LSASS.exe High memory usage - Windows server 2019

Question

Hello,

I'm having an issue with LSASS on Windows Server 2019: I found there was an issue with this same service wrote here, but even after updating to the latest update (2024-07 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5040430) that include the KB5021237) I still have this issue.

I tried restart the server and also the fix that you wrote ( KB5020805: How to manage Kerberos protocol changes related to CVE-2022-37967) but nothing worked.

Last day before a reboot (that was necessary for the updates) the LSASS.exe was using 8,2GB of RAM and it's not normal.

Can you help me? (The clean boot it's not a suitable solution for us).

Answer 1

Hello

It seems there is memory leak issue. Is this server a domain controller or a normal server?

If this is a DC, the following link may be useful.

THIS JUST IN!!!!  High LSASS Usage After Windows Update 3B March 2024 - Microsoft Community Hub

a. For lsass service, have we checked whether we have configured the audit policies to this machine. Open administratror command line and run "auditpol.exe /get /category:*" then check the result. If we have configured some audit policies to the machine, try to remove them temporarily then check the issue again.

b. Configure the following group policy to limit the logon cache.

Local Security Policy -> Local Policies -> Security Options -> Interactive Logon: Number of previous logons to cache

For advanced troubleshooting:

1. Verify whether the memory is related to handle leak firstly. It could be related to pool usage (kernal mode). Here is a link for reference:

Another Troubleshooting Adventure: More Real Life Memory Pool Leaks - Microsoft Community Hub

1. If it is not a pool leak. Try to use vmmap to verify the exact memory usage.

VMMap - Sysinternals | Microsoft Learn

3.. Refer to the following link to yse performance monitor to verify the frequency of the memory leak.

Use Performance Monitor to Find a User-Mode Memory Leak - Windows drivers | Microsoft Learn

1. If it leak all the time, the WPR tool should be useful to analyze this issue. Based on 2,3 then capture the related wpr tag

Exercise 2 - Track User Mode Process Allocations | Microsoft Learn

1. We may consider to enable heap tracing with dump file at last.

In short, analyzing a memory issue is very complicated. The forum resource is limited, we may consider to open a Microsoft ticket for more resources.

Open Support requests | Microsoft LearnHello

It seems there is memory leak issue. Is this server a domain controller or a normal server?

If this is a DC, the following link may be useful.

THIS JUST IN!!!!  High LSASS Usage After Windows Update 3B March 2024 - Microsoft Community Hub

a. For lsass service, have we checked whether we have configured the audit policies to this machine. Open administratror command line and run "auditpol.exe /get /category:*" then check the result. If we have configured some audit policies to the machine, try to remove them temporarily then check the issue again.

b. Configure the following group policy to limit the logon cache.

Local Security Policy -> Local Policies -> Security Options -> Interactive Logon: Number of previous logons to cache

For advanced troubleshooting:

1. Verify whether the memory is related to handle leak firstly. It could be related to pool usage (kernal mode). Here is a link for reference:

Another Troubleshooting Adventure: More Real Life Memory Pool Leaks - Microsoft Community Hub

1. If it is not a pool leak. Try to use vmmap to verify the exact memory usage.

VMMap - Sysinternals | Microsoft Learn

3.. Refer to the following link to yse performance monitor to verify the frequency of the memory leak.

Use Performance Monitor to Find a User-Mode Memory Leak - Windows drivers | Microsoft Learn

1. If it leak all the time, the WPR tool should be useful to analyze this issue. Based on 2,3 then capture the related wpr tag

Exercise 2 - Track User Mode Process Allocations | Microsoft Learn

1. We may consider to enable heap tracing with dump file at last.

In short, analyzing a memory issue is very complicated. The forum resource is limited, we may consider to open a Microsoft ticket for more resources.

Open Support requests | Microsoft Learn