Troubleshooting high LSASS process on a DC found expensive queries originating from a few workstations.

Each query is as follows:

Visited Entries: 1Million+
Returned Entries: <50 (most of the times 0)

Compared applications installed on these workstations; nothing which screams high ldap queries.

My Questions:

  1. How to stop these queries on the workstation?
  2. How to find the application which is the culprit on those workstations(Is Field engineering available on Windows 7?)
  3. All these are occurring on single DC, it might be hard-coded; how can these queries be blocked on just that DC? Please let me know if any suggestions or questions.
  • 4
    Install and run Microsoft Network Monitor on one of the suspect clients. Find the process (or processes) responsible for that traffic to the DC. Microsoft Network Monitor will show you all conversations and the processes responsible for those conversations. – joeqwerty Jul 2 '14 at 14:24
  1. by identifying the source
  2. if you run tcpview/tcpvcon on the workstation it could help as it shows which processes have connected to remote hosts
  3. you can block that workstation's IP connection to the DC LDAP tcp port using the firewall rules but most likely you will cover the symptoms and not cure the source problem. especially by blocking ldap queries your workstations will be unable to resolve any legitimate case requests (users will be unable to search within active directory, any services/programs that need to lookup objects in active directory will fail, etc)

if you do not suspect any particular software installed on the workstation then you should run an offline antivirus scan on that workstation

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.