LSASS.exe bet you guyz cant figure this one out - Techist - Tech Forum

Go Back   Techist - Tech Forum > Computer Software > Microsoft Windows and Software
Click Here to Login
Closed Thread
 
Thread Tools Display Modes
 
Old 04-11-2004, 08:53 PM   #1 (permalink)
Newb Techie
 
Join Date: Jan 2004
Posts: 19
Red face LSASS.exe bet you guyz cant figure this one out

whatever lsass.exe is , its becoming a huge problem. This just started about a week ago, that process just keeps increasing in memory usuage and form what i hear its a system needed process. Any ideas, i did the online norton virus scan and nothing came up. if i leave my comp idle for a few hours the processor (2400+) will be constantly running at 80%? help is def needed
__________________

Computa_neerd is offline  
Old 04-11-2004, 09:09 PM   #2 (permalink)
Junior Techie
 
Join Date: Dec 2003
Posts: 99
Default

WinTasks Process Library

lsass - lsass.exe - Process Information

Process File: lsass or lsass.exe
Process Name: Local Security Authority Service
Description: Windows Local Security Authority Server Process handles Windows security mechanisms. It verifies the validity of user logons to your computer or server. Technically, the software generates the process that is responsible for authenticating users for the Winlogon service.
Company: Microsoft Corp.
System Process: Yes
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
Common Errors: N/A

and qouting from http://support.microsoft.com/default...;EN-US;Q308356

Limit or Minimize the Number of Programs on Your Domain Controller
For optimum performance, the Lsass.exe process takes as much RAM as possible on a given server or domain controller. The Lsass.exe process relinquishes that RAM as other processes ask for it. The idea is to optimize performance of the Lsass.exe process while still accounting for other processes that might run on a computer. Because of this and to increase performance, it is a good practice to limit or minimize the number of programs on a domain controller. If there are no memory requests, the Lsass.exe process uses this memory to cache queried data.
Use the Active Directory Sizer (Adsizer.exe) and ADTEST Tools
You can use the Adsizer.exe tool to gauge the amount of memory that is needed for domain controllers based on their function. You can only use this test as an estimate because Adsizer.exe cannot predict exactly how much memory will be necessary for all processes. You can use the ADTEST tool to stress the domain controllers and provide an expected memory usage baseline and memory load.
32-Bit Addressing Space Is Limited to 4 Gigabytes (GB)
The 32-bit addressing space is limited to 4 GB of physical memory.
Use Counters to Monitor Lsass.exe Usage
You can use the job object, processor usage (80% Processor usage as a stress mark), adperf, and cop processes performance tools to monitor Lsass.exe usage. The counters of interest are Memory, Process, NTDS Object, Cache, Server, Processor, Threads, and Database.
Use Windows
If you plan to use more than 1 GB of physical memory on the domain controller, use Windows 2000 Advanced Server, Windows 2000 Datacenter Server, Windows Server 2003, Standard Edition, Windows Server 2003, Enterprise Edition, or Windows Server 2003, Datacenter Edition. You can use the /3GB switch on these versions of Windows to provide an additional 1 GB of addressable memory. However, if you use this switch with Windows 2000 Server, this memory space is marked as unavailable.
Memory Information
Lsass memory usage on domain controllers has two major components: one fixed and one variable.

The fixed component is made up of the code, the stacks, the heaps, and various fixed size data structures (for example, the schema cache). The amount of memory that Lsass uses may vary, depending on the load on the computer. As the number of running threads increases, so does the number of memory stacks. Lsass.exe usually uses 100 MB to 300 MB of memory. Lsass.exe uses the same amount of memory no matter how much RAM is installed in the computer. However, when a larger amount of RAM is installed, Lsass can use more RAM and less virtual memory.

The variable component is the database buffer cache. The size of the cache can range from less than 1 MB to the size of the entire database. Because a larger cache improves performance, the database engine for AD (ESENT) attempts to keep the cache as large as possible. While the size of the cache varies with memory pressure in the computer, the maximum size of the cache is limited by both the amount of physical RAM installed in the computer and by the amount of available virtual address space (VA). AD uses only a portion of total VA space for the cache. The maximum amount of VA space that AD can use is determined by the following formula:

((totalVA - 1GB) / 2)
Note This formula only applies to Windows 2000. In Windows Server 2003, the memory model for LSASS is different and the amount of memory that is used by the cache is dynamic. Memory usage has grown as large as 2.6 GB, but this is based on the assumption that other processes in LSASS do not need the memory.

This means that on an x86 machine without the /3GB switch, the cache size is limited either to 512 MB or to the amount of physical RAM, whichever is smaller. With the /3GB switch, the cache size is limited to either 1 GB or to the amount of physical RAM, whichever is smaller. Note that this means that the /3GB switch begins to help as soon as the amount of physical RAM is greater than approximately 600MB (500 MB for the cache, plus approximately 100 MB for the fixed component). On 64-bit systems, such as the IA64, cache size is effectively limited only by RAM, and Microsoft Development has test systems with over 9GB of cache in use.
__________________

__________________
nomad
nomad is offline  
Old 04-11-2004, 09:09 PM   #3 (permalink)
HONK if you route packets
 
mikesgroovin's Avatar
 
Join Date: Sep 2003
Location: MD
Posts: 4,715
Default

Well, lsass.exe isn't a problem. It's a windows system process that works with the Winlogon service to authenticate local users.
Are you sure that this is exactly how it is spelled? Any spaces or _ in the name?
Have you tried looking in msconfig or the registry to see what is starting when your computer boots? Could definatly be something that Norton would ordinarily pick up on.

-Mike
mikesgroovin is offline  
Old 04-11-2004, 09:10 PM   #4 (permalink)
HONK if you route packets
 
mikesgroovin's Avatar
 
Join Date: Sep 2003
Location: MD
Posts: 4,715
Default

LOL....seconds after you. Ok.....so you probably get it now...
mikesgroovin is offline  
Old 04-12-2004, 06:57 PM   #5 (permalink)
Wizard Techie
 
Join Date: Apr 2004
Posts: 3,247
Default

is this a home system or work? being used as what??
__________________
If you argue with an idiot he will drag you down to his level and beat you with experience.

I am not a fast writer.
I am not a slow writer.
I am a half-fast writer.

-Robert Asprin
killians45 is offline  
Old 04-12-2004, 06:59 PM   #6 (permalink)
Wizard Techie
 
Join Date: Apr 2004
Posts: 3,247
Default

also a listing of what is running in apps and process would be VERY helpful.
__________________
If you argue with an idiot he will drag you down to his level and beat you with experience.

I am not a fast writer.
I am not a slow writer.
I am a half-fast writer.

-Robert Asprin
killians45 is offline  
Old 04-12-2004, 09:05 PM   #7 (permalink)
Newb Techie
 
Join Date: Jan 2004
Posts: 19
Default

yea home computer heres a list of my processes

damn it wont let me upload my Screen shot of my processes, i pasted it in paint and attached it wtf
Computa_neerd is offline  
Old 04-12-2004, 09:10 PM   #8 (permalink)
Wizard Techie
 
Join Date: Apr 2004
Posts: 3,247
Default

hmm... no processes listed...
__________________
If you argue with an idiot he will drag you down to his level and beat you with experience.

I am not a fast writer.
I am not a slow writer.
I am a half-fast writer.

-Robert Asprin
killians45 is offline  
Old 04-12-2004, 09:12 PM   #9 (permalink)
Wizard Techie
 
Join Date: Apr 2004
Posts: 3,247
Default

well, to let you know the lsass is logon info for the user. contains the .dll's that are needed for given apps. ALOT of the stuff is not needed! Here is a listing I've found for ya. Just go into services (start/admin/services) and disable what you dont need:


This is a guide for information only with plain english descriptions of the services real function. Please make your own mind up over which services to disable on your system.

Alerter
Function - Good for big brother corporate networks. Home PCs do not need to send/receive administrative alerts.

home PC - Manual

-

Application Layer Gateway Service
Function - Good if the system is a gateway/client on a NAT LAN, also (attempts to) protect nasty script kiddies from turning you and your friends' computers into their pawns in the quest for world domination. XP's Firewall is about as useful as a chocolate Teapot. Disable this service unless you are on a home LAN and use Microsoft's Internet Connection Sharing.

home PC - Disabled

-

Application Management
Function - Provides software installation services such as Assign, Publish, and Remove.

home PC - Manual

-

Automatic Updates
Function - Allows Windows XP free reign to contact the Microsoft servers and download a whole host of "critical" updates. No
thanks Bill, think I can connect to WindowsUpdate by myself

home PC - Disabled

-

Background Intelligent Transfer Service
Function - A sneaky way of doing Automatic Updates - Windows XP will judge whether you are using your bandwidth or just sat
there motionless looking at your screen. If not it will happily download away.

home PC - Disabled

-

ClipBook
Function - "exactly what it says on the tin"
Why do you want to share your random cut'n'pastes with your fellow LAN chums? If you feel this is an important contribution to your life leave it on Manual. Otherwise kill this resource eating service!

home PC - Disabled

-

COM+ Event System
Function - Kind of like a communication method between different modules in Windows.

home PC - Manual

-

COM+ System Application
Function - If COM+ Event System is the car then this service is the driver

home PC - Manual

-

Computer Browser
Function - Like it says, needed to keep tracks of computers on your network. If you're on a LAN, leave it to manual, if you're a standalone system then disable it.

home PC - Disabled

-

Cryptographic Services
Function - Among other things, this service authenticates WHQL drivers (i.e. for graphics cards)

home PC - Manual

-

DHCP Client
Function - Under Windows managed networks DCHP is useful in assigning IP/DNS addresses.

home PC - Manual

-

Distributed Link Tracking Client
Function - Good for databases that rely on networked files for updating. Do you share files that lots of people work on? Do you even use NTFS as a home user?

home PC - Disabled

-

Distributed Transaction Coordinator
Function - Related to Distributed Link Tracking Client
The service sounds like a job title for a pointless middle manager somewhere. For home users it's the same story for our
Distributed Transaction Coordinator; going nowhere fast.

home PC - Disabled

-

DNS Client
Function - Needed by windows

home PC - Automatic

-

Error Reporting Service
Function - When something crashes (quite frequently) and Windows pops up and advises you to tell Microsoft all about it,
that is the fruit of this service's loins. One of my pet hates, If something crashes I will scream at the monitor and stamp my feet as I please; I don't need to tell Microsoft that I'm doing it.

home PC - Disabled

-

Event Log
Function - Exactly what it says on the tin

home PC - Manual

-

Fast User Switching Compatibility
Function - For home users this functions as "switch user" when the logoff option is used. If you want it you can have it.

home PC - Manual

-

Help and Support
Function - Description is self-explanitory

home PC - Disabled

-

Human Interface Device Access
Function - allows you to use a usb mouse/keyboard in Windows. If you have one set this to automatic

home PC - Disabled

-

IMAPI CD-Burning COM Service
Function - Controls the in-built CD-burning software in XP
If you don't use the in-built software then disable the service. Incidentally disabling this makes NERO Burning ROM open quicker.

home PC - Disabled

-

Indexing Service
Function - Works like an advanced search feature. This can search through files and index keywords for rapid searching.
Thanks, but no thanks. If I want to search I will use the "dog feature".

Recommended for home PC - Disabled

-

Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
Function - Related to Application Layer Gateway Service

home PC - Disabled

-

IPSEC Services
Function - Authenticates hosts before transfer of data, Encryption of IP traffic, Prevention of reply attacks

home PC - Manual

-

Logical Disk Manager
Function - Updates records to do with hard disk volumes.

home PC - Automatic

-

Logical Disk Manager Administrative Service
Function - Related to Logical Disk Manager it is infrequently used

home PC - Manual

-

Messenger
Function - Allows network administrators the ability to pop a little prompt on your screen with information. Although hilarious for the first 25 seconds in forcing your non-computer literate friends to think their machine has been hacked into this service is pretty much pointless.

home PC - Disabled

-

MS Software Shadow Copy Provider
Function - Like the man said, it allows shadow copying.

home PC - Disabled

-

Net Logon
Function - Domain Authentication, if you have a Domain

home PC - Disabled

-

NetMeeting Remote Desktop Sharing
Function - Why use the bloated netmeeting when VNC does it about 10 times faster and is free?

Recommended for home PC - Disabled

-

Network Connections
Function - Controls your internet connection details basically.

home PC - Manual

-

Network DDE
Function - DDE functions are usually restricted to business applications.

home PC - Disabled

-

Network DDE DSDM
Function - Related to Network DDE

home PC - Disabled

-

Network Location Awareness (NLA)
Function - Installation of some hardware requires usage of RPC.

home PC - Manual

-

NVIDIA Driver Helper Service
Function - Provides help and support for NVIDIA graphics cards. Disabling this service seems to significantly reduce the time Windows XP takes to shut down.

home PC - Disabled

-

Performance Logs and Alerts
Function - Hardly useful for a home PC now is it? Unless they start assigning the equivalent of 3DMarks I doubt anyone is really interested.

home PC - Disabled

-

Plug and Play
Function - Commonly referred to as Plug'n'Pray this service is perhaps one feature of Windows XP worth having.

home PC - Automatic

-

Portable Media Serial Number
Function - Quite possibly the most pointless and utterly useless service known to human kind. Why memory is allocated to the
retrieval of a needless serial number from your MP3 player is beyond me and I'm sure it's a joke.

home PC - Disabled

-

Print Spooler
Function - A must if you have a printer

home PC - Manual

-

Protected Storage
Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users.
Function - Stop those 1337 h4X0)2 skr1p7 |<1dd135 knocking around with your files. Trouble is, if they are already past your firewall you've had it anyway. Leave on Manual just in case.

home PC - Manual

-

QoS RSVP
Function - Quality Of Service - quite useful for services that use it used for network balancing and other nifty things to make "your internet experience as wonderful as possible". Quite good then that this service eats 25% of your bandwidth doing it and hardly anything actually makes use of it.

home PC - Disabled

-

Remote Access Auto Connection Manager
Function - Makes use of embedded links in programs such as Office, also is used in autodial functions

home PC - Manual

-

Remote Access Connection Manager
Function - Involved in dial-up.

home PC - Manual

-

Remote Desktop Help Session Manager
Function - Allows incoming Remote Desktop connections.
If you don't use this feature of Windows XP (Remote Desktop) then disable this service.

home PC - Disabled

-

Remote Procedure Call (RPC)
Function - Needed for some installations nice vague Microsoft description. Leave as manual.

home PC - Manual

-

Remote Procedure Call (RPC) Locator
Function - Related to Remote Procedure Call (RPC)

home PC - Manual

-

Remote Registry
Function - Allow people to modify local registry settings via remote desktop or similar. Allowing your registry to be edited remotely? Come on....

home PC - Disabled

-

Removable Storage
Function - Zip Drives, USB pens etc...

home PC - Manual

-

Routing and Remote Access
Function - used on business networks

home PC - Disabled

-

Secondary Logon
Function - allow multiple users on one machine.

home PC - Automatic

-

Security Accounts Manager
Function - Related to Secondary Logon

home PC - Automatic

-

Server
Function - Supports file sharing and other basic LAN functions.
If you're not on a network you don't need this.

home PC - Disabled

-

Smart Card
Function - If you don't use smart media, disable this service.

home PC - Disabled

-

Smart Card Helper
Function - Related to Smart Card

home PC - Disabled

-

SSDP Discovery Service
Function - UPnP = Universal Plug'n'Play If you don't have a LAN then disable this service.

home PC - Disabled

-

System Event Notification
Function - Can notify programs such as Outlook when an internet connection is established so that it can send its mail. This service manages a lot of processes

home PC - Automatic

-

System Restore Service
Function - Allows "rollback" to previous configurations in order to solve hardware/software problems.

home PC - Automatic

-

Task Scheduler
Function - Depends on the individual. Task Scheduler uses a fair amount of resources. Any program I wish to run, I run when I want, not at 4.37am on a Friday morning.

home PC - Disabled

-

TCP/IP NetBIOS Helper
Function - Helper for Internet traffic. Useful if you're fascinated by the intrinsic features of TCP/IP.

home PC - Disabled

-

Telephony
Function - it starts when a connection is made to the internet.

home PC - Manual

-

Telnet
Function - Big Security Hole - If you're not on a LAN this is well worth disabling to bounce those 13 year old hackers.

home PC - Disabled

-

Terminal Services
Function - Remote Desktop features.If you disabled Remote Desktop earlier then do the same with this.

home PC - Disabled

-

Themes
Function - Most people use the themes

home PC - Automatic

-

Uninterruptible Power Supply
Function - Most users (unless you live in California) do not have UPS backups.

home PC - Disabled

-

Universal Plug and Play Device Host
Function - You'll need this

home PC - Manual

-

Upload Manager
Function - Fundemental to Windows

home PC - Automatic

-

Volume Shadow Copy
Function - Set the same as MS Software Shadow Copy Provider

home PC - Disabled

-

WebClient
Function - Fundemental to Windows

For home PC - Automatic

-

Windows Audio
Function - Fundemental to Windows

home PC - Automatic

-

Windows Image Acquisition (WIA)
Function - In-built scanner and camera features.If you don't have a scanner/camera then disable this service. Also if you use a 3rd party image aquisition program then disable this.

home PC - Disabled

-

Windows Management Instrumentation
Function - Fundemental to Windows

home PC - Automatic

-

Windows Management Instrumentation Driver Extensions
Function - Fundemental to Windows

home PC - Automatic

-

Windows Time
Function - Fine if you need to have exactly the same time as the administrator on your network

home PC - Disabled

-

Windows Zero Configuration
Function - Wireless networking auto-configuration Wireless unless you have wireless having this resident in memory is
pointless.

home PC - Disabled

-

WMI Performance Adapter
Function - Provides information about your system to system components that require it.

home PC - Manual

-

Workstation
Function - Needed by Windows to provide functionality on the internet.

home PC - Automatic
__________________
If you argue with an idiot he will drag you down to his level and beat you with experience.

I am not a fast writer.
I am not a slow writer.
I am a half-fast writer.

-Robert Asprin
killians45 is offline  
Old 04-12-2004, 09:14 PM   #10 (permalink)
Wizard Techie
 
Join Date: Apr 2004
Posts: 3,247
Default

ps can't take credit for going through all that... would give credit to whomever but forgot who it is. I just cut and paste, as it would be easier. I know what to disable and not, anyhow, but its quicker if someone else has already done the research
__________________

__________________
If you argue with an idiot he will drag you down to his level and beat you with experience.

I am not a fast writer.
I am not a slow writer.
I am a half-fast writer.

-Robert Asprin
killians45 is offline  
Closed Thread

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off




Copyright 2002- Social Knowledge, LLC All Rights Reserved.

All times are GMT -5. The time now is 12:29 AM.


Powered by vBulletin® Version 3.8.8 Beta 1
Copyright ©2000 - 2017, vBulletin Solutions, Inc.