Lsass.exe memory leak

Aron Weinstock 5 Reputation points
2024-09-03T16:05:03.35+00:00

I have a few computers all on Windows 11 23H2 OS build 22631.3880, that have the Lsass.exe using over 3 GB of memory.

Restarting helps for a while but after a few hours it is back.

Windows for business | Windows Client for IT Pros | User experience | Other
0 comments No comments
{count} vote

2 answers

Sort by: Most helpful
  1. Jing Zhou 7,765 Reputation points Microsoft External Staff
    2024-09-04T06:11:48.8666667+00:00

    Hello,

     

    Thank you for posting in Q&A forum.

    Based on your description, here are the possible causes and solutions:

    1. Sometimes, malware disguises itself as an lsass.exe process, consuming a lot of resources. Perform a full scan with antivirus software to make sure your system is not infected with malware. We recommend that you use Windows Defender or other reliable security software for an in-depth scan.
    2. There may be an unfixed memory leak issue with a particular version of Windows that causes lsass.exe to take up a lot of memory. Update your Windows and drivers regularly to make sure you're using the latest patches and fixes. You can check for and install the latest updates through Settings > Update & Security > Windows Update.
    3. Some third-party security software or system services may conflict with lsass.exe, causing it to occupy memory abnormally. If you're using third-party security software, try disabling them temporarily to see if that reduces lsass.exe's memory usage.
    4. Use Task Manager or Resource Monitor to check which process or service is causing lsass.exe to use high memory. For example, you can see which processes are associated with lsass.exe and analyze them further.
    5. Any automated scripts, policies, or programs that frequently access security policies or authenticate users can increase memory usage for lsass.exe.

    Use the Event Viewer to inspect relevant system and application events for error messages that may be causing problems.

     

    I hope the information above is helpful.

    If you have any questions or concerns, please feel free to let us know.

     

    Best regards,

    Jill Zhou

     


    If the Answer is helpful, please click "Accept Answer" and upvote it.

    0 comments No comments

  2. Aron Weinstock 5 Reputation points
    2024-09-04T15:34:10.61+00:00

    Hi,

    I did a Virus scan.

    I tried to remove 3rd party security programs.

    Windows is fully up to date from the beginning, as I wrote the Windows OS build.

    Lsass is used By CNG Key Validation, Netlogon, Security accounts manager, and Credential Manager.

    How do I determine which automated script or program frequently accesses the security policy?


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.