LSASS excessive CPU usage

  • Thread starter Thread starter Todd hobdey
  • Start date Start date
T

Todd hobdey

In my forest root domain I've got 3 domain controllers and an Exchange 2000
server (1900 mailboxes), all running in their respective native modes. This
week one of the DCs has been acting weird. For a while in the morning LSASS
will spike the CPU for 30 seconds, cool down for 60 seconds and cycle this
way for an hour or so. The other two DCs aren't doing this.

KB Article 811172 looked promising if I change "minutes" to "seconds", but
even then the problem described isn't applicable.

Anyone know how I can sleuth this further or perhaps have seen it before?
 
Use the event log to see whats happening during the spike, check
REPMON to make sure that replication is proceeding normally. if you
still cant find it monitor the NIC traffic with ethereal or something,
see whats talking to it. Someone may be trying to hack it.
 
Back
Top