In the past month or so I noticed that lsass.exe has started to leak memory, getting to 500MB+ of ram in under a week after reboot. Before this I had never noticed it using any significant amount of memory compared to other processes on the system.

This is happening on 2 identical servers, neither of which has anything to do with Active Directory.

Maybe a recent Windows Update has caused this? Any thoughts on things to check?

As a side question is there some way to recycle the memory usage of lsass.exe without rebooting?


screenshot from Process Monitor

Here is what I'm seeing in Process Monitor, there are thousands of registry open/query/close a minute from lsass.exe. How can I track down what is triggering these?

  • Is the server this is happening on a DC? – Zypher Jan 31 '10 at 23:37
  • @Zypher No, both computers having this issue have nothing to do with domain/active directory (both setup on a 'workgroup' and all users are local) – thelsdj Jan 31 '10 at 23:56
  • Anything unusual logged in the eventviewer? Is it physical or virtual memory you are seeing increase? – SqlACID Feb 1 '10 at 2:30
  • @SqlACID Nothing abnormal in event viewer. The 'Mem Usage' and 'VM Size' are about the same for lsass.exe, currently at 510M on one server and 380M on the other (the one that has been rebooted most recently). – thelsdj Feb 1 '10 at 6:59
  • Strange; no way to restart it that i know of; I would probably try running sysinternals filemon/regmon/process explorer and looking for anything unusual going on. – SqlACID Feb 2 '10 at 0:57

If you have iis on your server, this microsoft kb can help you : http://support.microsoft.com/kb/979730

  • This looks like exactly the problem, one of the listed updates was installed right before I started noticing this. I haven't yet installed the fix but my guess is that this will fix it. – thelsdj Mar 9 '10 at 18:55

Running 3rd-party software with integrated NTLM authentication? Could be that software requesting security info and never freeing it up again.
Also, are you using the "Built-In" groups for anything? Sometimes having a lot of heavily used accounts in the Built-In groups can do this.

  • Trying to think what all we have on here that might give you more info. We run cygwin sshd but its not very heavily used and it hasn't been upgraded or usage changed since this started happening. The only thing we use separate accounts for is http authentication on our IIS server (and only 2-3 users), all other apps running on the server are run under a single local user. – thelsdj Feb 1 '10 at 0:28

A memory leak occurs in the Lsass.exe process on a Windows XP-based or a Windows Server 2003-based computer: http://support.microsoft.com/kb/902058

Also consider scanning for trojans

  • Already found that, but it is from years ago and these are fully patched servers that did not have any problem until about a month ago. – thelsdj Feb 1 '10 at 2:27
  • As previously mentioned: check for trojans or other undesirables. – Trevoke Feb 8 '10 at 19:02

We have also noticed some weird lsass memory usage lately when using SSL. Eventually it will cause SSL connections to fail.

It looks like there was a patch release this week http://support.microsoft.com/kb/973917 that while not specifically mentioning the problem we have been seeing, seems to have fixed it for us.

Might want to check this out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.