AD Processor Overload (lsass) Monitor

AD_CPU_Overload.Monitor (UnitMonitor)

Knowledge Base article:

Summary

AD Processor overload (lsass). The core process (Lsass.exe) for the Active Directory directory service is consuming a lot of CPU resources.

Configuration

Possible causes include the following:

Element properties:

TargetMicrosoft.Windows.Server.2008.AD.DomainControllerRole
Parent MonitorSystem.Health.PerformanceState
CategoryAvailabilityHealth
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeAD_CPU_Overload.Monitortype
RemotableFalse
AccessibilityPublic
Alert Message
The LSASS process has exceeded the processor utilization threshold
{0}
RunAsDefault

Source Code:

<UnitMonitor ID="AD_CPU_Overload.Monitor" Accessibility="Public" Enabled="onStandardMonitoring" Target="AD2008Core!Microsoft.Windows.Server.2008.AD.DomainControllerRole" ParentMonitorID="SystemHealth!System.Health.PerformanceState" Remotable="false" Priority="Normal" TypeID="AD_CPU_Overload.Monitortype" ConfirmDelivery="false">
<Category>AvailabilityHealth</Category>
<AlertSettings AlertMessage="AD_CPU_Overload.Monitor.AlertMessage">
<AlertOnState>Error</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>Error</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/Property[@Name='ErrorString']$</AlertParameter1>
</AlertParameters>
</AlertSettings>
<OperationalStates>
<OperationalState ID="ADCPUOverloadOk" MonitorTypeStateID="ADCPUOverloadOk" HealthState="Success"/>
<OperationalState ID="ADCPUOverloadError" MonitorTypeStateID="ADCPUOverloadError" HealthState="Error"/>
</OperationalStates>
<Configuration>
<Frequency>300</Frequency>
<TimeoutSeconds>300</TimeoutSeconds>
<Threshold>80</Threshold>
<NumSamples>10</NumSamples>
</Configuration>
</UnitMonitor>