High CPU utilization on domain controllers when the Knowledge Consistency Checker runs on Windows 2000 Server (833320)

SYMPTOMS

Server programs may stop responding temporarily. Client software that communicates with the server may experience time-out errors or may receive incomplete information from the server. You may also experience high CPU utilization on domain controllers.

CAUSE

This issue may occur in a very large forest structure. For example, in a forest that contains 1,000 sites and 100 domains, the Lsass.exe process may temporarily have high CPU utilization when the Knowledge Consistency Checker (KCC) runs. Because of the high priority of the Lsass.exe and of the KCC processes, programs and services that are running on the domain controller may stop responding. You may experience this issue although the Inter-Site Topology Generation (ISTG) technology is turned off.

WORKAROUND

To work around this issue, use one of the following methods:

Turn off inter-site Topology Generation for the KCC.
Turn off intra-site Topology Generation for the KCC.
Turn off connection translation for the domain controller by using the repadmin /options +disable_ntdsconn_xlate command.

Note If you turn off these KCC tasks, you must maintain them manually.

Note We recommend that you turn off ISTG in large-scaled environments.

MORE INFORMATION

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

244368 How to optimize Active Directory directory service replication in a large network

For additional information about how to use a script to turn off Inter-Site Topology Generation for the KCC, click the following article number to view the article in the Microsoft Knowledge Base:

245610 How to disable the Knowledge Consistency Checker Inter-Site Topology Generation for all sites

For additional information about how to modify Active Directory to turn off KCC inter-site generation and to turn off intra-site generation, click the following article number to view the article in the Microsoft Knowledge Base:

242780 How to disable the Knowledge Consistency Checker from automatically creating replication topology

Note We recommend that you run server programs on dedicated servers that do not also function as domain controllers. Large-scaled environments put a high demand on the available resources of a domain controller. This demand reduces the resources that are available to server programs.