Select the product you need help with

The DFS service and the Lsass.exe process appear to jointly consume more than 80 percent of system resources on a Windows Server 2003-based domain controller

Article ID: 935741 - View products that this article applies to.

Expand all | Collapse all

SYMPTOMS

In a Microsoft Windows Server 2003-based domain, you may experience the following problems:

On a domain controller, the Distributed File System (Dfssvc.exe) service and the Local Security Authority Server (Lsass.exe) process appear, in Task Manager, to jointly consume more than 80 percent of system resources. This behavior occurs for a sustained time period. For example, this behavior may last for more than five minutes.
When you stop the Dfssvc.exe service, CPU usage also drops for the Lsass.exe process.

Back to the top | Give Feedback

CAUSE

This problem may occur if the McAfee VirusScan Enterprise 8.0i update 11 or an earlier version is installed on client computers, on servers, or on domain controllers in the domain.

Back to the top | Give Feedback

RESOLUTION

To resolve this problem, follow these steps:

Determine whether McAfee VirusScan Enterprise 8.0i is installed on client computers, on servers, or on domain controllers in the domain. To do this, follow these steps:
1. Use the Network Monitor utility to perform a network trace on the domain controller.
  
  Note The Network Monitor utility is included in Windows Server 2003. In the network trace, you may see that the domain controller receives many GET_DFS_REFERRAL requests. In this situation, you see that these requests receive one of the following responses:
  - 549 STATUS_NOT_FOUND
  - STATUS_NO_SUCH_DEVICE
2. Examine the related Server Message Block (SMB) packets in the network trace. You may see one of the following entries:
  - PID=4
  - PID=8
  - PID=65279
  Note These entries indicate the presence of a kernel-level process, such as a McAfee filter driver.
3. Use the Windows NT Diagnostics (WinMSD) utility to determine whether McAfee VirusScan Enterprise 8.0i is installed on client computers, on servers, or on domain controllers in the domain.
  
  Note The WinMSD utility is included in Windows Server 2003 and in Microsoft Windows XP.
Contact McAfee technical support to obtain the latest update for McAfee VirusScan Enterprise 8.0i. To do this, visit the following McAfee Web site:
http://knowledge.mcafee.com/SupportSite/search.do?cmd=displayKC&docType=kc&externalId=KB43878&sliceId=SAL_Public&dialogID=486118&stateId=0%200%20484738
(http://knowledge.mcafee.com/SupportSite/search.do?cmd=displayKC&docType=kc&externalId=KB43878&sliceId=SAL_Public&dialogID=486118&stateId=0%200%20484738)
Note You must install this update on all computers that are running McAfee VirusScan Enterprise 8.0i in the Windows Server 2003-based domain environment.

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

Back to the top | Give Feedback

MORE INFORMATION

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

Back to the top | Give Feedback