Scanner hangs and domain controller processer is 100% loaded

[fma-it]

When scanning domain controllers is seems that the scanner is hanging and never finishing the scans! At the same time the processer load on the domain controllers goes to 100% due to WMI requests.

In the LANsweeper console we get the following error

Wmierror Timed out [Servername] (xxxxxxx.xxxxx.xxxxxx) \root\cimv2


We are running version Version 4.2.0.70 of the scanning service.

I am not able to enclose any logs since my IT Operations team has disabled LANsweeper!

Any suggestions?

[Hemoco]

If you continue having problems, could you contact us at support@lansweeper.com and provide us with the following:
- Your Errorlog.txt, found in Program Files\Lansweeper\Service.
- Output of the report below, preferably in Excel format.

Select tsyserrors.Errorid, tsyserrors.Errortype, tsyserrors.Errormsg,
tsyserrors.Scanserver, tsyserrors.Added
From tsyserrors
Order By tsyserrors.Added Desc

[fma-it]

OK, as soon as my IT department can find the time to initiate this we will give it a go. 🙂

But we need a permanent solution to the issue, how do we go about that?

[fma-it]

How do we know that it is not the LDAP queries that cause the problem?

Do you have any plans on looking further into the issue?

[Hemoco]

fma-it wrote:
How do we know that it is not the LDAP queries that cause the problem?

Because you told me in the first post that "the domain controllers goes to 100% due to WMI requests."

[fma-it]

What would be the idea? It seems to be the domain controller that we scan that have the problem!

[Hemoco]

fma-it wrote:
What would be the idea? It seems to be the domain controller that we scan that have the problem!

You can try to exclude only this domain controller from scanning.
Active scanning will still work (LDAP queries) but there will be no more WMI queries performed on this server.

[Hemoco]

This "might" be the cause of the problem (although we don't have this problem on our win2003 servers)
I suggest you move Lansweeper to a virtual server if possible.

[fma-it]

We have 20 simultainus scans running!

All the Servers are running Windows Server 2003 SP2!

Possible explanation?

http://blogs.technet.com/b/janelewis/archive/2009/12/18/high-cpu-on-wmiprvse-exe-caused-by-memory-leak-dnsprov-dll-windows-2003.aspx

[Hemoco]

This is not a know problem.
How many scanning threads are you running?

There is one known (Microsoft) issue with the LSASS.exe process on domain controllers:
see http://support.microsoft.com/kb/2028484