LSASS Process Monitor Monitor

Operational States

Parameter Name	Default Value	Description	Override
Interval (sec)	300
Timeout	300	Time out in Sec
Process Utilization Threshold (percent)	80
Number of samples to use when calculating the LSASS CPU utilization	10

Monitor State	Message	Priority	Severity	Auto Resolution
LSASS Process Monitor Error (Error)	The LSASS process has exceeded the processor utilization threshold over multiple samples.	Medium	Critical	Yes

Name

Default

Summary

LSASS Process Monitor. The core process (lsass.exe) for Active Directory Domain Services is consuming a lot of CPU resources.

If the overall CPU utilization on the server is too high, users and services that rely on Active Directory Domain Services may experience delays.

Causes

Possible causes include the following:

The domain controller needs resizing.
The domain controller is a bridgehead server, and it is compressing large amounts of data because a bulk load must be replicated intersite.
The domain controller is a primary domain controller (PDC) emulator operations master, and there are either a large number of password lockouts or a large number of expired user accounts.
One or more other domain controllers failed, and their load transferred to this domain controller because it is now the closest available domain controller.
An application is placing a heavy load on the domain controller. This is usually caused by inefficient, CPU-intensive operations such as non-indexed queries.
The domain controller is critically low on memory.
The domain controller is under a denial-of-service attack.

Resolutions

View the overall system performance of the machine to determine if it needs additional resources.

Add additional domain controllers to help load-balance the load.

Ensure that there are a sufficient number of DCs in the active AD sites.

External References