lsass.exe constant disk access and I/O

M

Mark.Wright

Hi all,
I have just installed win xp pro on a laptop, and find that battery life
is being compromised because the hdd never goes into standby mode. This is
because there is clockwork-regular disk access evey second. Inspecting
filemon and teskmanager I see that this is due to lsass.exe performing 3
writes and 3 reads every second. I have been into msconfig and unchecked
every item, and removed everything from startup, so that I boot into a
totally clean system with absolutely nothing running - no AV, no Norton,
no nothing. Still lsass.exe is busy spewing I/O to the disk. Searches on
Google groups indicate that this is quite a common problem, but I have
never seen a solution that worked be posted. Many times people have
posted articles or advice about trojans, AV software etc, but they never
got to the problem. It has been noted that MS claim this behaviour is
"normal" - which it most obviously isnt at all. Noone (not even MS!) would
write an OS that needed 3 physical disk writes a second. If they were
stupid enough to, there would have been no point in ever spending the time
to program idle-disk power-down ability into the OS, since the disk would
never be idle.

This inspired me to check my desktop, a dual CPU win xp pro, and I see
that while activity by lsass.exe is identical, there is absolutely no disk
access during periods of total idleness. I then checked a friend's xp pro
install, and his has no such constant access by lsass.exe.

This leads me to belive there are two issues:
1. A scenario that causes lsass.exe on an idle machine with nothing else
to have constant I/O.
2. A scenario that causes a busy lsass.exe in scenario 1 to always
perform a physical write, rather than some kind of cache/memory I/O write.

Since this is reducing the useability of a laptop (battery life), I do
consider this a serious flaw in XP. Can anyone shed any light on the above
scenarios?

Cheers,
Mark

--
 
M

Mark.Wright

NB:
All 3 machines are XP Sp1. Both the machines affected with lsass.exe disk
access have Norton AV 2002 installed, the unaffected machine has Norton AV
2003. Remember however that during my tests NAV was not loaded or
running. It could be that NAV 2003 affects a system file during install
perhaps, that is fixed in 2003?
Mark

(e-mail address removed) wrote:
: Hi all,
: I have just installed win xp pro on a laptop, and find that battery life
: is being compromised because the hdd never goes into standby mode. This is
: because there is clockwork-regular disk access evey second. Inspecting
: filemon and teskmanager I see that this is due to lsass.exe performing 3
: writes and 3 reads every second. I have been into msconfig and unchecked
: every item, and removed everything from startup, so that I boot into a
: totally clean system with absolutely nothing running - no AV, no Norton,
: no nothing. Still lsass.exe is busy spewing I/O to the disk. Searches on
: Google groups indicate that this is quite a common problem, but I have
: never seen a solution that worked be posted. Many times people have
: posted articles or advice about trojans, AV software etc, but they never
: got to the problem. It has been noted that MS claim this behaviour is
: "normal" - which it most obviously isnt at all. Noone (not even MS!) would
: write an OS that needed 3 physical disk writes a second. If they were
: stupid enough to, there would have been no point in ever spending the time
: to program idle-disk power-down ability into the OS, since the disk would
: never be idle.

: This inspired me to check my desktop, a dual CPU win xp pro, and I see
: that while activity by lsass.exe is identical, there is absolutely no disk
: access during periods of total idleness. I then checked a friend's xp pro
: install, and his has no such constant access by lsass.exe.

: This leads me to belive there are two issues:
: 1. A scenario that causes lsass.exe on an idle machine with nothing else
: to have constant I/O.
: 2. A scenario that causes a busy lsass.exe in scenario 1 to always
: perform a physical write, rather than some kind of cache/memory I/O write.

: Since this is reducing the useability of a laptop (battery life), I do
: consider this a serious flaw in XP. Can anyone shed any light on the above
: scenarios?

: Cheers,
: Mark

: --


--
 
M

Mark.Wright

Final PS: the disk activity is even present before login, whist the
machine is idle at the login screen.
Mark

(e-mail address removed) wrote:
: NB:
: All 3 machines are XP Sp1. Both the machines affected with lsass.exe disk
: access have Norton AV 2002 installed, the unaffected machine has Norton AV
: 2003. Remember however that during my tests NAV was not loaded or
: running. It could be that NAV 2003 affects a system file during install
: perhaps, that is fixed in 2003?
: Mark
 
A

Al

Hi Marc,
just wanted to add that it might have something to do with
the way the OS is preconfigured by the manufacturer of your
computer. I am running five Win XP machines (various
processors and manufacturers & XP home as well as XP pro)
and only one is having the problem (HP pavilion t240). Did
try almost anything as well, to no avail. Hope there is a
possible patch.
Cheers,
Al
 
A

Al

I am running various versions of NAV. The computer with the
lsass problem was recently upgraded from NIS 2003 to NIS
2004. No changes.
 
M

Mark.Wright

: Hi Marc,
: just wanted to add that it might have something to do with
: the way the OS is preconfigured by the manufacturer of your
: computer. I am running five Win XP machines (various
: processors and manufacturers & XP home as well as XP pro)
: and only one is having the problem (HP pavilion t240). Did
: try almost anything as well, to no avail. Hope there is a
: possible patch.

Hi Al,
I built the machine from bits myself, so there was no manufacturer's
config. The laptop was also a clean install.
Mark


--
 
M

Mark.Wright

: I am running various versions of NAV. The computer with the
: lsass problem was recently upgraded from NIS 2003 to NIS
: 2004. No changes.

Ah, OK. That's useful to know because I was considering upgrading to NAV
2003/4 in the hope of fixing it, but now I guess I wont.
Mark
 
M

Michael Clark

Mark, I also seem to have the same "constant" disk access. However, this
activity is only indicated by the blinking of the HDD light on my case.

I downloaded File Monitor from sysinternals, and it does not show any
constant disk activity, especially not from lsass.exe. Is this sysinternals
tool the utility you used to determine the source of constant disk activity?

I am running Norton AntiVirus 2002 -- I tried uninstalling the Norton
software but the blinking continued.

I am thinking that my "blinking" access indicator is just a fluke of the IDE
controller and the disk I am using, and not REAL disk access, because File
Monitor is not reporting it. But, I would like to hear about your
experience and what software you used.

Also, I am running a hand built P4 desktop, with Hitachi 80gb drives. The
motherboard is made by Intel.

-Mike
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top