Domain controllers may experience high LSASS CPU usage

Topic

New Reply

Domain controllers may experience high LSASS CPU usage

Domain controllers may experience high LSASS CPU usage   Status Resolved   Affected platforms Server Versions Message ID Originating KB Resolved KB Windows Server 2022 WI926814 KB5042881 – Windows Server 2019 WI926815 KB5043050 – Windows Server 2016 WI926816 KB5043051 – Windows Server 2012 R2 WI926818 KB5043138 – Windows Server 2012 WI926819 KB5043125 – Windows Server 2025 WI926820 KB5046617 –   After Remote Desktop Services (RDS) Licensing servers are patched with the Windows security updates released September 10, 2024 (the Originating KBs listed above) or later, domain controllers (DCS) might experience high CPU utilization in the  Local Security Authority Subsystem Service (LSASS) process. The issue occurs due to  Lightweight Directory Access Protocol (LDAP) query tasks issued by (RDS) License Servers that must use attributes that are not indexed by default. This high CPU usage on DCs is particularly noticeable in environments with many RDS user logons.   It is important to note that no update on the domain controllers (DCs) themselves is causing this issue. Instead, the problem arises when an updated RDS Licensing Server (RDLS)—patched with 9B or later—communicates with the DC.   This issue is specific to enterprise customers that have deployed RDS Licensing Servers and Active Directory domain controllers used in business and commercial environments.   Resolution: This issue can be addressed by following the steps below. Completing these actions ensures efficient LDAP query processing and proper operation of your RDS environment:   Important: This indexing step must be completed before applying the update. It only needs to be done once.   Index the DNSHostname Attribute in Active Directory: To complete the indexing, follow these steps: 1. Open the Microsoft Management Console (MMC): a. Right-click the Start button, select Run, and type mmc, then press Enter. 2. Add the Active Directory Schema Snap-in: b. In MMC, go to File > Add/Remove Snap-in. c. Select Active Directory Schema from the list of available snap-ins and click Add, then click OK. 3. Navigate to the Attributes Section: d. In the left-hand pane, click Attributes under the Active Directory Schema. 4. Locate and Select the DNSHostname Attribute: e. In the right-hand pane, find the DNSHostname attribute, right-click it, and select Properties. 5. Enable Indexing: f. Check the box next to “Index this attribute in Active Directory,” and click Apply. 6. Close the Console: g. Close the Active Directory Schema snap-in once you’ve completed the changes. For detailed instructions on indexing attributes, refer to Microsoft Community Hub – Indexing in Active Directory (#).   Additional Configuration Guidance: For environments using multiple RDS license servers after the September 2024 security update, ensure your setup follows the guidance provided in  Use multiple Remote Desktop license servers. This helps prevent excessive LDAP queries and ensures proper operation of your RDS environment.   Affected platforms: ·    Client: Windows 11, version 24H2 ·    Server: Windows Server 2025; Windows Server, Version 23H2; Windows Server 2022; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote