Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. The DFS service and the Lsass.exe process appear to jointly consume more than 80 percent of system resources on a Windows Server 2003-based domain controller

The DFS service and the Lsass.exe process appear to jointly consume more than 80 percent of system resources on a Windows Server 2003-based domain controller

View products that this article applies to.

Symptoms

In a Microsoft Windows Server 2003-based domain, you may experience the following problems:
  • On a domain controller, the Distributed File System (Dfssvc.exe) service and the Local Security Authority Server (Lsass.exe) process appear, in Task Manager, to jointly consume more than 80 percent of system resources. This behavior occurs for a sustained time period. For example, this behavior may last for more than five minutes.
  • When you stop the Dfssvc.exe service, CPU usage also drops for the Lsass.exe process.

↑ Back to the top

Cause

This problem may occur if the McAfee VirusScan Enterprise 8.0i update 11 or an earlier version is installed on client computers, on servers, or on domain controllers in the domain.

↑ Back to the top

Resolution

To resolve this problem, follow these steps:
  1. Determine whether McAfee VirusScan Enterprise 8.0i is installed on client computers, on servers, or on domain controllers in the domain. To do this, follow these steps:
    1. Use the Network Monitor utility to perform a network trace on the domain controller.

      Note The Network Monitor utility is included in Windows Server 2003. In the network trace, you may see that the domain controller receives many GET_DFS_REFERRAL requests. In this situation, you see that these requests receive one of the following responses:
      • 549 STATUS_NOT_FOUND
      • STATUS_NO_SUCH_DEVICE
    2. Examine the related Server Message Block (SMB) packets in the network trace. You may see one of the following entries:
      • PID=4
      • PID=8
      • PID=65279
      Note These entries indicate the presence of a kernel-level process, such as a McAfee filter driver.
    3. Use the Windows NT Diagnostics (WinMSD) utility to determine whether McAfee VirusScan Enterprise 8.0i is installed on client computers, on servers, or on domain controllers in the domain.

      Note The WinMSD utility is included in Windows Server 2003 and in Microsoft Windows XP.
  2. Contact McAfee technical support to obtain the latest update for McAfee VirusScan Enterprise 8.0i. To do this, visit the following McAfee Web site:
    http://knowledge.mcafee.com/SupportSite/search.do?cmd=displayKC&docType=kc&externalId=KB43878&sliceId=SAL_Public&dialogID=486118&stateId=0%200%20484738
    Note You must install this update on all computers that are running McAfee VirusScan Enterprise 8.0i in the Windows Server 2003-based domain environment.
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

↑ Back to the top

More information

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

↑ Back to the top

References

For more information, click the following article number to view the article in the Microsoft Knowledge Base:
908370� A domain controller that is running Microsoft Windows Server 2003 may stop responding for 2 to 15 minutes several times a day

↑ Back to the top

Keywords: KB935741, kbtshoot, kbexpertiseadvanced

↑ Back to the top

Article Info
Article ID : 935741
Revision : 2
Created on : 5/8/2007
Published on : 5/8/2007
Exists online : False
Views : 213