Active Administrator 8.6.3 - Web Console User Guide

Required permissions: When monitored locally, only domain user privilege is required. When monitored remotely, domain administrator privilege is required.

Description

This test checks if KDC service is running.

Resolution

Use the Services MCC snap-in or another SCP application to restart the KDC service.

LDAP response time

Indicates that the response time of the domain controller to a Lightweight Directory Access Protocol (LDAP) request equals or exceeds the configured threshold.

Category

•

General

Requirements

•

Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019

•

Required permissions: When monitored locally and remotely, only domain user privilege is required.

Description

Active Directory® clients use LDAP to communicate with the Directory Service Agent (DSA). A high response time value indicates that the domain controller is not satisfying directory requests quickly, which can result in poor client response times and, if bad enough, login and authentication failures.

Anything that could cause a reduction in overall system performance can increase LDAP response time. For instance, running too many processes, or running processes that use too much memory or CPU can reduce system performance and increase LDAP response times.

A poorly configured server can also increase LDAP response times. For instance, if the paging file is not large enough or if the disks are badly fragmented, poor disk performance can increase LDAP response time.

In some cases faulty hardware can also cause an increase in LDAP response time. For instance, a marginal Network Interface Card (NIC) can reduce network performance on the server, and a failing disk can make directory queries take a long time.

It is possible that the DSA on the domain controller is overloaded by incoming directory requests, by excessive Access Control List (ACL) propagation, or by too many complex directory queries.

Resolution

•

Determine if anything is degrading overall system performance, or if just Active Directory performance is poor.

•

Check the LDAP load on the server. If this is high, try to identify the traffic that is causing the LDAP load on the server.

•

Determine what processes are using the most CPU and generating the most disk I/O.

•

If a single process is generating most of the load, see if that process can be run on a different server.

•

If there are many processes using a significant amount of system resources, try to remove several of them.

•

If Local Security Authority Subsystem Service (LSASS) is using more than its share of server resources, then something is overloading the DSA.

Logic disk details

Information only. Lists the disk name, total disk size, amount of free space, percentage of used space, and whether or not the disk is compressed.

Category

•

General

LSASS % processor time

Indicates that the CPU for the Local Security Authority Service (LSASS) service on the domain controller is too busy, which can indicate a problem with directory service.

Category

•

Performance counters

Requirements

•

Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019

•

Required permissions: When monitored locally and remotely, only domain user privilege is required and the user must be a part of the Performance Logs user group.

Description

Tests the Process(lsass)\% Processor Time performance counter on the domain controller for the LSASS service to see if the value of the performance counter goes above the configured threshold for a period exceeding the configured duration.

Resolution

Please refer to the documents listed below for resolutions when Lsass.exe causes high CPU usage.

•

Troubleshooting High CPU Usage on a Domain Controller