We experience sporadic high LSASS threads on our 3 DCs. Running perfmon does not help much because the incidents are sporadic. Should I just let perfmon run without stopping it? Is there a way to do this without sacrificing the space on the server? On a side note, I ran poolmon and saw that MFEO driver is the top (and has a significant high non paged allocation compared to the rest). And after digging firther, that driver is linked to McAfee. Can someone please advise what is the best way to tackle this issue?