Chat now with support
Chat with Support

Active Administrator 8.4 - Web Console User Guide

Active Administrator Web Console Overview Active Directory Health Alerts Notifications Active Directory Health Check
Using the Health Check landing page Creating a Health Check Setting options for Health Check tests Health check tests
Forest tests Domain tests Domain controller tests Site tests
Active Directory Topology Reports Network Operations Center

LSASS % processor time

Indicates that the CPU for the Local Security Authority Service (LSASS) service on the domain controller is too busy, which can indicate a problem with directory service.

Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
Required permissions: When monitored locally and remotely, only domain user privilege is required and the user must be a part of the Performance Logs user group.

Tests the Process(lsass)\% Processor Time performance counter on the domain controller for the LSASS service to see if the value of the performance counter goes above the configured threshold for a period exceeding the configured duration.

Please refer to the documents listed below for resolutions when Lsass.exe causes high CPU usage.

LSASS private bytes

Indicates that the virtual memory used for Local Security Authority Service (LSASS) on the domain controller is above the preset threshold.

The amount of memory used for LSASS varies depending on the load of the computer. As the number of running threads increases, so does the number of memory stacks. Lsass.exe usually uses 100 MB to 300 MB of memory. Lsass.exe uses the same amount of memory no matter how much RAM is installed in the computer. However, when a larger amount of RAM is installed, Lsass.exe can use more RAM and less virtual memory.

Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
Required permissions: When monitored locally and remotely, only domain user privilege is required and the user must be a part of the Performance Logs user group.

Tests the Process(lsass)\Virtual Memory performance counter on the domain controller for the lsass service to see if the value in the performance counter goes above the configured threshold for a period exceeding the configured duration.

This situation can occur when event tracing for Security Accounts Manager (SAM) events is enabled. When event tracing for SAM events is enabled, the remote procedure call (RPC) binding is not released. Therefore, a memory leak occurs in the Lsass.exe process.

Please refer to the Microsoft knowledge base articles listed below.

LSASS working set

Indicates that the working set memory used for Local Security Authority Service (LSASS) on the domain controller is above the preset threshold.

The amount of memory used for Lsass varies depending on the computer’s load. As the number of running threads increases, so does the number of memory stacks. Lsass.exe usually uses 100 MB to 300 MB of memory. Lsass.exe uses the same amount of memory no matter how much RAM is installed in the computer. However, when a larger amount of RAM is installed, Lsass.exe can use more RAM and less virtual memory.

Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
Required permissions: When monitored locally and remotely, only domain user privilege is required and the user must be part of the Performance Logs user group.

Tests the Process(lsass)\Working Set performance counter (corresponding to Mem Usage from Task Manager) on the domain controller for Lsass to see if the value in the performance counter goes above the configured threshold for a period exceeding the configured duration.

It is also possible that the number of bytes allocated to the working set has increased to some pathological condition in a particular application.

Please refer to the Microsoft knowledge base articles listed below.

Memory details

Information only. Indicates total, free, and used physical and virtual memory.

Related Documents