Troubleshooting high LSASS process on a DC found expensive queries originating from a few workstations.
Each query is as follows:
Visited Entries: 1Million+
Returned Entries: <50 (most of the times 0)
Compared applications installed on these workstations; nothing which screams high ldap queries.
My Questions:
- How to stop these queries on the workstation?
- How to find the application which is the culprit on those workstations(Is Field engineering available on Windows 7?)
- All these are occurring on single DC, it might be hard-coded; how can these queries be blocked on just that DC? Please let me know if any suggestions or questions.