lsass.exe process hog

[Arkroyal]

My Windows SBS 2003 server with SP2 and reasonably up to date with updates has been running since June without a reboot and running perfectly smoothly. I am now starting to get a threshold warning for the lsass.exe process allocating too much memory (threshold warning was 104857600 bytes) and continues to grow. No events in event viewer and CPU usage only peaks at around 6%.

I suspect a possible memory leak, but none of the suggested fixes I have found seem to apply as the server is otherwise running normally. The version of lsass.exe is 5.2.3790.0.

Anyone got any ideas?

 

[itsp1965]

Try using process monitor from the sysinternals site to get a snapshot of what's going on.

 

[Arkroyal]

Thanks itsp1965.

Ran Process Explorer as suggested and there does not appear to be anything unusual going on. Backup Exec is running, we use Trend Micro Worry Free Business Server and the Exchange information store is using its customary large amount of memory.

All of the processes spawned by lsass appear to be related to Kerberos and SAM and are coming from internal IP addresses. CPU load is very low - max 6%.

The lsass memory usage is now hovering around 124,000 K and will probably generate another alert. They seem to be generated at 7:00 am each morning.