Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Our Windows 2003 terminal server is running extremely slow today, so I checked task manager to see what is going on. lsass.exe is using as much free CPU as it can. The CPU Usage is staying at 100% because of this. Today is one of our slowest days, so I'm confused about why it is running so high. The only application the users are running is iexplore.exe, and the only other running services on the computer is Veritas Backupexec agents (other than the normal microsoft products). Other than a reboot, is there any way to fix this? Is there any troubleshooting tasks I can do to see what's going on?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You might consider running Process Explorer and looking at the threads in lsass.exe with high CPU utilization. If you've got something that's injected a DLL into the lsass.exe address-space you'll be able to see it there.

I'd echo dvogel's question about whether something / someone is attempting a brute-force password guessing attack, as well. What the network traffic moving and and out of the box (you do have "Network Monitor" installed, right?) and see if anything there looks uncharacteristic.

share|improve this answer
    
Do you think it could be webwatcher? I was unaware of someone installing this, but it seems like the problem has started after the installation of this program. –  Jacob Jul 5 '10 at 14:43
    
It was webwatcher. I uninstalled this program and the problem cleared instantly. –  Jacob Jul 5 '10 at 15:37

Is it using more memory than usual? If so, there is a Hot Fix for this.

share|improve this answer
    
No, the memory usage is normal. I've been researching the issue all morning and it looks like the memory issue was on win2000 –  Jacob Jul 2 '10 at 15:23
    
If memory is normal, are you sure that you aren't the target of a brute force attack? –  dvogel Jul 2 '10 at 15:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.