Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1925
  • Last Modified:

WHY? -> The lsass.exe process is allocating more memory than usual.


I've had an SBS 2003 server running now for 6 years and just recently (couple weeks ago) I started getting the following alerts a few times a week:

The lsass.exe process is allocating more memory than usual.

Use Task Manager to view the top processes by CPU or memory usage. If a service or process appears to be using an unusual amount of resources, try stopping and then restarting it.

You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

I've read some other postings on EE that I can avoid these alerts by changing my alert settings. However, I would like to know (if it's possible) as to why I've started to receive these alerts now when for the past 5+ years I never saw one of these alerts.

I have not installed any new software or applications nor hardware. Aside from Microsoft updates, the server is pretty much identical to day one install.

If there is any other info I can provide please ask, screen shots, etc.

Thank you.
  • 2
3 Solutions

You can read this

Memory usage by the Lsass.exe process on domain controllers that are running Windows Server 2003 or Windows 2000 Server
In short:

"Memory usage increases with Active Directory use
The amount of memory that the Lsass.exe process uses increases in accordance with Active Directory usage. When data is queried, it is cached in memory. "

In long:

If the number is way unreasonable you may have a problem.  If it is just marginally higher it may just be caches getting bigger.  Take a look at other metrics of usage and see if there's an increas..if you are monitoring that.

emgee11Author Commented:
I updated the alert setting with a larger value than what was there initially, and no more alerts. I suppose it simply has increased. Have not noticed any other issues or problems related to this.
emgee11Author Commented:
In order to eliminate the alerts I increased the memory threshold before an alert is issued.

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now