Lsass exe running

This tool uses performance counters and tracing to monitor the issue. Then it compiles a report that shows details of potential problems. These problems need to be investigated as possible causes. View the report or reports that have been completed. The report contains eight broad categories under Diagnostic Results that will contain information and conclusions in the report. It won't always tell the exact cause of the problem. But you can use it to determine where to investigate to find the exact cause.

When facing high CPU usage by Lsass. It shows general performance concerns. Also examine the Active Directory category. I updated my virus database and doing full scan now. To update my Virus database i tethered my phone to the server for an internet connection.

The lsass data did not start on this connection, only the lan to cable modem connection. Scan is going to take hours so am letting my network off the internet for the night and hoping the scanner finds something upon my return in the morning. Obviously i can't kill lsass so i have isolated the network temporarily.

I'm assuming I've been compromised somehow. Everything i googled is more talking about lsass. What antivirus and malware solutions do you have on the server.

Do you have support teams for the same? Please remember to mark the replies as answers if they help. If you have feedback for TechNet Subscriber Support, contact tnmff microsoft. I am checking how the issue is going, if you still have any questions, please feel free to contact us.

And if the replies as above are helpful, we would appreciate you to mark them as answers, and if you resolve it using your own solution, please share your experience and solution here. It will be greatly helpful to others who have the same question. I have the similar problem. It seems waste time to restrict the IPs. We are having the same problem on our R2 server and as we have a limited bandwith internet connection, it is using up all our bandwith and causing ping response times of msec.

I had the same problem on a Windows server Office Office Exchange Server. Not an IT pro? Resources for IT Professionals.

Sign in. United States English. Ask a question. Quick access. See steps below for additional information about cleaning the computer from this file. When attempting to End Task lsass. If your computer continuously reboots because of the lsass. If you need to reboot the computer because of updates that were installed on your computer, it's ok to reboot the computer.

However, you may need to run shutdown -a again to prevent the computer from automatically restarting again. If you're unable to open any of Microsoft's pages, Windows update pages, or antivirus protection pages, likely the Sasser worm has modified your lmhosts hosts file.

Follow the steps below to edit and verify this file has not been modified.