OS: Windows XP SP 3
Machine: clone
OS Disk: NTFS with lots of space and lots of virtual memory available.
Problem message: HKLM\SECURITY\Policy\SecDesc\(Default)
Was working fine, then lsass.exe started looping continuously on the above point. Other than huge number of disk accesses and slowed response, this is just bugging me. I used Procmon to find the above line, but can't get past that. Just defraged the OS disk. and the lsass.exe looping is still going on, but it does seem to be somewhat calmer now.
Is lsass.exe polling normal or should I be worried? lsass.exe and explorer.exe have huge I/O Other counts in Task Manager.
The virus mentioned in the last post on this doesn't seem to be the problem because I can boot, login, etc without any problems. the last thing that I did (before the defrag) was to cleanup the IE7 temp files and cookies.
Any help or ideas will be greatly appreciated.
Not sure what you mean by Problem message: HKLM\SECURITY\Policy\SecDesc\(Default)
Are you getting an error message displayed or are you seeing this some other way? On my system, XP Pro +SP3 + all updates, lsass.exe also has continuous I/O Read, Write and Other hits. Also, lsass.exe exists in the following places:
Directory of C:\minint\SYSTEM32
08/04/2004 08:00 AM 13,312 LSASS.EXE
1 File(s) 13,312 bytes
Directory of C:\WINDOWS\ServicePackFiles\i386
04/14/2008 05:42 AM 13,312 lsass.exe
1 File(s) 13,312 bytes
Directory of C:\WINDOWS\system32
04/14/2008 05:42 AM 13,312 lsass.exe
1 File(s) 13,312 bytes
Directory of C:\WINDOWS\system32\dllcache
04/14/2008 05:42 AM 13,312 lsass.exe
I have The Recovery Console installed so that is why it's in C:\minint\SYSTEM32
thanks for the reply.
The message is from Procmon, a combination of filemon and regmon, supposedly bigger and better. It shows the following sequence of messages (with a filter in place):
Time of Day Process Name PID Operation Path Result Detail
31:37.7 lsass.exe 708 RegOpenKey HKLM\SECURITY\Policy SUCCESS Desired Access: Read/Write
31:37.7 lsass.exe 708 RegOpenKey HKLM\SECURITY\Policy\SecDesc SUCCESS Desired Access: Read
31:37.7 lsass.exe 708 RegQueryValue HKLM\SECURITY\Policy\SecDesc\(Default) BUFFER OVERFLOW Length: 12
31:37.7 lsass.exe 708 RegCloseKey HKLM\SECURITY\Policy\SecDesc SUCCESS
31:37.7 lsass.exe 708 RegOpenKey HKLM\SECURITY\Policy\SecDesc SUCCESS Desired Access: Read
31:37.7 lsass.exe 708 RegQueryValue HKLM\SECURITY\Policy\SecDesc\(Default) SUCCESS "Type: REG_NONE, Length: 180, Data: 01 00 04 80 98 00 00 00 A8 00 00 00 00 00 00 00"
31:37.7 lsass.exe 708 RegCloseKey HKLM\SECURITY\Policy\SecDesc SUCCESS
31:37.7 lsass.exe 708 RegCloseKey HKLM\SECURITY\Policy SUCCESS
31:37.7 lsass.exe 708 RegOpenKey HKLM\SECURITY\Policy SUCCESS Desired Access: Read/Write
Note that the last line and the first one are the same. It just keeps repeating the loop. Defrag the disk did help some, but it still keeps looping and looping…there is one loop every 9 milliseconds! This seems REALLY high.
Any ideas?
The log from Procmon have already showed where you need to look.
Group Policy – Security
To get there,
Goto Start, RUN, type:gpedit.msc
When you choose path, you need to access Computer configuration and not user configuration.
I don't have the means to check the exact path at the moment, but I believe it should be in system
or under administrative templates.
In there, you should look for Security – System
Look for a policy which states apply security to C:\ and sub-directories + Files.
If set, try disable it. Then see if the behaviour still happens. If the behaviour is the same, go back and change the
policy back to the setting before altering it.
Thanks for the response. I was not aware of that feature, so I did learn something new. Unfortunately, I was not able to identify the security feature that you mentioned. There was a whole list of things but nothing that looked like what you were describing - at least to me.
Thanks again for the idea, and if you get a chance to find the exact path, please forward it.
1. Click Start, click Run, type gpedit.msc, and then click OK.
2. Open Computer Configuration, open Administrative Templates, open Windows Components, and then open Internet Explorer.
3. Change the Security Zones: Use only machine settings setting to Disabled, and then close Gpedit.msc.
Thanks for the details, but that path doesn't exist on my XP Pro installation!
I did find the problem: Terminal Services service (after SP3 ?) will push lsass.exe to run every 7 milliseconds. Disable Terminal Services unless you REALLY need it.
Again, thanks to all who submitted replies. It does help.
I have XP Pro with SP3 + All updates, Terminal Service is enabled and I don't have the drive access problem you described. There has to be more to it but I don't have any idea what.
That is very interesting input. What virus detector/scanner are you using? I have McAfee on all my machines, but don't think that is the problem - took a while but I did manage to keep McAfee from starting and that didn't seem to have an effect.
The Vista one (boy was that a mistake!) has Terminal Service disabled and lsass.exe is still running away. Haven't had time to dig into this - been busy with other problems.
I think you are right in that something else is wrong, but at this point, I have no idea either.
Thanks for the info. One more piece to the puzzle.
