I have a user who has been noticing slowdowns with his machine frequently. When investigating his system (Windows Server 2008 R2) processes, we saw that lsass.exe was using 2.4GB of memory. A reboot took it back down to 80MB. It kept happening every day though and today we were able to identify what action he was taking that skyrocketed lsass's memory usage.

All he did was access a web page on another server. This should only be sending his cert with the web page request, correct? Why would a local security process care about that?

Does anybody have any idea what might be going on here and how to fix it?

  • HTTP or HTTPS site?
    – MartinC
    Apr 2, 2014 at 17:14
  • It's an HTTPS site.
    – Tony
    Apr 2, 2014 at 17:21
  • Well, since its an HTTPS site it uses the certificates to set up a SSL tunnel between the two servers. That's probably the reason lsass.exe gets involved, but as to why its consuming that much ram I don't really have an answer :(
    – MartinC
    Apr 2, 2014 at 17:38
  • Why is an end user running Windows Server as a desktop OS? You're certain that this machine isn't configured as a domain controller, right? Apr 3, 2014 at 16:30


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.