Vista
(1)
XP
(1)
RegQueryValue
(1)
RegCloseKey
(1)
RegOpenKey
(1)
Lsass
(1)

lsass.exe - 3 I/O Reads / Writes per second

Asked By lsas
07-Feb-08 03:47 AM
The lsass process is doing constant I/O.  Process Monitor describes the
action as:

56	1:32:41.6962584
AM	lsass.exe	740	RegOpenKey	HKLM\SECURITY\Policy	SUCCESS	Desired Access:
Read/Write
57	1:32:41.6962737
AM	lsass.exe	740	RegOpenKey	HKLM\SECURITY\Policy\SecDesc	SUCCESS	Desired
Access: Read
58	1:32:41.6962867
AM	lsass.exe	740	RegQueryValue	HKLM\SECURITY\Policy\SecDesc\(Default)	BUFFER
OVERFLOW	Length: 12
59	1:32:41.6962992
AM	lsass.exe	740	RegCloseKey	HKLM\SECURITY\Policy\SecDesc	SUCCESS
60	1:32:41.6963103
AM	lsass.exe	740	RegOpenKey	HKLM\SECURITY\Policy\SecDesc	SUCCESS	Desired
Access: Read
61	1:32:41.6963228
AM	lsass.exe	740	RegQueryValue	HKLM\SECURITY\Policy\SecDesc\(Default)	SUCCESS	Type: REG_NONE, Length: 200, Data:
62	1:32:41.6963351
AM	lsass.exe	740	RegCloseKey	HKLM\SECURITY\Policy\SecDesc	SUCCESS
63	1:32:41.6964635 AM	lsass.exe	740	RegCloseKey	HKLM\SECURITY\Policy	SUCCESS

Any ideas what is going on?  Note, the old XP trick of disabling Terminal
Services does not have an effect.  This is Vista with the latest updates.

Looks like these I/O operations are caused by Task Manager itself.

Asked By lsas
07-Feb-08 04:54 PM
Looks like these I/O operations are caused by Task Manager itself.  Process
Monitor is quiet when they are not running.

Looks like the I/O operations were caused by Task Manager itself.

Asked By lsas
07-Feb-08 04:56 PM
Looks like the I/O operations were caused by Task Manager itself.  Process
Monitor is quiet when TM is not running.
Post Question To EggHeadCafe