The DFS service and the Lsass.exe process appear to jointly consume more than 80 percent of system resources on a Windows Server 2003-based domain controller

Article translations Article translations
Article ID: 935741 - View products that this article applies to.
Expand all | Collapse all

SYMPTOMS

In a Microsoft Windows Server 2003-based domain, you may experience the following problems:
  • On a domain controller, the Distributed File System (Dfssvc.exe) service and the Local Security Authority Server (Lsass.exe) process appear, in Task Manager, to jointly consume more than 80 percent of system resources. This behavior occurs for a sustained time period. For example, this behavior may last for more than five minutes.
  • When you stop the Dfssvc.exe service, CPU usage also drops for the Lsass.exe process.

CAUSE

This problem may occur if the McAfee VirusScan Enterprise 8.0i update 11 or an earlier version is installed on client computers, on servers, or on domain controllers in the domain.

RESOLUTION

To resolve this problem, follow these steps:
  1. Determine whether McAfee VirusScan Enterprise 8.0i is installed on client computers, on servers, or on domain controllers in the domain. To do this, follow these steps:
    1. Use the Network Monitor utility to perform a network trace on the domain controller.

      Note The Network Monitor utility is included in Windows Server 2003. In the network trace, you may see that the domain controller receives many GET_DFS_REFERRAL requests. In this situation, you see that these requests receive one of the following responses:
      • 549 STATUS_NOT_FOUND
      • STATUS_NO_SUCH_DEVICE
    2. Examine the related Server Message Block (SMB) packets in the network trace. You may see one of the following entries:
      • PID=4
      • PID=8
      • PID=65279
      Note These entries indicate the presence of a kernel-level process, such as a McAfee filter driver.
    3. Use the Windows NT Diagnostics (WinMSD) utility to determine whether McAfee VirusScan Enterprise 8.0i is installed on client computers, on servers, or on domain controllers in the domain.

      Note The WinMSD utility is included in Windows Server 2003 and in Microsoft Windows XP.
  2. Contact McAfee technical support to obtain the latest update for McAfee VirusScan Enterprise 8.0i. To do this, visit the following McAfee Web site:
    http://knowledge.mcafee.com/SupportSite/search.do?cmd=displayKC&docType=kc&externalId=KB43878&sliceId=SAL_Public&dialogID=486118&stateId=0%200%20484738
    Note You must install this update on all computers that are running McAfee VirusScan Enterprise 8.0i in the Windows Server 2003-based domain environment.
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

MORE INFORMATION

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

REFERENCES

For more information, click the following article number to view the article in the Microsoft Knowledge Base:
908370 A domain controller that is running Microsoft Windows Server 2003 may stop responding for 2 to 15 minutes several times a day

Properties

Article ID: 935741 - Last Review: May 8, 2007 - Revision: 1.1
APPLIES TO
  • Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003, Web Edition
Keywords: 
kbexpertiseadvanced kbtshoot KB935741

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com