RE: [ActiveDir] DC crashing / LSASS --> memory leak

[Lucas, Bryan]

I went that route actually.  I unplugged, rebooted and it was fine.  After I browsed some file properties, LSASS sucked up a bunch of RAM (caching I presume) and then stabilized ~500MB.  After 30 minutes, I plugged it back in and it got drilled during replication but then returned to normal and so far so good.  Been about an hour now.   Its an older slower single CPU box and our only 2000 DC left, it will be demoted very soon after this incident ;)   Thanks for the suggestion.   I did call PSS btw and they wanted the typical dump and analyze and we’ll call you in a week or so.  No time for that unfortunately.   Bryan Lucas Server Administrator Texas Christian University From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Roger Longden Sent: Saturday, November 04, 2006 8:09 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] DC crashing / LSASS --> memory leak   Assuming you have a Premier support agreement I suggest calling PSS and/or your TAM.  I’d be curious if you see the same issue with the DC unplugged from the network.  In other words, I’d suspect malicious activity (could be viral/worms/Trojans) as a prime candidate.  I don’t recall seeing many memory leaks in lsass.exe in 2000 SP4.   - Roger   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Lucas, Bryan Sent: Saturday, November 04, 2006 2:50 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] DC crashing / LSASS --> memory leak   I’ve got a Win2000 SP4 box that I believe has LSASS crashing leading to a huge run on memory causing the system to page and yield a Virtual Memory is too low… type error and all access to the server is cutoff essentially (other than local logon).   After rebooting twice and watching TaskMgr, I see LSASS spike for about 4-8 seconds, then flatline and memory starts going nuts.  The box becomes extremely unresponsive.  I’m rebooting to safe mode now to review the logs, but in the mean time does anyone have any ideas?   The box has been fairly stable for a long time now.   Bryan Lucas Server Administrator Texas Christian University