Forum Discussion
How to diagnose lsass.exe leaking memory on Server 2022
Since last week, one DC (it differs, depending on reboot order as to which one, so clearly due to something on the network selecting the DC as a login server) has a huge lsass.exe memory issue. I had to reboot one DC after the process hit 6GB in size. Here's the progression of the process since that reboot:
Is anyone else seeing this, perhaps since last week's updates?
Any suggestions for how to diagnose?
5 Replies
Rob Butterworth We had the same issue since the patch on Tuesday on our 2019 DC's.
The lsass process consumed all memory (64GB) of the DC's. We had to constantly reboot the DC's do free up the memory.
After we uninstalled the patch the memory consumption of lsass was normal.Im seeing this too. Since Windows updates last week lsass.exe on one of my domain controllers is growing by 800mb per hour.
Jim4509 The odd thing is I have two sites, each with two DCs, and it is only one of the sites where I see this, so I need to work out what authentication activity is specific to the site where the issue manifests.
The issue follows the bulk of the authentication activity - if I reboot one the the servers, the other's rate of memory use change increases and the rebooted server's reduces, see below.
Also see https://www.reddit.com/r/WindowsServer/comments/1bhvpcn/comment/kvkn6zp/?utm_source=share&utm_medium=web2x&context=3 and https://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2024-exchange-server-security-updates/ba-p/4075348/page/3#comments
Hello, I am reviving the issue, we have a web server, server 2022, installed on 07/2024. After an update in 10/2024 (I guess so), lsass.exe started to constantly increase the memory, now it is up to 6-8gb weekly and I have to restart the server. The faulty March 2024 patch is not available on this server, so we cannot install the correct patch. I would be very happy if anyone could help on this issue. thanks.
