Windows 10- High CPU usage by 'Local Security Authority Process' RRS feed

  • Question

  • My CPU usage has been as such since I upgraded to Windows 10. After about 15 mins of start up the CPU usage increases to 50-60% and remains as such until restart even when the laptop is idle with no other software running. This 50-60% usage is occupied by 'Local Security Authority Process' that includes 4 sub process: Credential Manager, Security Accounts Manager, CNG Key Isolation and Encrypting File System (EFS). To solve issue I have performed a clean install of Windows 10 from DVD but the problem is still there. I have searched the internet for this issue but there is no viable solution.

    Due to high usage of CPU, the cooling fan is always running and my laptop battery life has reduced to half from before. When i was using Win 8.1, idle CPU usage was below 7-8% and battery life was about 6 hrs. now its less than 3 hrs.

    I am happy with all other performances of Win10. but if this CPU usage problem cannot be fixed i will have to go back to Win 8.

    Does anyone know a solution for this issue?

    Thursday, September 10, 2015 12:26 AM

All replies

  • I haven't heard of it before, but you could narrow down the source more by turning on the event tracing providers for those or otherwise getting some representative stack traces.  

    WinSDK Support Team Blog:

    Thursday, September 10, 2015 7:39 PM
  • Same here.

    It's getting me mad.

    It happened to me upgrading to Win 10 Insider Preview 14291.

    It was not the only bug.

    On a double extended screen setting (ever worked smoothly til then) full screen Flash video started to crash constantly the start menu putting it "out of order" (after its auto-reload).... no matter what browser's involved or any attempt to upgrade flash.

    A clean boot (only win services) shows a "loop" of an app that quickly and constantly crashes.... too quick to read which app is (I was only able to read "built-in administrator).

    Thought about a malware action's going on, since Defender blocked and quarantined a Trojan (Pocyx C!Plock) that's available on-line as BrokenBot for Clash of Clans (I'm not an on-line player and it appeared on my environment under the form of a software patch, supposedly .... ;-) ).

    I also noticed a tampering information loop on event viewer involving TPM configuration (disabled on my BIOS as a personal security policy.... after some security issues a couple of my customers had to front after a malware escalation to admin privileges): TPM-WMI was the title of the info item on the loop on event viewer.

    Then I downloaded WMI-Tools to see if suspicious classes and Schedules on Task Scheduler may be present.... confronting them with regedit etc etc (but it's a too long job for my available time)

    Anyway, for a reason or another and having the backup of all that's meaningful for me already saved and aimintg to recover this LSASS annoying resources consumption and all these bugs, I made a clean reset of Win 10.

    And I didn't solve any problem....

    So, 4 are the possible explanation:

    - Win 10 Build 14291.rs1_release 160314-2254 giant bug

    - something that's automatically synced with my Microsoft profile (on OneDrive) or a browser's extension (I use Chrome)

    - something on my network (broadband router etc...., othe LAN devices with other OS) even if I own another laptop with 14291 that doesn't suffer from this issue on the same LAN

    - Russian Hackers so skilled that found the way to cook the TPM chip/boot record/or BIOS stuff (mine is not UEFI) once they got admin privileges through a malware

    Anyway, the most practical way to put LSASS to sleep at 0,2% of CPU, is killing "CNG Key Isolation" sub-process. Ain't a fair way to front the bugs but this is my main machine and I got jobs to finish on the web. And even if CPU consumption seems solved, in any case audio service randomly stops and even Start Menu stops working randomly (no Start Menu expanding and even no right click to get WIN-X menu and no WIN-X menu available in any case.... logout-login restore the stuff, if needed)

    If someone's at MSDN is curious about what we're on about, I attach the log files of the build upgrade to 14291.... "SetupAct.log" and "SetupAct_offline.log" (no, I would like but there's no way to attach logs here in MSDN)

    If of some use, of course I can provide more logs from event viewer, resource monitor, WMI-tool etc etc

    Wednesday, March 23, 2016 4:50 AM
  • I have the same issue on 14291 build, any suggestions ?
    Saturday, March 26, 2016 9:44 PM
  • Hi,

    This is a Windows Desktop Debugging forum. If you have a security concern, here is the Desktop Security forum and specific Win10 Security forum . If you feel it is rather a performance issue, here is the Win10 performance forum.

    Also, the Answers forum on malware and security may be helpful.

    If you wish to use performance analysis tools to investigate why a specific Win10 process causes performance issues on your machine, please say so, and someone should be able to guide you.


    -- pa

    • Edited by Pavel A Monday, March 28, 2016 1:44 PM
    Monday, March 28, 2016 1:41 PM
  • Very useful ;(

    Saturday, May 6, 2017 10:34 PM