In a Microsoft Windows Server 2003-based domain, you may experience the following problems:
- On a domain controller, the Distributed File System (Dfssvc.exe) service and the Local Security Authority Server (Lsass.exe) process appear, in Task Manager, to jointly consume more than 80 percent of system resources. This behavior occurs for a sustained time period. For example, this behavior may last for more than five minutes.
- When you stop the Dfssvc.exe service, CPU usage also drops for the Lsass.exe process.
This problem may occur if the McAfee VirusScan Enterprise 8.0i update 11 or an earlier version is installed on client computers, on servers, or on domain controllers in the domain.
To resolve this problem, follow these steps:
- Determine whether McAfee VirusScan Enterprise 8.0i is installed on client computers, on servers, or on domain controllers in the domain. To do this, follow these steps:
- Use the Network Monitor utility to perform a network trace on the domain controller.
Note The Network Monitor utility is included in Windows Server 2003. In the network trace, you may see that the domain controller receives many GET_DFS_REFERRAL
requests. In this situation, you see that these requests receive one of the following responses:
- 549 STATUS_NOT_FOUND
- Examine the related Server Message Block (SMB) packets in the network trace. You may see one of the following entries:Note These entries indicate the presence of a kernel-level process, such as a McAfee filter driver.
- Use the Windows NT Diagnostics (WinMSD) utility to determine whether McAfee VirusScan Enterprise 8.0i is installed on client computers, on servers, or on domain controllers in the domain.
Note The WinMSD utility is included in Windows Server 2003 and in Microsoft Windows XP.
- Contact McAfee technical support to obtain the latest update for McAfee VirusScan Enterprise 8.0i. To do this, visit the following McAfee Web site:Note You must install this update on all computers that are running McAfee VirusScan Enterprise 8.0i in the Windows Server 2003-based domain environment.
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
A domain controller that is running Microsoft Windows Server 2003 may stop responding for 2 to 15 minutes several times a day
Article ID: 935741 - Last Review: May 8, 2007 - Revision: 1.1
- Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
- Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
- Microsoft Windows Server 2003, Standard Edition (32-bit x86)
- Microsoft Windows Server 2003, Web Edition
|kbexpertiseadvanced kbtshoot KB935741|