less than 1 minute read

I logged into work this morning with two critical alerts from System Center Operations Manager from one of our Domain Controllers:

  1. The LSASS process has exceeded the processor utilization threshold
  2. The total number of ATQ threads in use has exceeded one or more thresholds over multiple samples.

The reporting server was not maxing CPU usage, RAM, or system resources. The alert descriptions provided some additional insights. Respectively, they were:

Failure to retrieve the raw performance data for the lsass process via WMI: The error returned was: 'Generic failure ' (0x80041001) and Failure to retrieve the raw performance data for NTDS via WMI: The error returned was: 'Object required' (0x1A8)

The Fix

The solution was to rebuild Performance Counter Library values. This is achieved by navigating to C:\Windows\System32
Run lodctr /R

Error Message: Error: Unable to rebuild performance counter setting from system backup store, error code is 2.

If you encounter the above error, switch directories to C:\Windows\syswow64
Then run lodctr /R

For the above tip, special thanks to this question post.

Leave a comment