CV accessed lsass.exe service

Hello @Marcel,

Thanks for raising this question with us.

The process "Lsass" is described as the following on MS website:

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/troubleshoot-high-lsass.exe-cpu-utilization

Local Security Authority Subsystem Service (Lsass.exe) is the process on an Active Directory domain controller. It's responsible for providing Active Directory database lookups, authentication, and replication.

Given that this client is running AD backups we are going to use the Lsass.exe to authenticate and collect data about AD.

Kind regards

Albert Williams

Hi @Albert Williams 

Thanks for your response.
Yes that was my first thought aswell,

However I was having second thoughts:

• AD backups are running for months now and they never received these alerts until yesterday
• Is GenProcessModuleInfo.exe in any way responsible for these backups?

br

Marcel VIs

Any explanation from CV please?