WHY? -> The lsass.exe process is allocating more memory than usual.

Posted on 2011-05-05
Last Modified: 2012-05-11

I've had an SBS 2003 server running now for 6 years and just recently (couple weeks ago) I started getting the following alerts a few times a week:

The lsass.exe process is allocating more memory than usual.

Use Task Manager to view the top processes by CPU or memory usage. If a service or process appears to be using an unusual amount of resources, try stopping and then restarting it.

You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

I've read some other postings on EE that I can avoid these alerts by changing my alert settings. However, I would like to know (if it's possible) as to why I've started to receive these alerts now when for the past 5+ years I never saw one of these alerts.

I have not installed any new software or applications nor hardware. Aside from Microsoft updates, the server is pretty much identical to day one install.

If there is any other info I can provide please ask, screen shots, etc.

Thank you.
Question by:emgee11
    LVL 4

    Assisted Solution


    You can read this

    Memory usage by the Lsass.exe process on domain controllers that are running Windows Server 2003 or Windows 2000 Server
    LVL 5

    Assisted Solution

    In short:

    "Memory usage increases with Active Directory use
    The amount of memory that the Lsass.exe process uses increases in accordance with Active Directory usage. When data is queried, it is cached in memory. "

    In long:

    If the number is way unreasonable you may have a problem.  If it is just marginally higher it may just be caches getting bigger.  Take a look at other metrics of usage and see if there's an increas..if you are monitoring that.


    Accepted Solution

    I updated the alert setting with a larger value than what was there initially, and no more alerts. I suppose it simply has increased. Have not noticed any other issues or problems related to this.

    Author Closing Comment

    In order to eliminate the alerts I increased the memory threshold before an alert is issued.

    Featured Post

    PRTG Network Monitor: Intuitive Network Monitoring

    Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

    Join & Write a Comment

    Suggested Solutions

    Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
    You may have discovered the 'Compatibility View Settings' workaround for making your SBS 2008 Remote Web Workplace 'connect to a computer' section stops 'working around' after a Windows 10 client upgrade.  That can be fixed so it 'works around' agai…
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
    how to add IIS SMTP to handle application/Scanner relays into office 365.

    755 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now