My RAM is constantly at 5+ gigabyte used, most of it taken up by lsass.exe. I've already done a full system scan for virusses and malware, but found nothing.

After digging in my system logs, I did find a whole lot of errors for Schannel:

- System 
  - Provider 
   [ Name]  Schannel 
   [ Guid]  {1F678132-5938-4686-9FDC-C8FF68F15C85} 
   EventID 36887 
   Version 0 
   Level 2 
   Task 0 
   Opcode 0 
   Keywords 0x8000000000000000 
  - TimeCreated 
   [ SystemTime]  2013-04-20T01:04:43.693414200Z 
   EventRecordID 147497 
  - Execution 
   [ ProcessID]  876 
   [ ThreadID]  924 
   Channel System 
   Computer Andreas-PC 
  - Security 
   [ UserID]  S-1-5-18 
- EventData 
  AlertDesc 48 

Could anyone provide me with a solution for this?


1 Answer 1


Lsass.exe is Windows' Local security authentication server. Or it's also called Local Security Authority Process. It is lsass.exe on the filesystem. It resides in *C:\Windows\System32* folder.

Check to see if the lsass.exe process on your machine that is taking up so much memory is the actual windows lass.exe in the folder I mentioned above. If not, likely it's a virus. I've never seen lsass.exe take more than 3 MB of memory.

Unfortunately, it's very nearly impossible to diagnose anything with such little information, and without actually looking at what's currently also running on your system...

This might seem like a stupid question, but are you positive no other user accounts are logged onto (but not active) on Windows? That might explain why lsass.exe was taking up so much memory, but even then... 5GB is way too much!

I would also try to match and see if you can figure out what processes are using those processIds that show up in the error logs for Schannel. That might be a good clue. You can find more about schannel here.

Hope this helps somewhat!

  • I had an additional account from Eset Smart Security for anti-theft. After I removed that one, my RAM usage dropped a few gigs, so I guess that it was badly optimized (or I'm just unlucky with it)
    – Andreas
    Apr 20, 2013 at 14:41
  • @Andreas : A few gigs! o.0 Geez... I'd suggest perhaps using something a little lighter for anti-theft... I use the free Prey application, which I also use to protect my Android phone Apr 20, 2013 at 18:07
  • I also found it strange so I reactivated it and it seems to work fine now (lsass.exe is at 3 mb). Kinda weird but I'll keep monitoring it.
    – Andreas
    Apr 21, 2013 at 10:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .