Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have deployed an RDS Farm with 12 virtual RDS servers using Hyper V. Currently some users are not able to log on. After passing credentials to the connection broker, the session hangs on the "Welcome" screen.

Using resource monitor we've seen that svchost (with the "networkservice" service) has a CPU usage of 50%, when viewing the wait chain on the process it displays that it's waiting for a lsa.exe to finish.

We can't kill any of the users processes, even when trying with taskkill /f. Suspending lsa.exe did work but didn't have any effect. The networkservice also couldn't be restarted.

Also, if this happens, the current users logged on to the RDS server can't be displayed. Task manager crashes when viewing the users, RDS service manager crashes when viewing the users (even remotely) and the cmd command "query session" doesn't work.

No antivirus is installed on the RDS server. The only thing we can do is rebooting the server, which is not an option because of the fact that other users are in active sessions.

Does anyone have ANY idea what's going on? We didn't encounter this in our pre-production setup.

share|improve this question
Apply this Hotfix and se if that solves the problem: – user364801 Sep 4 '14 at 5:43
up vote 0 down vote accepted

You can use Process Explorer to see what svchost is doing, by regarding the Threads tab. This may tell you which Windows DLL/API calls is the busy thread using, and might clarify the situation (with a bit of luck).

Just to remark that statistically speaking, most cases of high CPU usage in svchost are the result of virus infection.

share|improve this answer
We did try launching process explorer, unfortunately during the high cpu usage it wont start. I can try to launch it before the high cpu usage. I will also try process monitor. – Rohan1 Jan 14 '11 at 19:52
If anything useful comes up, please incorporate it in your post (and drop me a comment here). – harrymc Jan 14 '11 at 21:22
Today the issue occurred again, using process monitor I was able to see that it was querying the firefox folder and constantly looping. Upon removing the firefox profile, the cpu usage went down... LSM.exe (local session manager, wrote lsa.exe by mistake) which was stuck in this loop does explain why the sessions couldn't be displayed by task manager or the mmc snap in. I assume the process was busy because of the loop. Thanks for your help! – Rohan1 Jan 17 '11 at 19:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.