Lsass process consuming high memory on all domain controller running windows server 2019.

On Windows Server 2019 domain controllers, high LSASS memory usage is often normal because LSASS caches Active Directory data in memory to improve performance.

Key points:

• LSASS handles domain authentication and Active Directory management on domain controllers.
• The largest variable memory consumer is the ESE database buffer cache.
• On a 64-bit system, the cache can grow up to the size of the Active Directory database file (NTDS.dit) when there is no other memory pressure.
• If the database is smaller than available RAM, the cache can grow 30 to 40 percent larger than the database size.
• In Windows Server 2019, the ESE version store is calculated at NTDS startup as 10% of physical RAM, with a minimum of 400 MB and a maximum of 4 GB.
• LSASS also commonly uses about 100 MB to 300 MB for fixed components such as code, stacks, heaps, and schema cache.

If the memory usage is causing performance issues, use this approach:

1. Check whether the server is actually under memory pressure, not just showing high LSASS usage.
2. Minimize extra programs on the domain controller, especially monitoring agents and workloads that generate many WMI queries.
3. Check for other processes with significant memory usage that may be competing with LSASS.
4. Keep the server current with recent servicing updates, because quality updates can include fixes for excessive memory utilization.
5. If the issue includes high CPU along with high memory, run Active Directory Diagnostics in Performance Monitor:
   • Open Server Manager or run Perfmon.msc
   • Go to Diagnostics > Reliability and Performance > Data Collector Sets > System
   • Right-click Active Directory Diagnostics and select Start
   • After collection and report compilation, review Reports > System > Active Directory Diagnostics
   • Check Diagnostic Results, especially the Active Directory and Network sections, to identify expensive LDAP queries or remote clients driving load

This is most concerning when LSASS growth is accompanied by slow authentication, LDAP delays, RPC failures, or overall domain controller performance degradation.

• Memory usage considerations for AD DS performance tuning
• How to troubleshoot high Lsass.exe CPU utilization on Active Directory Domain Controllers