LSASS.EXE high CPU usage

I have a web/SQL server (Win2k3sp1, SQL2005) currently experiencing a serious
problem.
Regularly throughout the day, the LSASS.EXE process jumps from <2% CPU usage
to 50-70% CPU, sometime for 30 seconds, sometimes as long as 30 minutes. The
consequence of course being that the server goes to a constant 100% CPU
usage, causing services to be denied or be unacceptably slow. During normal
operation (when LSASS is behaving), the server spec is more than enough to
cope with it's workload, and runs at around 20% CPU usage.
There were issues with LSASS.EXE in Win2k, but none that I know of or can
find in Win2k3. This is not a SASSER type worm virus, it's genuine LSASS.EXE.
I'm not even sure if this is the cause of the problem or a symptom of
something else.
Please suggest something, this is a critical production server and this has
now become a serious issue.
Thanks.
Could you check in your eventLog and see if there are repeated error
messages , particuarly in Directory Services Log?
Jack Vamvas
__________________________________________________ ________________
Receive free SQL tips - register at www.ciquery.com/sqlserver.htm
SQL Server Performance Audit - check www.ciquery.com/sqlserver_audit.htm
New article by Jack Vamvas - SQL and Markov Chains -
www.ciquery.com/articles/art_04.asp
"The Vogon" <TheVogon@.discussions.microsoft.com> wrote in message
news:0CB0C2E5-4AC5-4F71-B7D7-16180F368002@.microsoft.com...
> I have a web/SQL server (Win2k3sp1, SQL2005) currently experiencing a
serious
> problem.
> Regularly throughout the day, the LSASS.EXE process jumps from <2% CPU
usage
> to 50-70% CPU, sometime for 30 seconds, sometimes as long as 30 minutes.
The
> consequence of course being that the server goes to a constant 100% CPU
> usage, causing services to be denied or be unacceptably slow. During
normal
> operation (when LSASS is behaving), the server spec is more than enough to
> cope with it's workload, and runs at around 20% CPU usage.
> There were issues with LSASS.EXE in Win2k, but none that I know of or can
> find in Win2k3. This is not a SASSER type worm virus, it's genuine
LSASS.EXE.
> I'm not even sure if this is the cause of the problem or a symptom of
> something else.
> Please suggest something, this is a critical production server and this
has
> now become a serious issue.
> Thanks.
>
|||Thanks for the reply...
There are no errors regarding this in the log files, no out of the ordinary
errors or warnings are generated. Incidentally, the server is not a Domain
Controller so no DS logs.
"Jack Vamvas" wrote:

> Could you check in your eventLog and see if there are repeated error
> messages , particuarly in Directory Services Log?
> --
> Jack Vamvas
> __________________________________________________ ________________
> Receive free SQL tips - register at www.ciquery.com/sqlserver.htm
> SQL Server Performance Audit - check www.ciquery.com/sqlserver_audit.htm
> New article by Jack Vamvas - SQL and Markov Chains -
> www.ciquery.com/articles/art_04.asp
> "The Vogon" <TheVogon@.discussions.microsoft.com> wrote in message
> news:0CB0C2E5-4AC5-4F71-B7D7-16180F368002@.microsoft.com...
> serious
> usage
> The
> normal
> LSASS.EXE.
> has
>
>