Thursday, May 14, 2009

lsass.exe high CPU usage and disk I/O

One of my old computers has had a problem for YEARS.

Windows XP, service pack 2.

Within minutes of reboot, lsass.exe goes to near 100% CPU utilisation, and sits there for sometimes around half an hour.

Rendering the computer pretty much unusable.

ALL attempts to resolve the problem had failed.

And after wasting lots and lots of time, I resigned myself to simply hibernating not rebooting where possible, and losing half an hour of time every time I wanted to reboot the computer.

Killing lsass.exe fails, because the Task Manager informs you that it is a system process.

Trying to reduce its priority, so it hogs less CPU, fails for the same reason.

It is exactly the same file (same file size, and same file bytes - I used fc.exe to compare) as the lsass.exe on my other Windows XP computers - none of which exhibit this problem.

I haven't found a solution, but things have improved now.

1) Earlier today, based on comments I saw on one website, I went into the properties for each hard disk, and unchecked the "Allow Indexing Service to index this disk for fast file searching" option. When I clicked "Apply", it asked whether I want to apply this change to all subfolders as well, and I said yes. It took ages, but it did finally finish applying the change.

2) Note that I had already long prior disabled the Indexing Service itself.

3) Also earlier today, based on suggestions on another website, I completely disabled the Terminal Services service. (I also disabled Fast User Switching, prior to disabling said Terminal Services service.)

lsass.exe still hogs CPU. It's I/O read and write count goes up to over a hundred thousand. But then it stops. At approximately the same I/O read/write count each time. And once it stops, my computer runs fine.

And fortunately, I don't know what's changed, but it only seems to take about five minutes now. Which is really stupid. But much more bearable than half an hour.

It doesn't seem to be a worm or trojan or anything such like. Antivirus scans turn up nothing.

handle.exe reports exactly the same files open by lsass.exe each time I run it. That's a lot of I/O to generate for the same set of files!!! Unless it's doing some sneaky direct-to-disk I/O and bypassing the usual file-handle system...

And besides, what's with all those writes? Well over a hundred thousand disk writes within the first five minutes of bootup?

Google-ing for lsass.exe issues reveals lots of people experiencing problems, but it turns up remarkably few solutions.

I haven't found a complete solution, but perhaps somehow between unchecking that "Allow Indexing Service ..." option, and disabling the Terminal Services service, it has taken a bite out of the ridiculous amount of time that lsass.exe now wastes each time I boot...

3 comments:

Anonymous said...

I have the same problem and have not found a solution.

kunghwah said...

just switch of the printer spool when you don't need it from msconfig

Anonymous said...

Disabling Superfetch is also a must