Re: lsass.exe in CPU loop when logging in

I have run into the *exact* same problem, Stewart. I copied about 10GB
of data from one machine to another. The data on the original machine
was encrypted; when I attempted to copy the data, Windows warned me the
encryption would be lost on the destination machine. I chose "ignore
all," and allowed the copy to continue. Once I rebooted the
destination machine, I began getting LSASS taking up 99% of CPU
resources immediately after boot-up for about 10 minutes. Since the
destination was, in this case, a laptop, it causes a major drain on the
battery for these 10 minutes. Even after I've removed the 10GB of
files from the laptop that I had copied, LSASS still consumes my
processor as though its trying to "figure something out." I also watch
with dread as my commit charge increases at about 100kb per second from
200MB at bootup to about 330MB once LSASS finishes whatever it's doing.
The charge then levels off, so I KNOW it is LSASS causing the problem,
even though windows lists its memory usage in Task Manager as
unchanging.

If ANYONE (especially a True Microsoft Tech, not one of these Microsoft
"Certified" Impostors who seem to have no real solutions for anything
besides spewing advice about AdAware and Norton Antivirus) has
encountered this problem and knows the solution, I would greatly
appreciate it if they would share it with the rest of the world. I'll
tell you right here and now that System Event Logs show nothing
strange. I have no viruses. I have no worms. I have no adware. Just
because 90% of computer users don't know how to maintain a Windows XP
system properly doesn't mean people such as Stewart and myself do not.
Don't insult our intelligence with further finger-pointing at obviously
implausible causes of this problem. A real solution is what I think we
both want... My laptop battery will thank you for it later. :-)

Kevin

Stewart Berman wrote:
It appears to be a bug in Microsoft's security system startup that is somehow triggered by moving an
encrypted file to another machine on a network and decrypt it as part of the move. I suspect it is
a problem with either some attribute settings or with one of the alternative data streams.
lsass.exe is obviously trying to understand or repair the status of the files and takes ten minutes
before finally giving up.

While it may appear that the problem is affected by group membership it is actually single user
specific. Only a user who has transferred encrypted files to an unencrypted machine is affected.

I am looking for someone that has seen the problem and actually has a solution to it. I appreciate
you are trying to be helpfully but it is clear you have not seen the problem nor do you have any
knowledge of a solution. While doing the obvious things like checking the system logs and scanning
for viruses and mal wear only wastes time resetting security settings to their defaults could bring
my system to a halt. (Although I am running on a home LAN, I am running enterprise level firewall
and virus checking software and they get very upset if their settings are changed from those set by
the global engineering team.)

Stu


"Steven L Umbach" <n9rou@xxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

Look in the system/application logs that you can see via Event Viewer to see
if any failure/warnings are shown at the time that the user is trying to
logon. If you find any you can search Google or use http://www.eventid.net
to find more information about the event and possible solution. Also try
booting into Safe Mode as the user to see what happens. Since it seems to be
based on group membership it sounds as if the less privileged users may have
a lack or permission to something critical. You could try using secedit as
described in the link below to reset security settings back to default
defined levels to see if that helps or not. It is a long command but you can
simply copy and paste it into a command prompt. I would also do full scans
for malware and spyware using late definitions for anything you use and also
scan in Safe Mode. AdAware SE is an excellent free for personal user spyware
program if you do not currently have one. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;EN-US;313222
http://www.lavasoftusa.com/software/adaware/ --- AdAware SE

"Stewart Berman" <sabmsdn@xxxxxxxxxxxx> wrote in message
news:h5cet15sppa79k04f9oll7gbg3ikkf6jsn@xxxxxxxxxx
I have a Windows XP Pro SP2 Workstation. If I log in as an administrator
it behaves normally. If I
login as a non administrator power user the system seems to hang. Task
Manager shows lsass.exe at
between 92% and 97% CPU. This continues for several minutes and then
stops.

I find a posting from about a year ago via Google that describes my
situation (see below).
Unfortunately, it did not have a response.

How do I fix the problem?

Stu

**********************************************************
Jun 9 2005, 2:35 am show options

Newsgroups: microsoft.public.windowsxp.security_admin
From: test1234567 <test1234567.1qc...@xxxxxxxxxxxxxxxxxxxxxxxxxxxx> - Find
messages by this author
Date: Thu, 9 Jun 2005 02:35:50 -0500
Local: Thurs, Jun 9 2005 2:35 am
Subject: Re: LSASS.EXE process consuming 100% CPU time
Reply to Author | Forward | Print | Individual Message | Show original |
Report Abuse

I have the same problem with two computers runnin XP

The problem starts appearing under these conditions:

- You try to copy an EFS (windows encryted) file from one computer to
the other target computer using a (home) LAN connection.

- The system warns you that the file cannot be copied unless the
encryption is removed. You select 'Ignore All' button in the encryption
dialog box.

- The file starts being copied to the targed computer (in both cases I
had also EFS active in the targed computer user profile). I noted that
during this time the processor works high only on the target computer
(may be the decryption is done there?!!)

- After the file ends beeing copied, everything seems ok.

- However, the next time you (re)start the target computer, and login
to that profile, LSASS goes to nearly 100% of CPU usage for a few
minutes. In a Pentium III 466MHz this takes about 10 minutes. In a
Centrino Mobile processor of 1.5 GHz this takes about 1 minute. After
this everything goes well.

- This happen then every time you loggin to the same user profile in
the target computer. The problem does not show for the other user
accounts (profiles).

- The source computer where the EFS file originated is not affected at
all by this problem.
**********************************************************



.

Quantcast