Remote Desktop svchost (networkservice) & lsa.exe high cpu usage, hangs on welcome screen

Question

We have deployed an RDS Farm with 12 virtual RDS servers using Hyper V. Currently some users are not able to log on. After passing credentials to the connection broker, the session hangs on the "Welcome" screen.

Using resource monitor we've seen that svchost (with the "networkservice" service) has a CPU usage of 50%, when viewing the wait chain on the process it displays that it's waiting for a lsa.exe to finish.

We can't kill any of the users processes, even when trying with taskkill /f. Suspending lsa.exe did work but didn't have any effect. The networkservice also couldn't be restarted.

Also, if this happens, the current users logged on to the RDS server can't be displayed. Task manager crashes when viewing the users, RDS service manager crashes when viewing the users (even remotely) and the cmd command "query session" doesn't work.

No antivirus is installed on the RDS server. The only thing we can do is rebooting the server, which is not an option because of the fact that other users are in active sessions.

Does anyone have ANY idea what's going on? We didn't encounter this in our pre-production setup.

Solution

You can use Process Explorer to see what svchost is doing, by regarding the Threads tab. This may tell you which Windows DLL/API calls is the busy thread using, and might clarify the situation (with a bit of luck).

Just to remark that statistically speaking, most cases of high CPU usage in svchost are the result of virus infection.

Comments

[Admin]

Apply this Hotfix and se if that solves the problem: support.microsoft.com/kb/2750090

[Rohan1]

We did try launching process explorer, unfortunately during the high cpu usage it wont start. I can try to launch it before the high cpu usage. I will also try process monitor.

[harrymc]

If anything useful comes up, please incorporate it in your post (and drop me a comment here).

[Rohan1]

Today the issue occurred again, using process monitor I was able to see that it was querying the firefox folder and constantly looping. Upon removing the firefox profile, the cpu usage went down... LSM.exe (local session manager, wrote lsa.exe by mistake) which was stuck in this loop does explain why the sessions couldn't be displayed by task manager or the mmc snap in. I assume the process was busy because of the loop. Thanks for your help!