lsass.exe high cpu, Error 18456

We just migrated to a new sql server with SQL Server 2005 installed (we moved from 2000).

We are experiencing two issues that we cannot resolve:

1. The site and database clients that use this SQL Server run very slow now. We have noticed that the lsass.exe process consistantly uses 25% CPU, +/- 10%. When we stop SQL server the lsass.exe process goes down to 0. What can be causing this? The website uses a SQL user account, not a windows user account.

2. We have an error in the event log that might be related to the issue above. It appears every few minutes:

Event Type: Failure Audit
Event Source: MSSQLSERVER
Event Category: (4)
Event ID: 18456
Date: 10/25/2006
Time: 11:54:42 AM
User: NT AUTHORITY\SYSTEM
Computer: MSDB
Description:
Login failed for user 'NT AUTHORITY\SYSTEM'. [CLIENT: <local machine>]

The error log from SQL gives more info:

Error: 18456, Severity: 14, State: 16.

What is causing this? How can this be traced?

I am stuck here. All help greatly appreciated.

Moshe

I'm not sure about the lsass.exe process, but here is a good blog from the SQL Protocols team about the failure error messages.

http://blogs.msdn.com/sql_protocols/archive/2006/02/21/536201.aspx

Thanks,
Sam Lester (MSFT)

|||

I have seen that blog, but it did not help me. I will post there anyway though.

Please advise, this is a serious issue.

|||

I may also add that I have not yet ungraded to Service Pack 1. Are their any known issues related to this that were fixed with Service Pack 1? I would only upgrade now if you were confident that upgrading would fix the issue since the server is now deployed.

|||People, including me, have also seen high CPU usage by lsass.exe when signing into Windows Live Messenger (and possibly earlier versions of Messenger).|||I have the same problem, everytime that I open messenger live the cpu goes high, lsass.exe take all my cpu...

have you find something to fix the problem?

regards,|||I reformatted the machine that resolved the issue. Microsoft PSS was not helpful in this and could not uncover the cause of the issue.