LSASS taking 12 hours to complete at boot up in Windows server 2019 vs 3 minutes in 2012R2

CoderR 1 Reputation point
2023-03-30T20:06:36.61+00:00

I have a system with 50K local users (it's create via a script for IIS authentication, this cannot be changed at this time as it's being done by a legacy app).

It's currently running on Windows Server 2012R2 and it takes about 3-4 minutes to boot up - it's been working perfectly for almost a decade now.

I need need to upgrade to Server 2019 or Server 2022. However once the 50K local users are recreated it takes about 12 hours for the server to boot up and login. After analyzing the boot up logs using procmon I noticed that with 2012R2 LSASS is enumerating the SAM users in parallel with other tasks including running LoginUI and once logged in LSASS stop.

Where as in 2019 LSASS has to complete enumerating the SAM users before the login takes place, this takes 12 hours to complete.

Does anyone know how to get 2019 to behave like 2012R2 and have LSASS complete it's SAM validation in parallel with other tasks so it doesn't take 9 hours to boot? Very frustrating the MS broke something that worked great.

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,832 questions
Windows Server 2012
Windows Server 2012
A Microsoft server operating system that supports enterprise-level management, data storage, applications, and communications.
1,607 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,378 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Limitless Technology 44,421 Reputation points
    2023-03-31T10:31:44.8066667+00:00

    Hello

    Thank you for your question and reaching out. I can understand you are having query\issues related to LSASS taking huge time.

    1. Please check and scan for Check for malware and also perform Full scan with your Antivirus on 2012 R2 server.
    2. Disable any Local Windows firewall for temporary purpose.
    3. Perform scandisk using below command as some due to disk issues it may tame take time to boot up.

    chkdsk /f /r c:\

    1. Please also consider to Migrate FSMO role to new Additional DC having 2019 or 2022 installed.

    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.