• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1946
  • Last Modified:

WHY? -> The lsass.exe process is allocating more memory than usual.


I've had an SBS 2003 server running now for 6 years and just recently (couple weeks ago) I started getting the following alerts a few times a week:

The lsass.exe process is allocating more memory than usual.

Use Task Manager to view the top processes by CPU or memory usage. If a service or process appears to be using an unusual amount of resources, try stopping and then restarting it.

You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting taskpad.

I've read some other postings on EE that I can avoid these alerts by changing my alert settings. However, I would like to know (if it's possible) as to why I've started to receive these alerts now when for the past 5+ years I never saw one of these alerts.

I have not installed any new software or applications nor hardware. Aside from Microsoft updates, the server is pretty much identical to day one install.

If there is any other info I can provide please ask, screen shots, etc.

Thank you.
  • 2
3 Solutions

You can read this

Memory usage by the Lsass.exe process on domain controllers that are running Windows Server 2003 or Windows 2000 Server
In short:

"Memory usage increases with Active Directory use
The amount of memory that the Lsass.exe process uses increases in accordance with Active Directory usage. When data is queried, it is cached in memory. "

In long:

If the number is way unreasonable you may have a problem.  If it is just marginally higher it may just be caches getting bigger.  Take a look at other metrics of usage and see if there's an increas..if you are monitoring that.

emgee11Author Commented:
I updated the alert setting with a larger value than what was there initially, and no more alerts. I suppose it simply has increased. Have not noticed any other issues or problems related to this.
emgee11Author Commented:
In order to eliminate the alerts I increased the memory threshold before an alert is issued.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now