Re: lsass.exe in CPU loop when logging in

It appears to be a bug in Microsoft's security system startup that is somehow triggered by moving an
encrypted file to another machine on a network and decrypt it as part of the move. I suspect it is
a problem with either some attribute settings or with one of the alternative data streams.
lsass.exe is obviously trying to understand or repair the status of the files and takes ten minutes
before finally giving up.

While it may appear that the problem is affected by group membership it is actually single user
specific. Only a user who has transferred encrypted files to an unencrypted machine is affected.

I am looking for someone that has seen the problem and actually has a solution to it. I appreciate
you are trying to be helpfully but it is clear you have not seen the problem nor do you have any
knowledge of a solution. While doing the obvious things like checking the system logs and scanning
for viruses and mal wear only wastes time resetting security settings to their defaults could bring
my system to a halt. (Although I am running on a home LAN, I am running enterprise level firewall
and virus checking software and they get very upset if their settings are changed from those set by
the global engineering team.)

Stu


"Steven L Umbach" <n9rou@xxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

Look in the system/application logs that you can see via Event Viewer to see
if any failure/warnings are shown at the time that the user is trying to
logon. If you find any you can search Google or use http://www.eventid.net
to find more information about the event and possible solution. Also try
booting into Safe Mode as the user to see what happens. Since it seems to be
based on group membership it sounds as if the less privileged users may have
a lack or permission to something critical. You could try using secedit as
described in the link below to reset security settings back to default
defined levels to see if that helps or not. It is a long command but you can
simply copy and paste it into a command prompt. I would also do full scans
for malware and spyware using late definitions for anything you use and also
scan in Safe Mode. AdAware SE is an excellent free for personal user spyware
program if you do not currently have one. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;EN-US;313222
http://www.lavasoftusa.com/software/adaware/ --- AdAware SE

"Stewart Berman" <sabmsdn@xxxxxxxxxxxx> wrote in message
news:h5cet15sppa79k04f9oll7gbg3ikkf6jsn@xxxxxxxxxx
I have a Windows XP Pro SP2 Workstation. If I log in as an administrator
it behaves normally. If I
login as a non administrator power user the system seems to hang. Task
Manager shows lsass.exe at
between 92% and 97% CPU. This continues for several minutes and then
stops.

I find a posting from about a year ago via Google that describes my
situation (see below).
Unfortunately, it did not have a response.

How do I fix the problem?

Stu

**********************************************************
Jun 9 2005, 2:35 am show options

Newsgroups: microsoft.public.windowsxp.security_admin
From: test1234567 <test1234567.1qc...@xxxxxxxxxxxxxxxxxxxxxxxxxxxx> - Find
messages by this author
Date: Thu, 9 Jun 2005 02:35:50 -0500
Local: Thurs, Jun 9 2005 2:35 am
Subject: Re: LSASS.EXE process consuming 100% CPU time
Reply to Author | Forward | Print | Individual Message | Show original |
Report Abuse

I have the same problem with two computers runnin XP

The problem starts appearing under these conditions:

- You try to copy an EFS (windows encryted) file from one computer to
the other target computer using a (home) LAN connection.

- The system warns you that the file cannot be copied unless the
encryption is removed. You select 'Ignore All' button in the encryption
dialog box.

- The file starts being copied to the targed computer (in both cases I
had also EFS active in the targed computer user profile). I noted that
during this time the processor works high only on the target computer
(may be the decryption is done there?!!)

- After the file ends beeing copied, everything seems ok.

- However, the next time you (re)start the target computer, and login
to that profile, LSASS goes to nearly 100% of CPU usage for a few
minutes. In a Pentium III 466MHz this takes about 10 minutes. In a
Centrino Mobile processor of 1.5 GHz this takes about 1 minute. After
this everything goes well.

- This happen then every time you loggin to the same user profile in
the target computer. The problem does not show for the other user
accounts (profiles).

- The source computer where the EFS file originated is not affected at
all by this problem.
**********************************************************



.