none@nospam.com> wrote in message
news:OQY9WogDEHA.2600@TK2MSFTNGP09.phx.gbl...
> no, none of my workstations start with a prefix that matches
> the domain name.
>
> "David Everett [MSFT]" <deverett@online.microsoft.com> wrote in message
> news:OMmNb8fDEHA.3664@TK2MSFTNGP10.phx.gbl...
> > By any chance do your workstations have a prefix on the computer names
> that
> > match the domain name?
> >
> > For example you domain is called Domain and your workstations are called
> > Domain-wks1, Domain-wks2.
> > -- 
> > David Everett
> > Microsoft Corporation
> >
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> >
> > "David Everett [MSFT]" <deverett@online.microsoft.com> wrote in message
> > news:#Hoih1dDEHA.2768@tk2msftngp13.phx.gbl...
> > > Does the spike happen at particular time intervals, like every 12
hours?
> > >
> > > Were there any schema modifications recently or have you done any
large
> > > migrations recently?
> > > -- 
> > > David Everett
> > > Microsoft Corporation
> > >
> > > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> > >
> > > "JA" <none@nospam.com> wrote in message
> > > news:O1dPPqWDEHA.3852@TK2MSFTNGP10.phx.gbl...
> > > > i have windows 2000 service pack 4 installed.
> > > >
> > > > two out of three DC's have this problem where the lsass.exe process
> > would
> > > > go to near 100% usage.
> > > >
> > > > the client machines are either xp pro or windows 2000 pro.
> > > >
> > > > no sims or sms installed.
> > > >
> > > > i seem to be getting a lot of the following event log errors:
> > > > event id: 1000
> > > > source: userenv
> > > > desc: windows cannot determine the user or computer name. return
value
> > > (14)
> > > >
> > > > and
> > > > event id: 213
> > > > source: licenseservice
> > > > desc: replication of license information failed because the license
> > > logging
> > > > service on server servername.company.com could not be contacted
> > > >
> > > > that server has been taken out of the domain and cannot be put back
> > > > into the domain. i guess it probably wasn't gracefully demoted? how
> > would
> > > > one correct that and i'm not sure if that could be the cause of the
> > > > lsass.exe
> > > > to spike up like that.
> > > >
> > > >
> > > > "David Everett [MSFT]" <deverett@online.microsoft.com> wrote in
> message
> > > > news:eJ2hOmRDEHA.2076@TK2MSFTNGP09.phx.gbl...
> > > > > What Service Pack is installed on the DCs?
> > > > >
> > > > > Are you getting any errors in the Directory Services event logs of
> the
> > > > DCs?
> > > > > If so, what is the Event ID, Source and Description of these
events?
> > > > >
> > > > > If this DC is the only one that has the problem and others do not,
> try
> > > > > Transferring the PDC role to a different DC and see if the CPU
spike
> > > moves
> > > > > with the role.
> > > > >
> > > > > What OS do the client machines have installed?
> > > > >
> > > > > Is SIMS or another third-party solution that works like SMS in the
> > > > > environment?
> > > > >
> > > > > Follow the steps outlined in 251343 on the problem DC and see if
the
> > "DS
> > > > > Security Propagation Events" counter returns to baseline in
perfmon
> or
> > > if
> > > > it
> > > > > stays spiked.  If the process stays spiked you may need to examine
> > > > > membership of Protected Groups.
> > > > >
> > > > > 251343 Manually Initializing the SD Propagator Thread to Evaluate
> > > > Inherited
> > > > > http://support.microsoft.com/?id=251343
> > > > >
> > > > > 811172 Lsass.exe Spikes at 100 Percent CPU Usage and Then Shows a
> > > Typical
> > > > > Load
> > > > > http://support.microsoft.com/?id=811172
> > > > > -- 
> > > > > David Everett
> > > > > Microsoft Corporation
> > > > >
> > > > > This posting is provided "AS IS" with no warranties, and confers
no
> > > > rights.
> > > > >
> > > > > "JA" <none@nospam.com> wrote in message
> > > > > news:O6JYajIDEHA.3692@tk2msftngp13.phx.gbl...
> > > > > > i have a windows 2000 advanced server. it is a domain
controller,
> as
> > > > well
> > > > > as
> > > > > > a
> > > > > > fsmo roles holder and a dns server. i have 2 other domain
> > controllers
> > > > and
> > > > > a
> > > > > > secondary dns server.
> > > > > >
> > > > > > at least once a week, this server's cpu usage (in task manager)
> goes
> > > > near
> > > > > > 100%
> > > > > > and the culprit thats taking up so much cpu usage is LSASS.exe.
> why
> > is
> > > > > that?
> > > > > > when i reboot, its okay again.
> > > > > >
> > > > > > i believe that process handles logons? not really sure. can
anyone
> > > tell
> > > > me
> > > > > > why
> > > > > > this process goes 100% on occassions and i need to reboot?
thanks.
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Relevant Pages

  • Re: LSASS.exe process near 100% usage
    ... Can you download and run the DS version of MPSReports on one of these DCs? ... This posting is provided "AS IS" with no warranties, and confers no rights. ... >> By any chance do your workstations have a prefix on the computer names ...
    (microsoft.public.windows.server.general)
  • Re: LSASS.exe process near 100% usage
    ... Can you download and run the DS version of MPSReports on one of these DCs? ... This posting is provided "AS IS" with no warranties, and confers no rights. ... >> By any chance do your workstations have a prefix on the computer names ...
    (microsoft.public.win2000.active_directory)
  • ebooks share lits 342
    ... download your ebooks ... Nations Convention on the Rights of the Child, ... Nations Convention on the Rights of the Child, ...
    (sci.med.nutrition)
  • Re: Svchost errors
    ... | I HAVE GOT THE PROBLEM THAT ALOT OF MY WIN2000 WORKSTATIONS GIVES ME SVCHOST ... This will bring up the initial menu of choices and should be executed in Normal Mode. ... You can choose to go to each menu item and just download the needed files or you can ... It is suggested to run the scanners in both Safe Mode and Normal Mode. ...
    (microsoft.public.win2000.general)
  • Re: SR-1a update problem
    ... This posting is provided "AS IS" with no warranties, and confers no rights. ... "Debi" wrote in message ... I checked & a download of the full ...
    (microsoft.public.officeupdate)