Neki bi korisnici mogli biti suočeni s problemom u kojem proces LSAISO.exe (LSA Isolated) ima veliku potrošnju CPU-a^{(high CPU usage)} na računalu sa sustavom Windows 10^{(Windows 10)} . Proces je povezan sa Credential Guard & Key Guard . U ovom postu ćemo pogledati mogući uzrok i preporučeno rješenje ovog problema.

LSAISO proces visoke potrošnje CPU-a

VSM koristi načine izolacije koji su poznati kao virtualne razine povjerenja^{(Virtual Trust Levels)} ( VTL ) za zaštitu IUM procesa (također poznatih kao pouzdani programi). IUM procesi kao što je LSAISO^(LSAISO) rade u VTL1 dok se drugi procesi izvode u VTL0 . Memorijske stranice procesa koji se pokreću u VTL1 zaštićene su od bilo kakvog zlonamjernog koda koji se izvodi u VTL0 .

Proces podsustavnog servisa lokalnog sigurnosnog autoriteta (LSASS) odgovoran je za upravljanje politikom lokalnog sustava, provjeru autentičnosti korisnika i reviziju, dok je također obrađivao osjetljive sigurnosne podatke kao što su hashovi lozinki i Kerberos ključevi.

Za korištenje sigurnosnih prednosti VSM -a, LSAISO trustlet koji radi u VTL1 komunicira preko RPC kanala s LSAISO procesom koji se izvodi u VTL0 . LSAISO tajne^(LSAISO) su šifrirane prije nego što se pošalju u LSASS , a stranice LSAISO- a su zaštićene od bilo kakvog zlonamjernog koda koji se izvodi u VTL0 .

Mogući uzrok visoke potrošnje CPU-a LSAISO procesa^{(Possible cause of LSAISO process high CPU usage)}

U sustavu Windows 10, LSAISO proces^{(LSAISO process)} se izvodi kao proces izoliranog korisničkog načina^{(Isolated User Mode)} ( IUM ) u novom sigurnosnom okruženju koje je poznato kao Virtual Secure Mode (VSM).

Aplikacije i upravljački programi koji pokušavaju učitati DLL (Dynamic Link Library) u IUM proces, ubaciti nit ili isporučiti APC korisničkog načina rada mogu destabilizirati cijeli sustav. Ova destabilizacija može pokrenuti visoku upotrebu LSAISO CPU^{(LSAISO CPU)} -a u sustavu Windows 10^{(Windows 10)} .

Kako riješiti problem visoke potrošnje CPU-a LSAISO procesa^{(How to fix LSAISO process high CPU usage issue)}

Da biste riješili ovaj problem, Microsoft preporučuje korištenje jedne od sljedećih metoda.

1. Koristite proces eliminacije.
2. Provjerite ima li APC-a u redu čekanja.

Sada, idemo u detalje za dva preporučena rješenja.

1] Koristite proces eliminacije^{(1] Use the process of elimination)}

Uobičajeno je da neke aplikacije (kao što su antivirusni programi) ubacuju DLL^(DLLs) -ove ili APC-ove u red čekanja u^(APCs) LSAISO proces^(LSAISO) . To uzrokuje da LSAISO proces doživi veliku upotrebu CPU -a.

U ovom scenariju, metoda rješavanja problema “ procesa eliminacije^{(process of elimination)} ” zahtijeva da onemogućite aplikacije i upravljačke programe sve dok se skok CPU - a ne ublaži. Nakon što utvrdite koji softver uzrokuje problem, obratite se dobavljaču za ažuriranje softvera.

2] Provjerite ima li APC-a u redu čekanja^{(2] Check for queued APCs)}

U ovom scenariju najprije ćete morati preuzeti besplatni alat za otklanjanje pogrešaka sustava Windows (WinDbg) . Alat je također uključen^{(tool is also included)} u Windows Driver Kit (WDK).

Nakon što preuzmete alat WinDbg , možete nastaviti s dolje navedenim koracima kako biste odredili koji upravljački program stavlja APC u red čekanja na LSAISO .

Napomena:^(Note:) Ne preporučuje se potpuni dump memorije jer bi zahtijevao dešifriranje ako je VSM omogućen na sustavu.

Da biste omogućili ispis kernela, učinite sljedeće:

• Pritisnite tipku Windows + R. U dijaloškom okviru Pokreni upišite ^(Run)kontrolni sustav^{(control system)} , pritisnite Enter da otvorite aplet sustava na ^(System)upravljačkoj ploči^{(Control Panel)} , a zatim odaberite Napredne postavke sustava^{(Advanced system settings)} .
• Na kartici Napredno^(Advanced)  u  dijaloškom okviru Svojstva sustava^{(System Properties)}  odaberite  Postavke ^(Settings ) u području  pokretanja i oporavka^{(Startup and Recovery)}  .
• U  dijaloškom okviru  Startup and Recovery odaberite ^{(Startup and Recovery)}Dump memorije kernela^{(Kernel memory dump)}  na  padajućem popisu Write debugging information .
• Zabilježite lokaciju Dump datoteke^{(Dump File)} koju ćete  koristiti u  koraku 5^{(step 5)} , a zatim kliknite U redu^(OK) .

2. Kliknite gumb Start , pronađite i kliknite unos Windows Kits na izborniku ^{(Windows Kits)}Start , zatim odaberite WinDbg(x64/x86) za pokretanje alata.

https://msdl.microsoft.com/download/symbols

4. Zatim, na izborniku Datoteka^(File)  , kliknite  Open Crash Dump .

5. Dođite^(Browse) do lokacije datoteke ispisa kernela koju ste zabilježili u koraku 1, a zatim odaberite Otvori^(Open) . Provjerite datum na .dmp datoteci kako biste bili sigurni da je novostvorena tijekom ove sesije rješavanja problema.

6. U naredbenom^(Command)  prozoru upišite  !apc , pritisnite Enter.

Dobit ćete sličan izlaz kao što je prikazano u nastavku.

7. Pretražite rezultate za LsaIso.exe . Ako je upravljački program pod nazivom “ <ProblemDriver>.sys ” naveden pod LsaIso.exe , kao što je prikazano u izlazu iznad – kontaktirajte dobavljača, a zatim ih uputite na ovaj Microsoftov dokument^{(Microsoft document)} radi preporučenog ublažavanja za izolirani korisnički način^{(Isolated User Mode)} ( IUM ) procesi.

Ako nijedan upravljački program nije naveden pod Lsaiso.exe , to znači da LSAISO proces nema APC^(APCs) -ove u redu čekanja .

That’s it!

Fix LSAISO process high CPU usage in Windows 10

Some users might be faced with the problem in which the LSAISO.exe (LSA Isolated) process experiences high CPU usage on a Windows 10 computer. The process is associated with Credential Guard & Key Guard. In this post, we have a look at the possible cause and the recommended solution to this issue.

LSAISO process high CPU usage

VSM uses isolation modes that are known as Virtual Trust Levels (VTL) to protect IUM processes (also known as trustlets). IUM processes such as LSAISO run in VTL1 while other processes run in VTL0. The memory pages of processes that run in VTL1 are protected from any malicious code that is running in VTL0.

The Local Security Authority Subsystem Service (LSASS) process is responsible for managing the local system policy, user authentication, and auditing while it also handled sensitive security data such as password hashes and Kerberos keys.

To use the security benefits of VSM, the LSAISO trustlet that runs in VTL1 communicates through an RPC channel with the LSAISO process that is running in VTL0. The LSAISO secrets are encrypted before they are sent to LSASS, and the pages of LSAISO are protected from any malicious code that is running in VTL0.

Possible cause of LSAISO process high CPU usage

In Windows 10, the LSAISO process runs as an Isolated User Mode (IUM) process in a new security environment that is known as Virtual Secure Mode (VSM).

Applications and drivers that try to load a DLL (Dynamic Link Library) into an IUM process, inject a thread, or deliver a user-mode APC may destabilize the entire system. This destabilization can trigger the high LSAISO CPU usage in Windows 10.

How to fix LSAISO process high CPU usage issue

To resolve this issue, Microsoft recommends using one of the following methods.

1. Use the process of elimination.
2. Check for queued APCs.

Now, let’s delve into details for the two recommended solutions.

1] Use the process of elimination

It is common for some applications (such as antivirus programs) to inject DLLs or queue APCs to the LSAISO process. This causes the LSAISO process to experience high CPU usage.

In this scenario, the “process of elimination” troubleshooting method requires that you disable applications and drivers until the CPU spike is mitigated. After you determine which software is causing the problem, contact the vendor for a software update.

2] Check for queued APCs

In this scenario, you’ll need to first download the free Windows Debugging (WinDbg) tool. The tool is also included in the Windows Driver Kit (WDK).

Once you have the WinDbg tool downloaded, you can then proceed with the steps outlined below to determine which driver is queuing an APC to LSAISO.

Note: A complete memory dump is not recommended because it would require decryption if VSM is enabled on the system.

To enable the kernel dump, do the following:

• Press Windows key + R. In the Run dialog box, type control system, hit Enter to open the System applet in Control Panel, and then select Advanced system settings.
• On the Advanced tab of the System Properties dialog box, select Settings in the Startup and Recovery area.
• In the Startup and Recovery dialog box, select Kernel memory dump in the Write debugging information drop-down list.
• Make a note of the Dump File location to use in step 5, and then click OK.

2. Click the Start button, locate and click Windows Kits entry on the Start menu, then select WinDbg(x64/x86) to launch the tool.

https://msdl.microsoft.com/download/symbols

4. Next, on the File menu, click Open Crash Dump.

5. Browse to the location of the kernel dump file that you noted in step 1, and then select Open. Check the date on the .dmp file to make sure that it was newly created during this troubleshooting session.

6. In the Command window, type !apc, hit Enter.

You’ll receive a similar output as shown below.

7. Search the results for LsaIso.exe. If a driver that is named “<ProblemDriver>.sys” is listed under LsaIso.exe, as shown in the output above – contact the vendor, and then refer them to this Microsoft document for the recommended mitigation for the Isolated User Mode (IUM) processes.

If no drivers are listed under Lsaiso.exe, this means that the LSAISO process has no queued APCs.

That’s it!

Related posts

• Kako riješiti problem visoke potrošnje CPU-a GSvr.exe u sustavu Windows 10

• Kako promijeniti prioritet procesa procesora u sustavu Windows 10

• 7 načina da popravite kritični proces koji je umro u sustavu Windows 10

• Popravite MoUSO Core Worker Process u sustavu Windows 10

• Kako popraviti visoku upotrebu CPU-a u sustavu Windows 10

• 3 načina da ubijete proces u sustavu Windows 10

• Kako popraviti visoku upotrebu CPU-a procesom mirovanja sustava

• Nije moguće postaviti prioritet procesa u Upravitelju zadataka sustava Windows 10

• Popravite COM Surogate visoku upotrebu CPU-a ili diska u sustavu Windows 11/10

• Popravi pogrešku ID-a događaja 7031 ili 7034 kada se korisnik odjavi s računala sa sustavom Windows 10

• Što je lsass.exe u sustavu Windows 10 i kako znati je li virus?

• Popravite nedostatak NTLDR-a, pritisnite Ctrl-Alt-Del za ponovno pokretanje pogreške u sustavu Windows 10

• Ikona Fix Sticky Notes na programskoj traci nije kombinirana u sustavu Windows 10

• Riješite problem ERR_CONNECTION_TIMED_OUT u Chromeu u sustavu Windows 10

• Popravite pogrešku plavog zaslona aksfridge.sys u sustavu Windows 10

• Popravite veliku upotrebu procesora NT kernela i procesa u sustavu Windows

• Što je proces splwow64.exe u sustavu Windows 10 i mogu li ga onemogućiti?

• Partner za popravak nije se povezao s pogreškom usmjerivača u TeamVieweru u sustavu Windows 10

• Ne mogu se spojiti na Xbox Live; Riješite problem s Xbox Live Networkingom u sustavu Windows 10

• Popravite BSOD pogrešku Ntfs.sys Failed BSOD u sustavu Windows 10