Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hi I have a SQL Server 2005 Enterprise Edition on a Windows Server 2003 Enterprise sp2. Lately, I get very high I/O(Reda, Write, Other in Task Manager) from process lsass.exe. When I run sysinternals' process monitor on lsass.exe, I get a lot of activity related to SQL Server process. It seems it repeats a pattern of IRP_MJ_CREATE, IRP_MJ_DIRECTORY_CONTROL, IRP_MJ_CLEANUP and IRP_MJ_CLOSE by requests from sql server. Any suggestions on the cause?

share|improve this question

migrated from Jan 2 '10 at 8:23

This question came from our site for professional and enthusiast programmers.

Belongs on – Sam152 Jan 2 '10 at 6:18
No it doesn't - but it could do with some more data relating to to the level of IO, the spec and config of the server and what it is being used for. – Helvick Jan 2 '10 at 9:58

LSASS is the Local Security Authority process. LSASS does any work only as a result of security related activity occurring on other processes. A high amount of lsass.exe activity would indicate perhaps a high number of authentication (Kerberos, NTLM) events occurring.

Forget about Task Monitor or Process Monitor. Fire up Perfmon and look at the performance counters if you want to troubleshoot a problem. Get all counters/all instances for the Process category to identify which process consumes CPU/Memory/IO. I would be quite surprised to hear that lsass is truly a performance bottleneck.

I'd recommend you follow the Waits and Queues troubleshooting methodology to understand why you experience problems at peak hours. It's a proven methodology with an stellar track record on identifying problem root cause.

share|improve this answer

The server is a database server. we have about 150 clients that use this server as db server for their application(hospital automation). In task manager, for sqlserver.exe, reads and writes are about 1 million, where lsass is 19,000,000 and it increases between 50-100 every second. This causes a significant decrease in server performance in peak hours.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.