Comment #27 on issue 374624 by
jd...@ionpcs.net: Running chrome causes 100%
I am working on this issue right now.
Using some clues from you all here, I've tracked it down this.
Process explorer shows a security token request and termination loop
happening under lsass.exe, with token being <LaptopName>\<account>:1c42f
Such as: Smith_VAIO\John:1c42f
Upon inspection with Process Monitor, we see the following:
11:34:57.3492434 AM lsass.exe 908 RegQueryKey HKLM SUCCESS Query:
HandleTags, HandleTags: 0x0
11:34:57.3492833 AM lsass.exe 908 RegOpenKey
HKLM\Software\Microsoft\Windows
NT\CurrentVersion\ProfileList\S-1-5-21-563832473-1690269938-841482641-1000
SUCCESS Desired Access: Read
11:34:57.3493295 AM lsass.exe 908 RegQueryValue
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList\S-1-5-21-563832473-1690269938-841482641-1000\ProfileImagePath
SUCCESS Type: REG_EXPAND_SZ, Length: 28, Data: C:\Users\John
11:34:57.3493613 AM lsass.exe 908 RegQueryValue
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList\S-1-5-21-563832473-1690269938-841482641-1000\ProfileImagePath
SUCCESS Type: REG_EXPAND_SZ, Length: 28, Data: C:\Users\John
11:34:57.3493926 AM lsass.exe 908 RegCloseKey
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList\S-1-5-21-563832473-1690269938-841482641-1000
SUCCESS
11:34:57.3495197 AM lsass.exe 908 CreateFile
C:\Users\John\AppData\Roaming\Microsoft\Protect\S-1-5-21-563832473-1690269938-841482641-513\Preferred
PATH NOT FOUND Desired Access: Generic Read, Disposition: Open, Options:
Sequential Access, Synchronous IO Non-Alert, Non-Directory File,
Attributes: HS, ShareMode: Read, AllocationSize: n/a, Impersonating:
Smith_VAIO\John
This behavior loops.
Sometimes throwing in:
11:34:57.1073869 AM lsass.exe 908 CreateFile
C:\Users\John\AppData\Roaming\Microsoft\Protect\CREDHIST SUCCESS Desired
Access: Generic Read/Write, Disposition: OpenIf, Options: Synchronous IO
Non-Alert, Non-Directory File, Random Access, Attributes: HS, ShareMode:
None, AllocationSize: 0, Impersonating: Smith_VAIO\John, OpenResult: Opened
11:34:57.1074461 AM lsass.exe 908 QueryStandardInformationFile
C:\Users\John\AppData\Roaming\Microsoft\Protect\CREDHIST SUCCESS
AllocationSize: 24, EndOfFile: 24, NumberOfLinks: 1, DeletePending: False,
Directory: False
11:34:57.1074769 AM lsass.exe 908 CreateFileMapping
C:\Users\John\AppData\Roaming\Microsoft\Protect\CREDHIST FILE LOCKED WITH
WRITERS SyncType: SyncTypeCreateSection, PageProtection:
11:34:57.1075034 AM lsass.exe 908 QueryStandardInformationFile
C:\Users\John\AppData\Roaming\Microsoft\Protect\CREDHIST SUCCESS
AllocationSize: 24, EndOfFile: 24, NumberOfLinks: 1, DeletePending: False,
Directory: False
11:34:57.1075669 AM lsass.exe 908 CreateFileMapping
C:\Users\John\AppData\Roaming\Microsoft\Protect\CREDHIST SUCCESS SyncType:
SyncTypeOther
11:34:57.1076805 AM lsass.exe 908 CloseFile
C:\Users\John\AppData\Roaming\Microsoft\Protect\CREDHIST SUCCESS
So...Using that info, I went to the
path "C:\Users\John\Appdata\Roaming\Microsoft\Protect\" and found one
folder with a random guid that was created days ago. lsass.exe was
currently still in a 'stuck' state, when I deleted this guid folder, and
another one was immediately created with a new guid. The next step is
probably unnecessary, but I deleted the newly created guid folder as well,
and this time it did not respawn. lsass.exe processor time was back to
normal. I attempted to close chrome, at which point it closed properly. I
reopened chrome, observed lsass use some cpu for about 10 seconds, then
stop. I closed chrome, and the process terminated properly yet again. I
then reopened chrome to observe the same behavior as previous (normal
behavior).
So, conclusion, the folder located
at "C:\Users\<username>\appdata\roaming\microsoft\protect\<guid>" must be
deleted.
That worked in my case.
Hope you value the info!