Major problems Microsoft LSASS engine

[snap254]

We noticed that there is a HUGE increase in CPU for the "lsass.exe" engine on a Windows host server running Windows Auth operations via WAFFLE in our Java app. Under enough pressure - this service will crash and effectively kill the entire host server - requiring a reboot.

We know LSASS (Local Security Authority Process) is part of the Kerberos infrastructure on a Windows Machine. But, when we pump a .Net application via IIS and Windows Auth, we do not see the same LSASS response.

First, has anyone seen this before? Second, is this to be expected using WAFFLE or anything else? Third, is there any obvious steps we can take to mitigate the problem?

thx
in advance

[hazendaz]

What version is being used? Get Outlook for Android<https://aka.ms/ghei36>

…

________________________________ From: snap254 <[email protected]> Sent: Thursday, March 12, 2020 11:09:29 AM To: Waffle/waffle <[email protected]> Cc: Subscribed <[email protected]> Subject: [Waffle/waffle] Major problems Microsoft LSASS engine (#902) We noticed that there is a HUGE increase in CPU for the "lsass.exe" engine on a Windows host server running Windows Auth operations via WAFFLE in our Java app. Under enough pressure - this service will crash and effectively kill the entire host server - requiring a reboot. We now LSASS (Local Security Authority Process) is part of the Kerberos infrastructure on a Windows Machine. But, when we pump a .Net application via IIS and Windows Auth, we do not see the same LSASS response. First, has anyone seen this before? Second, is this to be expected using WAFFLE or anything else? Third, is there any obvious steps we can take to mitigate the problem? thx in advance — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub<#902>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAHODI6HJKCFVJOOBGERBOTRHD3KTANCNFSM4LGOOYUA>.

[snap254]

We're currently using 1.8.3. I believe that issues with LSASS were addressed in 1.8.0 and we can upgrade to the latest version 2. But we did not see anything in the release notes since 1.8.3 that addresses any other problems with LSASS, so its not something we have actively pursued.

Should we?

[snap254]

PS: We're running Java 11 on Windows 2016 Standard.

[hazendaz]

@snap254 I would suggest upgrading to latest. Waffle is on top of JNA and a lot has changed with that since 2017. I haven't seen any other reports that I recall on this issue.