Microsoft KB Archive/935741

= The DFS service and the Lsass.exe process appear to jointly consume more than 80 percent of system resources on a Windows Server 2003-based domain controller =

Article ID: 935741

Article Last Modified on 5/8/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Web Edition

-



SYMPTOMS
In a Microsoft Windows Server 2003-based domain, you may experience the following problems:
 * On a domain controller, the Distributed File System (Dfssvc.exe) service and the Local Security Authority Server (Lsass.exe) process appear, in Task Manager, to jointly consume more than 80 percent of system resources. This behavior occurs for a sustained time period. For example, this behavior may last for more than five minutes.
 * When you stop the Dfssvc.exe service, CPU usage also drops for the Lsass.exe process.



CAUSE
This problem may occur if the McAfee VirusScan Enterprise 8.0i update 11 or an earlier version is installed on client computers, on servers, or on domain controllers in the domain.



RESOLUTION
To resolve this problem, follow these steps:  Determine whether McAfee VirusScan Enterprise 8.0i is installed on client computers, on servers, or on domain controllers in the domain. To do this, follow these steps:  Use the Network Monitor utility to perform a network trace on the domain controller.

Note The Network Monitor utility is included in Windows Server 2003. In the network trace, you may see that the domain controller receives many GET_DFS_REFERRAL requests. In this situation, you see that these requests receive one of the following responses:  549 STATUS_NOT_FOUND STATUS_NO_SUCH_DEVICE  Examine the related Server Message Block (SMB) packets in the network trace. You may see one of the following entries:  PID=4</li> PID=8</li> PID=65279</li></ul>

Note These entries indicate the presence of a kernel-level process, such as a McAfee filter driver.</li> Use the Windows NT Diagnostics (WinMSD) utility to determine whether McAfee VirusScan Enterprise 8.0i is installed on client computers, on servers, or on domain controllers in the domain.

Note The WinMSD utility is included in Windows Server 2003 and in Microsoft Windows XP.</li></ol> </li> Contact McAfee technical support to obtain the latest update for McAfee VirusScan Enterprise 8.0i. To do this, visit the following McAfee Web site:

http://knowledge.mcafee.com/SupportSite/search.do?cmd=displayKC&docType=kc&externalId=KB43878&sliceId=SAL_Public&dialogID=486118&stateId=0%200%20484738

Note You must install this update on all computers that are running McAfee VirusScan Enterprise 8.0i in the Windows Server 2003-based domain environment.</li></ol>

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

<div class="moreinformation_section">

MORE INFORMATION
The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

<div class="references_section">