4

In the past month or so I noticed that lsass.exe has started to leak memory, getting to 500MB+ of ram in under a week after reboot. Before this I had never noticed it using any significant amount of memory compared to other processes on the system.

This is happening on 2 identical servers, neither of which has anything to do with Active Directory.

Maybe a recent Windows Update has caused this? Any thoughts on things to check?

As a side question is there some way to recycle the memory usage of lsass.exe without rebooting?

Edit:

screenshot from Process Monitor

Here is what I'm seeing in Process Monitor, there are thousands of registry open/query/close a minute from lsass.exe. How can I track down what is triggering these?

Improve this question
5
  • Is the server this is happening on a DC?
    – Zypher
    Jan 31, 2010 at 23:37
  • @Zypher No, both computers having this issue have nothing to do with domain/active directory (both setup on a 'workgroup' and all users are local)
    – thelsdj
    Jan 31, 2010 at 23:56
  • Anything unusual logged in the eventviewer? Is it physical or virtual memory you are seeing increase?
    – SqlACID
    Feb 1, 2010 at 2:30
  • @SqlACID Nothing abnormal in event viewer. The 'Mem Usage' and 'VM Size' are about the same for lsass.exe, currently at 510M on one server and 380M on the other (the one that has been rebooted most recently).
    – thelsdj
    Feb 1, 2010 at 6:59
  • Strange; no way to restart it that i know of; I would probably try running sysinternals filemon/regmon/process explorer and looking for anything unusual going on.
    – SqlACID
    Feb 2, 2010 at 0:57

4 Answers 4

Reset to default
1

If you have iis on your server, this microsoft kb can help you : http://support.microsoft.com/kb/979730

Improve this answer
1
  • This looks like exactly the problem, one of the listed updates was installed right before I started noticing this. I haven't yet installed the fix but my guess is that this will fix it.
    – thelsdj
    Mar 9, 2010 at 18:55
0

Running 3rd-party software with integrated NTLM authentication? Could be that software requesting security info and never freeing it up again.
Also, are you using the "Built-In" groups for anything? Sometimes having a lot of heavily used accounts in the Built-In groups can do this.

Improve this answer
1
  • Trying to think what all we have on here that might give you more info. We run cygwin sshd but its not very heavily used and it hasn't been upgraded or usage changed since this started happening. The only thing we use separate accounts for is http authentication on our IIS server (and only 2-3 users), all other apps running on the server are run under a single local user.
    – thelsdj
    Feb 1, 2010 at 0:28
0

A memory leak occurs in the Lsass.exe process on a Windows XP-based or a Windows Server 2003-based computer: http://support.microsoft.com/kb/902058

Also consider scanning for trojans

Improve this answer
2
  • Already found that, but it is from years ago and these are fully patched servers that did not have any problem until about a month ago.
    – thelsdj
    Feb 1, 2010 at 2:27
  • As previously mentioned: check for trojans or other undesirables.
    – Trevoke
    Feb 8, 2010 at 19:02
0

We have also noticed some weird lsass memory usage lately when using SSL. Eventually it will cause SSL connections to fail.

It looks like there was a patch release this week http://support.microsoft.com/kb/973917 that while not specifically mentioning the problem we have been seeing, seems to have fixed it for us.

Might want to check this out.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .