1

My machine has been feeling sluggish and I'm noticing that the lsass.exe process is allocating nearly 2GB, which seems unusually high.

here: enter image description here

(Win7x64,Vertex2,Gtx460,i7-2600,8gb ram)

Any ideas?

Improve this question
8
  • lsass.exe is the service responsible for managing authentication. Do you have anything unusual about your authentication? (Work environment, multiple users logging onto the system, remote desktop, etc.)?
    – Darth Android
    Sep 20, 2012 at 14:28
  • Do you see any "unusual" events being logged in any of the Windows event logs?
    – HeatfanJohn
    Sep 20, 2012 at 14:31
  • Well i dont have a domain or something in here (nor AD), its a standalone workstation. maybe because i have RSAT?. iv noticed that the lsass looks like CNG Key Isolation service (or KeyIso), when i try to stop the service i cant cause it have dependencies like wlan and eap. here: i.imgur.com/2Y7t9.jpg
    – energydream2007
    Sep 20, 2012 at 14:34
  • and il check the event log now
    – energydream2007
    Sep 20, 2012 at 14:35
  • hey iv just seen the the event log have unusual number of "The following fatal alert was received: 42." evnets (id 36887 and source Schannel)
    – energydream2007
    Sep 20, 2012 at 14:40

1 Answer 1

Reset to default
3

On my system, lsass.exe is consuming about 10K.

I'm at work. On our company's main domain controller, lsass.exe is up to about 80K.

Either your lsass.exe is infected, a piece of malware is trying to do something funny, or (least likely) something over the network is trying to do the same.

It's also possible you may have a legitimate program making a legitimate amount of authentication requests - possibly something running as another user accessing many, many files in a short period of time or similar.

Improve this answer
6
  • can that be RSAT tools? cause ive scan with alot of scanner for a virus or malware an i cant see something that can cause this
    – energydream2007
    Sep 20, 2012 at 14:41
  • 1
    @energydream2007 - Disable the tools and report back. You need to avoid terms like RSAT when you don't explain what it means.
    – Ramhound
    Sep 20, 2012 at 15:30
  • Yes as of now uninstall the RSAT resolve the prob - the usage is now 30k~. and everybody know what is RSAT...
    – energydream2007
    Sep 20, 2012 at 15:55
  • 2
    @energydream2007 Err, no we don't. Googling the term brings up a bunch of different products as well.
    – Darth Android
    Sep 20, 2012 at 19:21
  • 1
    if you assisting ppl in the IT world you suppose to know this specific tool
    – energydream2007
    Sep 20, 2012 at 19:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .