LSASS Process Monitor. The core process (lsass.exe) for Active Directory Domain Services is consuming a lot of CPU resources.

If the overall CPU utilization on the server is too high, users and services that rely on Active Directory Domain Services may experience delays.

Possible causes include the following:

• The domain controller needs resizing.

• The domain controller is a bridgehead server, and it is compressing large amounts of data because a bulk load must be replicated inter-site.

• The domain controller is a primary domain controller (PDC) emulator operations master, and there are either a large number of password lockouts or a large number of expired user accounts.

• One or more other domain controllers failed, and their load transferred to this domain controller because it is now the closest available domain controller.

• An application is placing a heavy load on the domain controller. This is usually caused by inefficient, CPU-intensive operations such as non-indexed queries.

• The domain controller is critically low on memory.

• The domain controller is under a denial-of-service attack.

View the overall system performance of the machine to determine if it needs additional resources.

Add additional domain controllers to help load-balance the load.

Ensure that there are a sufficient number of DCs in the active AD sites.

• Capacity Planning for Active Directory Domain Services