☰

LSASS.Exe 在 SBS2003 上的 CPU 使用率为 100%

tag-icon • tag-icon windows-server-2003 windows-sbs-2003 lsass
LSASS.Exe 在 SBS2003 上的 CPU 使用率为 100%

LSASS.exe 在我的 SBS2003 DC 上占用了 100% 的 CPU 使用率。

我怎么也想不出是什么原因造成的。我检查了事件日志，发现了一些问题。我看不出其中有什么相关之处。除了 ActiveSync 错误（很久以前开始的，在出现此问题之前）之外，没有其他问题会定期记录。

那里有少量的原木；

Event Type: Warning
Event Source:   MSDTC
Event Category: SVC
Event ID:   53258
Date:       02.05.2013
Time:       5:43:20 p.m.
User:       N/A
Computer:   SERVER
Description:
MS DTC could not correctly process a DC Promotion/Demotion event. MS DTC will continue to function and will use the existing security settings. Error Specifics: %1

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

和

Event Type: Error
Event Source:   MSExchangeSA
Event Category: RFR Interface 
Event ID:   9143
Date:       02.05.2013
Time:       5:42:58 p.m.
User:       N/A
Computer:   SERVER
Description:
Referral Interface cannot contact any Global Catalog that supports the NSPI Service. Clients making RFR requests will fail to connect until a Global Catalog becomes available again. After a Domain Controller is promoted to a Global Catalog, it must be rebooted to support MAPI Clients. 

For more information, click http://www.microsoft.com/contentredirect.asp.

还有一些其他 MSExchangeAL 错误；

Event Type: Error
Event Source:   MSExchangeAL
Event Category: LDAP Operations 
Event ID:   8026
Date:       02.05.2013
Time:       5:31:32 p.m.
User:       N/A
Computer:   SERVER
Description:
LDAP Bind was unsuccessful on directory SERVER.etcetera.local for distinguished name ''. Directory returned error:[0x51] Server Down.    

For more information, click http://www.microsoft.com/contentredirect.asp.

和

Event Type: Error
Event Source:   MSExchangeAL
Event Category: Service Control 
Event ID:   8250
Date:       02.05.2013
Time:       5:31:19 p.m.
User:       N/A
Computer:   SERVER
Description:
The Win32 API call 'DsGetDCNameW' returned error code [0x862] The specified component could not be found in the configuration information.  The service could not be initialized.  Make sure that the operating system was installed properly. 

For more information, click http://www.microsoft.com/contentredirect.asp.

和

Event Type: Error
Event Source:   MSExchangeAL
Event Category: LDAP Operations 
Event ID:   8026
Date:       02.05.2013
Time:       5:31:19 p.m.
User:       N/A
Computer:   SERVER
Description:
LDAP Bind was unsuccessful on directory SERVER.etcetera.local for distinguished name ''. Directory returned error:[0x51] Server Down.    

For more information, click http://www.microsoft.com/contentredirect.asp.

这是此域中唯一的服务器。我假设问题出在这台机器上，因此我一直在关注本文的第 2 部分；

http://blogs.technet.com/b/askds/archive/2007/08/23/troubleshooting-high-lsass-cpu-utilization-on-a-domain-controller-part-2-of-2.aspx

我尝试了几个我见过的选项。我在 HKLM\System\CurrentControlSet\Control\LSA 中的通知包中有一个条目“RASSFM KDCSVC WDIGEST scecli dsrestor”。我读到这里的标准条目不包括 dsrestor 条目，但我犹豫着说这是问题所在（我今晚有停机时间来测试删除它 + 重新启动）。

有人知道我可以尝试什么吗？

谢谢！-Ewan

答案1

好的，我找到了问题。我真傻 - 我没有注意到有重复的 LSASS.exe。原来这是恶意软件挖掘比特币，因此 CPU 使用率很高。

相关内容