Re: LSASS.exe process near 100% usage
From: JA (none_at_nospam.com)
Date: 03/23/04
- Next message: Al Dunbar [MS-MVP]: "Re: Script to change password in AD"
- Previous message: Herb Martin: "Re: Contact Migration"
- In reply to: David Everett [MSFT]: "Re: LSASS.exe process near 100% usage"
- Messages sorted by: [ date ] [ thread ]
Date: Mon, 22 Mar 2004 14:21:59 -1000
okay i sent this output to your hotmail address. please let me know what you
find.
also, the other server's lsass.exe service is spiking. i pulled the network
connection
as you suggested in an earlier message but its still at 90-99%
"David Everett [MSFT]" <deverett@online.microsoft.com> wrote in message
news:OZIz5LhDEHA.2932@tk2msftngp13.phx.gbl...
> Can you download and run the DS version of MPSReports on one of these DCs?
>
> When it finishes it will place a "servername_MPSReports.CAB file in the
> %systemroot%\MPSReports\DirSvc\Logs\cab folder. If you like you can send
> the CAB file to my temporary hotmail address TemporaryOneX@hotmail.com.
>
> The MPSReports utility can be downloaded from:
>
http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd915706/MPSRPT_DirSvc.EXE
> --
> David Everett
> Microsoft Corporation
>
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
> "JA" <none@nospam.com> wrote in message
> news:OQY9WogDEHA.2600@TK2MSFTNGP09.phx.gbl...
> > no, none of my workstations start with a prefix that matches
> > the domain name.
> >
> > "David Everett [MSFT]" <deverett@online.microsoft.com> wrote in message
> > news:OMmNb8fDEHA.3664@TK2MSFTNGP10.phx.gbl...
> > > By any chance do your workstations have a prefix on the computer names
> > that
> > > match the domain name?
> > >
> > > For example you domain is called Domain and your workstations are
called
> > > Domain-wks1, Domain-wks2.
> > > --
> > > David Everett
> > > Microsoft Corporation
> > >
> > > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> > >
> > > "David Everett [MSFT]" <deverett@online.microsoft.com> wrote in
message
> > > news:#Hoih1dDEHA.2768@tk2msftngp13.phx.gbl...
> > > > Does the spike happen at particular time intervals, like every 12
> hours?
> > > >
> > > > Were there any schema modifications recently or have you done any
> large
> > > > migrations recently?
> > > > --
> > > > David Everett
> > > > Microsoft Corporation
> > > >
> > > > This posting is provided "AS IS" with no warranties, and confers no
> > > rights.
> > > >
> > > > "JA" <none@nospam.com> wrote in message
> > > > news:O1dPPqWDEHA.3852@TK2MSFTNGP10.phx.gbl...
> > > > > i have windows 2000 service pack 4 installed.
> > > > >
> > > > > two out of three DC's have this problem where the lsass.exe
process
> > > would
> > > > > go to near 100% usage.
> > > > >
> > > > > the client machines are either xp pro or windows 2000 pro.
> > > > >
> > > > > no sims or sms installed.
> > > > >
> > > > > i seem to be getting a lot of the following event log errors:
> > > > > event id: 1000
> > > > > source: userenv
> > > > > desc: windows cannot determine the user or computer name. return
> value
> > > > (14)
> > > > >
> > > > > and
> > > > > event id: 213
> > > > > source: licenseservice
> > > > > desc: replication of license information failed because the
license
> > > > logging
> > > > > service on server servername.company.com could not be contacted
> > > > >
> > > > > that server has been taken out of the domain and cannot be put
back
> > > > > into the domain. i guess it probably wasn't gracefully demoted?
how
> > > would
> > > > > one correct that and i'm not sure if that could be the cause of
the
> > > > > lsass.exe
> > > > > to spike up like that.
> > > > >
> > > > >
> > > > > "David Everett [MSFT]" <deverett@online.microsoft.com> wrote in
> > message
> > > > > news:eJ2hOmRDEHA.2076@TK2MSFTNGP09.phx.gbl...
> > > > > > What Service Pack is installed on the DCs?
> > > > > >
> > > > > > Are you getting any errors in the Directory Services event logs
of
> > the
> > > > > DCs?
> > > > > > If so, what is the Event ID, Source and Description of these
> events?
> > > > > >
> > > > > > If this DC is the only one that has the problem and others do
not,
> > try
> > > > > > Transferring the PDC role to a different DC and see if the CPU
> spike
> > > > moves
> > > > > > with the role.
> > > > > >
> > > > > > What OS do the client machines have installed?
> > > > > >
> > > > > > Is SIMS or another third-party solution that works like SMS in
the
> > > > > > environment?
> > > > > >
> > > > > > Follow the steps outlined in 251343 on the problem DC and see if
> the
> > > "DS
> > > > > > Security Propagation Events" counter returns to baseline in
> perfmon
> > or
> > > > if
> > > > > it
> > > > > > stays spiked. If the process stays spiked you may need to
examine
> > > > > > membership of Protected Groups.
> > > > > >
> > > > > > 251343 Manually Initializing the SD Propagator Thread to
Evaluate
> > > > > Inherited
> > > > > > http://support.microsoft.com/?id=251343
> > > > > >
> > > > > > 811172 Lsass.exe Spikes at 100 Percent CPU Usage and Then Shows
a
> > > > Typical
> > > > > > Load
> > > > > > http://support.microsoft.com/?id=811172
> > > > > > --
> > > > > > David Everett
> > > > > > Microsoft Corporation
> > > > > >
> > > > > > This posting is provided "AS IS" with no warranties, and confers
> no
> > > > > rights.
> > > > > >
> > > > > > "JA" <none@nospam.com> wrote in message
> > > > > > news:O6JYajIDEHA.3692@tk2msftngp13.phx.gbl...
> > > > > > > i have a windows 2000 advanced server. it is a domain
> controller,
> > as
> > > > > well
> > > > > > as
> > > > > > > a
> > > > > > > fsmo roles holder and a dns server. i have 2 other domain
> > > controllers
> > > > > and
> > > > > > a
> > > > > > > secondary dns server.
> > > > > > >
> > > > > > > at least once a week, this server's cpu usage (in task
manager)
> > goes
> > > > > near
> > > > > > > 100%
> > > > > > > and the culprit thats taking up so much cpu usage is
LSASS.exe.
> > why
> > > is
> > > > > > that?
> > > > > > > when i reboot, its okay again.
> > > > > > >
> > > > > > > i believe that process handles logons? not really sure. can
> anyone
> > > > tell
> > > > > me
> > > > > > > why
> > > > > > > this process goes 100% on occassions and i need to reboot?
> thanks.
> > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>
- Next message: Al Dunbar [MS-MVP]: "Re: Script to change password in AD"
- Previous message: Herb Martin: "Re: Contact Migration"
- In reply to: David Everett [MSFT]: "Re: LSASS.exe process near 100% usage"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
