Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

what is lsass.exe for? 1

Status
Not open for further replies.

LucyP

Programmer
Jan 17, 2001
51
ES
Hi

I've had an ongoing problem with my Win2000 web server for a while now. It's running IIS5 and SQL Server (which I initially thought was the problem but am almost sure now that the problem is in the Windows configuration).

Anyway my problem is that after being online for a couple of days, the server starts to run really slowly, regardless of traffic at the time, memory configuration of memory left (we've just added 512Mb so we know memory is not the problem). When I look at the CPU usage (using the Task Manager's processes tab and ordering the list by CPU usage) I notice that lsass.exe is using an inordinate amount of CPU time and when the CPU is being used heavily (i.e. when a database search is being carried out) it is the top user of the CPU - effectively hogging the computer's resources so everything else runs slowly. Lsass.exe also uses a lot of CPU time when the system has first been rebooted and runs well and then seems to just use more and more. My own computer doesn't do this - obviously lsass.exe is running but it comes way down the list and almost never moves into pole position (that is, it is never the one process that uses the most CPU time).

What does lsass.exe do? What settings might cause it to use so much CPU time? Can I disable it or at least set it to a lower appetite, as it were? Please help.
 
Its the "Local Security Authority" process.

Have you got SP2 installed?
 
The local security authentication (LSA) subsystem server component generates the process that authenticates users for the Winlogon service. The LSA also responds to authentication information received from the Graphical Identification and Authentication (GINA) Msgina.dll component. If authentication is successful, Lsass.exe generates the user's access token, which starts the initial shell. Other processes that the user initiates inherit this token.

You might add some columns to Task Manager so that you can see the memory, both 'Memory Usage' and 'VM Size,' that lsass.exe is using. There are some known memory leak issues.

It seems to me like this server is handling a stressful authentication load. If there is any slowness or bottleneck in the authentication process, I can imagine lsass.exe hanging and eating processor time while waiting for it. Are you using SSL? Other types of authentication and encryption? I'm not sure this would be related to encryption, but you might think about it. What is the context in which user's hit the web site. Are running the Anonymous account in the name of a domain user account, or is it one of the built-in local accounts?
 
Hi both of you.

I am using Win2000 SP2 and it's updated with all the latest service packs. It also has a special Microsoft patch for an lsass problem but it turns out not to have helped (I did know it was a long shot).

We do use SSL, but not very much - it's on the checkout and order review pages and we take maybe 10-20 orders a day. I have absolutely know idea about the anonymous account - this was preconfigured (and is probably set to the Windows default) could that be the problem?

thanks

 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top