SCOM generates alerts frequently on our domain controlers (2012) where LSASS is using high cpu load, over 80% over 1hour. Alerts are randomly generated from all our 6 domaincontrollers and generated at different times even at nights.

Running a perfmon scan for directory services informs me that SAM is the client taking up most CPU load.

Any ideas on how to digg deeper to find out the reason behind?

We have 6 DC with 4 vCPU and 8GB ram.

/Lee

Hi Lee,

You may need to provide more information to better troubleshoot this issue. Which Operating Systems do DCs running on? Are there any specific actions performed when this issue occurred? Any programs/applications are installed?

Here are some troubleshooting links below I suggest refer to:

Troubleshooting High LSASS CPU Utilization on a Domain Controller (Part 1 of 2)

http://blogs.technet.com/b/askds/archive/2007/08/20/troubleshooting-high-lsass-cpu-utilization-on-a-domain-controller-part-1-of-2.aspx

Troubleshooting High LSASS CPU Utilization on a Domain Controller (Part 2 of 2)-

http://blogs.technet.com/b/askds/archive/2007/08/23/troubleshooting-high-lsass-cpu-utilization-on-a-domain-controller-part-2-of-2.aspx

How to Troubleshoot High LSASS.EXE CPU Utilization on an Active Directory Domain Controllers

http://support.microsoft.com/kb/2550044

Troubleshooting High CPU Usage on a Domain Controller

http://technet.microsoft.com/en-us/library/bb727054.aspx

Best Regards,

Amy