Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My machine has been feeling sluggish and I'm noticing that the lsass.exe process is allocating nearly 2GB, which seems unusually high.

here: enter image description here

(Win7x64,Vertex2,Gtx460,i7-2600,8gb ram)

Any ideas?

share|improve this question
lsass.exe is the service responsible for managing authentication. Do you have anything unusual about your authentication? (Work environment, multiple users logging onto the system, remote desktop, etc.)? – Darth Android Sep 20 '12 at 14:28
Do you see any "unusual" events being logged in any of the Windows event logs? – HeatfanJohn Sep 20 '12 at 14:31
Well i dont have a domain or something in here (nor AD), its a standalone workstation. maybe because i have RSAT?. iv noticed that the lsass looks like CNG Key Isolation service (or KeyIso), when i try to stop the service i cant cause it have dependencies like wlan and eap. here: – energydream2007 Sep 20 '12 at 14:34
and il check the event log now – energydream2007 Sep 20 '12 at 14:35
hey iv just seen the the event log have unusual number of "The following fatal alert was received: 42." evnets (id 36887 and source Schannel) – energydream2007 Sep 20 '12 at 14:40

On my system, lsass.exe is consuming about 10K.

I'm at work. On our company's main domain controller, lsass.exe is up to about 80K.

Either your lsass.exe is infected, a piece of malware is trying to do something funny, or (least likely) something over the network is trying to do the same.

It's also possible you may have a legitimate program making a legitimate amount of authentication requests - possibly something running as another user accessing many, many files in a short period of time or similar.

share|improve this answer
can that be RSAT tools? cause ive scan with alot of scanner for a virus or malware an i cant see something that can cause this – energydream2007 Sep 20 '12 at 14:41
@energydream2007 - Disable the tools and report back. You need to avoid terms like RSAT when you don't explain what it means. – Ramhound Sep 20 '12 at 15:30
Yes as of now uninstall the RSAT resolve the prob - the usage is now 30k~. and everybody know what is RSAT... – energydream2007 Sep 20 '12 at 15:55
@energydream2007 Err, no we don't. Googling the term brings up a bunch of different products as well. – Darth Android Sep 20 '12 at 19:21
if you assisting ppl in the IT world you suppose to know this specific tool – energydream2007 Sep 20 '12 at 19:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .