LSASS.EXE Consuming CPU Windows 2003 SP2

[AJ]

Hi Folks

Just recently after installing ForeFront for SharePoint we have
started having LSASS.EXE issues. Basically the problems starts by
users not being able to log into their sharepoint site which is
published by ISA. It's strange because one site can be inaccesible and
the others fine. Looking at the server LSASS.EXE is pegging the
processor at 25%. Eventually this increases in what seems like 25%
increments until finally the server becomes competely unresponsive. I
have applied all the latest Windows updates but nothing has fixed this
issue. The problem seems to occur every 3 or 4 days. There are no
errors in the event logs anywhere so I'm stuck as to how to tackle
this one. Googling around I have come across one person who has the
exact same issue as me however no fix has been offered. I have just
uninstalled Forefront to see if that is the cause but I'm not
confident this will fix it. A reboot is the only way to return
LSASS.EXe to its normal CPU usage level. Nothing else has changed on
the server at all apart from the installation of ForeFront.

Anyone have any ideas?

TIA

AJ

 

[Meinolf Weber [MVP-DS]]

Hello AJ,

Check this articles in detail if they apply:
http://support.microsoft.com/kb/939268

http://support.microsoft.com/kb/842382

http://support.microsoft.com/kb/934318

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hi Folks
>
> Just recently after installing ForeFront for SharePoint we have
> started having LSASS.EXE issues. Basically the problems starts by
> users not being able to log into their sharepoint site which is
> published by ISA. It's strange because one site can be inaccesible and
> the others fine. Looking at the server LSASS.EXE is pegging the
> processor at 25%. Eventually this increases in what seems like 25%
> increments until finally the server becomes competely unresponsive. I
> have applied all the latest Windows updates but nothing has fixed this
> issue. The problem seems to occur every 3 or 4 days. There are no
> errors in the event logs anywhere so I'm stuck as to how to tackle
> this one. Googling around I have come across one person who has the
> exact same issue as me however no fix has been offered. I have just
> uninstalled Forefront to see if that is the cause but I'm not
> confident this will fix it. A reboot is the only way to return
> LSASS.EXe to its normal CPU usage level. Nothing else has changed on
> the server at all apart from the installation of ForeFront.
>
> Anyone have any ideas?
>
> TIA
>
> AJ
>

 

[AJ]

On 29 Aug, 09:17, Meinolf Weber [MVP-DS]
wrote:
> Hello AJ,
>
> Check this articles in detail if they apply:http://support.microsoft.com/kb/939268
>
> http://support.microsoft.com/kb/842382
>
> http://support.microsoft.com/kb/934318
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!!http://www.blakjak.demon.co.uk/mul_crss.htm
>
>
>
> > Hi Folks
>
> > Just recently after installing ForeFront for SharePoint we have
> > started having LSASS.EXE issues. Basically the problems starts by
> > users not being able to log into their sharepoint site which is
> > published by ISA. It's strange because one site can be inaccesible and
> > the others fine. Looking at the server LSASS.EXE is pegging the
> > processor at 25%. Eventually this increases in what seems like 25%
> > increments until finally the server becomes competely unresponsive. I
> > have applied all the latest Windows updates but nothing has fixed this
> > issue. The problem seems to occur every 3 or 4 days. There are no
> > errors in the event logs anywhere so I'm stuck as to how to tackle
> > this one. Googling around I have come across one person who has the
> > exact same issue as me however no fix has been offered. I have just
> > uninstalled Forefront to see if that is the cause but I'm not
> > confident this will fix it. A reboot is the only way to return
> > LSASS.EXe to its normal CPU usage level. Nothing else has changed on
> > the server at all apart from the installation of ForeFront.
>
> > Anyone have any ideas?
>
> > TIA
>
> > AJ- Hide quoted text -
>
> - Show quoted text -

Interesting, when the problem occured, prior to posting, I checked the
ISA Server authentication delegation setting for one of the published
sites. This site was the one that seemed to become inaccesible first.
The ISA rule was configured to use NTLM and as soon as I changed it
the site became accesible again, however the server still became
inacccesible again a few days later. It looks like your NTLM link
might be the fix, as I did not check remaining sites and ISA rules. I
will do some more investigatory work into this and let you know.

Thanks for the links, most helpful

AJ

 

[AJ]

On 30 Aug, 10:12, AJ wrote:
> On 29 Aug, 09:17, Meinolf Weber [MVP-DS]
> wrote:
>
>
>
>
>
> > Hello AJ,
>
> > Check this articles in detail if they apply:http://support.microsoft.com/kb/939268
>
> >http://support.microsoft.com/kb/842382
>
> >http://support.microsoft.com/kb/934318
>
> > Best regards
>
> > Meinolf Weber
> > Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> > no rights.
> > ** Please do NOT email, only reply to Newsgroups
> > ** HELP us help YOU!!!http://www.blakjak.demon.co.uk/mul_crss.htm
>
> > > Hi Folks
>
> > > Just recently after installing ForeFront for SharePoint we have
> > > started having LSASS.EXE issues. Basically the problems starts by
> > > users not being able to log into their sharepoint site which is
> > > published by ISA. It's strange because one site can be inaccesible and
> > > the others fine. Looking at the server LSASS.EXE is pegging the
> > > processor at 25%. Eventually this increases in what seems like 25%
> > > increments until finally the server becomes competely unresponsive. I
> > > have applied all the latest Windows updates but nothing has fixed this
> > > issue. The problem seems to occur every 3 or 4 days. There are no
> > > errors in the event logs anywhere so I'm stuck as to how to tackle
> > > this one. Googling around I have come across one person who has the
> > > exact same issue as me however no fix has been offered. I have just
> > > uninstalled Forefront to see if that is the cause but I'm not
> > > confident this will fix it. A reboot is the only way to return
> > > LSASS.EXe to its normal CPU usage level. Nothing else has changed on
> > > the server at all apart from the installation of ForeFront.
>
> > > Anyone have any ideas?
>
> > > TIA
>
> > > AJ- Hide quoted text -
>
> > - Show quoted text -
>
> Interesting, when the problem occured, prior to posting, I checked the
> ISA Server authentication delegation setting for one of the published
> sites. This site was the one that seemed to become inaccesible first.
> The ISA rule was configured to use NTLM and as soon as I changed it
> the site became accesible again, however the server still became
> inacccesible again a few days later. It looks like your NTLM link
> might be the fix, as I did not check remaining sites and ISA rules. I
> will do some more investigatory work into this and let you know.
>
> Thanks for the links, most helpful

>
> AJ- Hide quoted text -
>
> - Show quoted text -

Just thought I would let you know that this indeed fixed my problem!

THANK YOU!

AJ

 

[Meinolf Weber [MVP-DS]]

Hello AJ,

Nice to hear, thanks for the feedback.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> On 30 Aug, 10:12, AJ wrote:
>
>> On 29 Aug, 09:17, Meinolf Weber [MVP-DS]
>> wrote:
>>
>>> Hello AJ,
>>>
>>> Check this articles in detail if they
>>> apply:http://support.microsoft.com/kb/939268
>>>
>>> http://support.microsoft.com/kb/842382
>>>
>>> http://support.microsoft.com/kb/934318
>>>
>>> Best regards
>>>
>>> Meinolf Weber
>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>>> confers
>>> no rights.
>>> ** Please do NOT email, only reply to Newsgroups
>>> ** HELP us help YOU!!!http://www.blakjak.demon.co.uk/mul_crss.htm
>>>> Hi Folks
>>>>
>>>> Just recently after installing ForeFront for SharePoint we have
>>>> started having LSASS.EXE issues. Basically the problems starts by
>>>> users not being able to log into their sharepoint site which is
>>>> published by ISA. It's strange because one site can be inaccesible
>>>> and the others fine. Looking at the server LSASS.EXE is pegging the
>>>> processor at 25%. Eventually this increases in what seems like 25%
>>>> increments until finally the server becomes competely unresponsive.
>>>> I have applied all the latest Windows updates but nothing has fixed
>>>> this issue. The problem seems to occur every 3 or 4 days. There are
>>>> no errors in the event logs anywhere so I'm stuck as to how to
>>>> tackle this one. Googling around I have come across one person who
>>>> has the exact same issue as me however no fix has been offered. I
>>>> have just uninstalled Forefront to see if that is the cause but I'm
>>>> not confident this will fix it. A reboot is the only way to return
>>>> LSASS.EXe to its normal CPU usage level. Nothing else has changed
>>>> on the server at all apart from the installation of ForeFront.
>>>>
>>>> Anyone have any ideas?
>>>>
>>>> TIA
>>>>
>>>> AJ- Hide quoted text -
>>>>
>>> - Show quoted text -
>>>
>> Interesting, when the problem occured, prior to posting, I checked
>> the ISA Server authentication delegation setting for one of the
>> published sites. This site was the one that seemed to become
>> inaccesible first. The ISA rule was configured to use NTLM and as
>> soon as I changed it the site became accesible again, however the
>> server still became inacccesible again a few days later. It looks
>> like your NTLM link might be the fix, as I did not check remaining
>> sites and ISA rules. I will do some more investigatory work into this
>> and let you know.
>>
>> Thanks for the links, most helpful

>>
>> AJ- Hide quoted text -
>>
>> - Show quoted text -
>>
> Just thought I would let you know that this indeed fixed my problem!
>
> THANK YOU!
>
> AJ
>