RE: [ActiveDir] lsass.exe hogs my domain controller cpu

[Eric Fleischman]

Network trace = a sniff, capture, etc. of the packets hitting the wire. Tools like netmon and Ethereal can do this for you. SPA = Server Performance Advisor. You can pick up the tool here: http://www.microsoft.com/downloads/details.aspx?FamilyID=61a41d78-e4aa-47b9-901b-cf85da075a73&displaylang=en   ~Eric     From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sharif Naser Sent: Wednesday, March 02, 2005 11:09 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] lsass.exe hogs my domain controller cpu   Thanks a lot guys,   I’m afraid it was not the right KB article but I do appreciate your response. On the other hand I did my home work in order to find a solution for this problem. Unfortunately, my home work was unfruitful.   Now, the good news is that the problem was solved through solving an exchange problem I don’t know whether this could be a coincident but this is what happened   Finally, I need to know how do you collect network trace & what is SPA data.     Thanks & best regards, Sharif   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jorge de Almeida Pinto Sent: Tuesday, March 01, 2005 5:26 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] lsass.exe hogs my domain controller cpu   Sorry, tried to help in a "very quick and dirty way". ;-))   I agree that researching is always better than guessing!   On the other side please tell if I've thrown the correct KB article so I can start running to buy a lotto ticket... ;-))   Jorge   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Eric Fleischman Sent: Tuesday, March 01, 2005 14:49 To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] lsass.exe hogs my domain controller cpu Jorge, the problem with throwing a KB at it is that there are hundreds…..probably thousands…..of things that could cause this. With the data provided, it is nearly impossible to effectively diagnose the problem. This KB could be it, and if it is, I suggest you go out and buy a lotto ticket immediately. :)   This is my standard action plan I use for high lsass/dsamain utilization cases: 0)       During the problem state please collect 3-5 dumps of lsass using adplus as follows: adplus –Hang –p 123 –o c:\dumps (instead of 123 use the PID of lsass please) 1)       During the problem please collect a network trace with a duration of at least 2 minutes in length 2)       If on 2k3, collect >=5 minutes worth of SPA data. Set SPA to data only mode, and just zip up the transfer directory. We can compile it after.     From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jorge de Almeida Pinto Sent: Tuesday, March 01, 2005 1:28 AM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] lsass.exe hogs my domain controller cpu   See the following if it applies: http://support.microsoft.com/Default.aspx?kbid=842382 Jorge   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sharif Naser Sent: Tuesday, March 01, 2005 08:22 To: ActiveDir@mail.activedir.org Subject: [ActiveDir] lsass.exe hogs my domain controller cpu Hello experts,   Lsass.exe hogs my domain controllers cpu (99%), what could be the reason for this, how do I get rid off this problem.   Machine was started twice but the problem still persists. By the way, machines has advanced windows 2000 with sp4.   Regards, DISCLAIMER: This electronic message transmission contains information from Qatar Steel Company (QASCO) which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. Be aware that any disclosure, copying, distribution or use of the contents of this information, including attachments, is prohibited without the written consent of Qatar Steel Company (QASCO). This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you. DISCLAIMER: This electronic message transmission contains information from Qatar Steel Company (QASCO) which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. Be aware that any disclosure, copying, distribution or use of the contents of this information, including attachments, is prohibited without the written consent of Qatar Steel Company (QASCO).