The domain controller is under a denial-of-service attack. The domain controller is critically low on memory. This is usually caused by inefficient, CPU-intensive operations such as non-indexed queries. One or more other domain controllers failed, and their load transferred to this domain controller because it is now the closest available domain controller.Īn application is placing a heavy load on the domain controller. The domain controller is a primary domain controller (PDC) emulator operations master, and there are either a large number of password lockouts or a large number of expired user accounts. The domain controller is a bridgehead server, and it is compressing large amounts of data because a bulk load must be replicated inter-site. If the overall CPU utilization on the server is too high, users and services that rely on Active Directory Domain Services may experience delays.

The core process (lsass.exe) for Active Directory Domain Services is consuming a lot of CPU resources.

Process monitor windows server 2016