Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are running a Windows 2000 Server as a domain controller and file server. 2 weeks ago, the machine was running fine. Then, after a power-outage and a restart, the machine became sluggish and intermittently stopped giving out DHCP (this can be temp resolved with a restart usually). Windows Task Manager shows 100% CPU usage. The top resource hog under the processes tab in Task Manager are lsass.exe and snmp.exe, that is, unless rtvscan is running. In that case, rtvscan is running at over 127k.

Event Viewer shows no obviously-relevant issues. Additionally, searching Google for lsass CPU usage issues has not been helpful to me.

What steps can I take to troubleshoot this? I have unplugged it from the network for 15min to determine if this is an internal or external issue. The CPU usage remains at 100%.

EDIT - the power outage was long enough to drain the UPS, which resulted in an improper shutdown (because I am not running UPS software on the machine).

share|improve this question
why down-vote this without a comment? If there is a problem with is, what? – cop1152 May 24 '11 at 13:24
good ? about the down vote, thats wierd. – tony roth May 24 '11 at 13:28
also was that power-outage and a restart was that a clean shutdown or crash? – tony roth May 24 '11 at 13:29
Did any patches apply after the restart? – Chadddada May 24 '11 at 13:56

Here is what I would do:

  1. First I would run a chkdsk /f.
  2. I am not sure if Window File Protection existed for Server 2000, although my research says id did, so I would run sfc /scannow to fix the Windows files.
  3. If that does not work, I would uninstall your Symantec AV.
  4. If that does not work, I would make an image of the server to be safe, then do an install over the current install. This will preserve your settings, but should repair any corrupted files.
  5. Run Windows Update and patch.
  6. Reinstall Symantec AV

Based on the services you say are pegging the CPU, it is probably either Symantec or Windows that is the problem, and it is likely a corrupt file that got damaged during the improper shutdown. Doing this should repair your files.

share|improve this answer
Thanks for the reply/your time. I had a hunch that it may be Symantec. I will report back in the morning with the results. – cop1152 May 24 '11 at 20:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.