Topic Last Modified: 2006-12-04

The Microsoft® Exchange Server Analyzer Tool examines the Exchange Function Call Log (FCL), the Store.fcl file, for Local Security Authentication Server (Lsass.exe) process component events that exceed a response time of 25 milliseconds.

Exchange FCL LSASS process component events represent Microsoft Exchange Information Store service (Store.exe) function calls to the Local Security Authentication Server (Lsass.exe) process component.

The Local Security Authentication Server process (Lsass.exe) is a security subsystem invoked by other processes to verify account information and logon validation.

Every Exchange client logon causes the server running Exchange Server to send a request to look up the account security identifier (SID) for the client and creates a call within the Local Security Authentication Server (Lsass.exe) process.

If Exchange Server Analyzer finds events in the Store.fcl logging file that reflect a response time of more than 25 milliseconds for Local Security Authentication Server (Lsass.exe) component function calls from the Microsoft Exchange Information Store service (Store.exe), the Exchange Server Analyzer displays an error.

When cross-component calls from the Microsoft Exchange Information Store service (Store.exe) wait for a response, remote procedure call (RPC) threads can back up behind these requests and lead to Exchange Server performance issues such as delays in server responses to clients.

Slow response times for Microsoft Exchange Information Store service (Store.exe) function calls to LSASS can be caused by the following conditions:

Server resource issues related to the number of users who authenticate at the same time.
Network latency between the Exchange server and the Domain Controller or global catalog server.
Server resource bottleneck issues.

To resolve this error, take the following steps:

Consider implementing the NeverPing parameter as described in NeverPing parameter recommended
Run the Exchange Server Analyzer for an additional analysis of server issues such as message and attachment size limits. You can download the Exchange Server Analyzer at "Microsoft Exchange Server Best Practices Analyzer Tool v2.7" (http://go.microsoft.com/fwlink/?LinkId=34705).
Review the articles in the For More Information section of this document.

For More Information

For more information about the Lsass.exe process and memory usage, see Microsoft Knowledge Base article 308356, "Memory usage by the Lsass.exe process on domain controllers that are running Windows Server 2003 or Windows 2000 Server" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=308356).

For more information about Exchange Client Logons and LSASS issues, see Microsoft Knowledge Base article 161938, "Slow Exchange Client Logons Due to Resource Deadlock" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=161938).

For more information about network latency between the Exchange server and the Domain Controller or global catalog server, see the following Exchange Server Team Blog article, "Exchange Does Not Always Use Local GCs" (http://go.microsoft.com/fwlink/?LinkId=69166).

Note:
The content of each blog and its URL are subject to change without notice.

For more information about Server Resource Bottleneck issues, see Processor Bottleneck.

For more information about Exchange Server performance, see the "Performance and Scalability Guide for Exchange Server 2003" (http://go.microsoft.com/fwlink/?LinkId=47576).

For more information about how to troubleshoot Exchange Server performance issues, see "Troubleshooting Microsoft Exchange Server Performance" (http://go.microsoft.com/fwlink/?LinkId=47588).

For more information about how to troubleshoot information store performance, see Microsoft Knowledge Base article 257725, "XADM: How to Collect Diagnostic Data for Information Store Troubleshooting" (http://go.microsoft.com/fwlink/?LinkId=3052&kbid=257725).