lsass.exe using 20% - 25% of CPU non-stop
I'm not sure if I've got the right forum for this but I'm having problems with lsass.exe on Windows 7 Ultimate x64. Within about 10 minutes of logging in on the machine, lsass.exe starts using 20 to 25 percent of the processor. When I drill in to that process using Process Explorer, it looks like ntdll.dll!EtwTraceMessageVa is the culprit with a "Cycles Delta" number of >2,200,000,000. I'm not sure what this means or how to proceed. Any ideas? Thanks, -BenBenjamin Day - Microsoft MVP for Visual Studio Team System - http://blog.benday.com
June 3rd, 2010 4:54pm

Hi Ben, follow my guide here: http://www.msfn.org/board/index.php?showtopic=140264 and make a xperf trace. Are you bale to see what lsass.exe is doing? If you're unsure how to read the data, upload the trace file to your SkyDrive and post a link here. best regards André"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
Free Windows Admin Tool Kit Click here and download it now
June 3rd, 2010 6:23pm

Hi, To troubleshoot the performance issue, please perform the following steps. 1. Restart the machine in Safe Mode and verify whether the lsass.exe consumes the same process. If the issue persists, please let me know. Otherwise, please move on the next steps. 2. Perform a Clean Boot to check the result. 3. Upgrade the virus definition and run a complete scanning. Thanks, Novak
June 4th, 2010 2:09am

I've tracked it down (I think) to Outlook 2010. When lsass.exe is going crazy on the CPU, Outlook 2010 won't exit (close the UI but the Outlook.exe process stays around.) When I kill the outlook.exe process, lsass.exe goes back to 0%. I've already disabled all the "add-ons" in Outlook and it still hangs. Anyone got any ideas why/how these might be related and what to do about it? -BenBenjamin Day - Microsoft MVP for Visual Studio Team System - http://blog.benday.com
Free Windows Admin Tool Kit Click here and download it now
June 4th, 2010 4:19pm

Are you using the Office 2010 Beta or RTM?"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
June 6th, 2010 6:33pm

Hi Andre, I'm having the lsass.exe problem with Outlook 2010 RTM. -BenBenjamin Day - Microsoft MVP for Visual Studio Team System - http://blog.benday.com
Free Windows Admin Tool Kit Click here and download it now
June 7th, 2010 9:00am

Hi Ben, are you able to attach the Debugger to Outlook and look what Outlook is doing? André"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
June 7th, 2010 5:02pm

Hi, Since you have located the cause, I suggest you uninstall Outlook 2010 RTM and reinstall it to check the result. If the issue persists, please download Process Monitor and monitor the detail file which causes the problem. For your reference, you can download Process Monitor from the link below: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx Thanks, Novak
Free Windows Admin Tool Kit Click here and download it now
June 7th, 2010 9:50pm

I've been having this problem, also. Does yours freeze even when you're not doing something particularly CPU intensive? Do you own a Toshiba Satellite? I also have a bunch of processes running ATM, most of which I have no idea what they are or what they're there for. They don't show up in AVG or Spybot, but they take up a lot of memory. Mostly RTHDCPL.exe, CCC.exe, and MOM.exe (don't worry. I know this is a known malware, but it's for ATI catalyst. They should really change that.) which takes up 12k, 7.5k and 5.4k respectively. Technocrate, Outlook 2010 does seem to freeze pretty often on things that seem like they're not all that CPU intensive. For example, typing in a name in the To box of an email and hitting CTRL-K to autocomplete the address hangs up the UI most of the time for about 10 seconds. Nope. Not running a Toshiba. Benjamin Day - Microsoft MVP for Visual Studio Team System - http://blog.benday.com
June 8th, 2010 8:49am

Hi, Since you have located the cause, I suggest you uninstall Outlook 2010 RTM and reinstall it to check the result. If the issue persists, please download Process Monitor and monitor the detail file which causes the problem. For your reference, you can download Process Monitor from the link below: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx Thanks, Novak Novak, I've been on the road all this week and noticed something interesting. Since I wasn't ever able to ping a domain controller, I didn't have any problems with lsass.exe. Now that I'm back in my office, I'm getting the lsass.exe problem again. I used Process Monitor to review what Outlook.exe and lsass.exe are doing and both processes are trying to do the same operations over and over again. I've posted the results to my skydrive: http://cid-66759c6053a12290.office.live.com/view.aspx/Public/ProcessMonitorResults.xlsx Can you take a look and let me know what you think? Thanks, -BenBenjamin Day - Microsoft MVP for Visual Studio Team System - http://blog.benday.com
Free Windows Admin Tool Kit Click here and download it now
June 11th, 2010 5:56pm

There are also other causes of this issue: I use a laptop at work and do not authenticate against the work domain - I login as local admin. If I need to use a network resource that requires authentication I usually receive a credentials prompt, and I authenticate with my domain credentials. So therefore I launch Outlook 2010 and it prompts me as above. I decided to tick the "save credentials/details" box this morning, and carried on working. I noticed lsass.exe cpu usage jump to 20% constantly. Outlook connection status says "connecting" to my exchange server after a reboot. I know the saved credentials are correct (or at least they were correct at the time I saved them because I used them to authenticate and use Outlook), my hunch is that since reboot - is Outlook possibly using my local authentication token to attempt to login (which obviously wont work)... Also is there any tracing I can use (like xperf) to see the token (or even the username) it is trying to use? I havent attached windbg or run procexp to see the call stack anything like that, but I thought it was worth mentioning that there are other causes of the issue. Oh and one more thing - can anyone tell me how to "unsave" my credentials? thanks, Crispin.
October 14th, 2010 10:45am

Good afternoon Benjamin, I wanted to thank you for the information that you provided in this post. I had been troubleshooting a XenApp performance issue for days and finally zeroed in on LSASS.EXE. Your advice lead me to the source of the issue that we were having and it resolved IMMEDIATELY once I have mounted the Public Folder (instead of leaving it dismounted- we don't want to use them but had a lingering Outlook 2003 client that we "couldn't" upgrade). Eventually we will kill the Public Folder, but for now at least we can operate! Thanks again, Dan Charlesworth Network Manager Alta Genetics
Free Windows Admin Tool Kit Click here and download it now
April 24th, 2012 6:17pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics