LSASS.EXE produces memory leak on Windows 10

Hi all,

I'm experiencing a problem in the office's server since I installed Windows 10. The problem is a well-known one with LSASS.EXE, and I've found that it's docummented and there are patches for Windows Server 2012, Windows 8.1 and Windows 7: LINK

My problem is there is no information about this problem on Windows 10.

The computer works like a charm... until lsass.exe starts taking more and more RAM. When it takes the whole 16GB the computer works awful and has to be restarted.

I attach some screenshots:



Memory Usage:



CPU:





The computer is a server but has no active directory, it's a common lan with four computers and the server has (among other functions) a ERP that uses SQL 2016 with a database.

Since I saw a reference to Named Pipes I tried to disable in "cliconf.exe" but it didn't solve the problem:


I Found some information about memory leaks in windows 10 (not related to LSASS but "Windows Network Data Usage Monitoring Driver", so I modified registry in this way:

Navigate to Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ndu and then from the right hand section of the window double click Start in order to be able to edit the Value data setting. It will probably be 2 but changing this to 4 will disable the ndu.

Server specs:

-i7 Haswell @4,5 ghz
-Asrock Z97 extreme4 motherboard
-16 GB RAM DDR3 2400mhz
-Integrated VGA
-Raid 0 SSDs

Can anyone help me with this? I tryed Windows Performance Recorder Tool but it gave me not information to determine what is causing LSASS.EXE have this issue.

Regards and many thanks in adavance.

orlbuckeye said:

Because lsass.exe is a crucial system file, its name is often faked by malware. The lsass.exe file used by Windows is located in the directory Windows\System32. If it is running from any other location, that lsass.exe is most likely a virus, spyware, trojan or worm. Due to the way some systems display fonts, malicious developers may name the file something like Isass.exe (capital "i" instead of a lowercase "L") in efforts to trick users into installing or executing a malicious file instead of the trusted system file.

Download and run Anti MalwareBytes.

Many thanks for your answer, orlbuckeye,

What you tell is the first thing I tried and checked. I ran Malwarebytes and checked the first letter was "L" and not "I". The problem is caused by the real "LSASS.EXE".

Regards

Have you looked on the LSA providers tab of autoruns? Might be a place to start.

windows 7 - lsass.exe causes memory leak - Super User