Hi Folks,
our Client sites domain controllers creates high cpu alerts due to lsass.exe process which caused more than 80% and some time 100% of cpu spikes.
As per our investigation, Installed SPA on one of DC..to look forward for which clients created this issue.
The reports shows,
Top Process Group CPU%
Lsass.exe 75%
Top Activity CPU%
SamEnumUsersInDom 46 %
Top Client CPU%
SAM 46%
TOP CLIENT
UNDER "SAM ITS Shows lot of search like this
| Client | Requests/sec | Response Time(ms) | CPU% |
|---|
| deep | dc=abc.com,... | (sAMAccountType=805306368 ) | NC_Acc_Type_Sid:210989:N; |
|
Also Found lot of Net log events on DCs
Events ID 5805 & 5723
I have checked the computers on AD and found some computers which stated on net logon events are in domain and some of them not found.
Can you please help me to nail down the issue asap.
Thank you.
Senvaas