Skip to main content

schedul2 and lsass.exe constantly > 20% CPU

Thread needs solution

Windows 10 x64 version 1607 (Build 14393.105) german
ATIH 2017 Build 5534 - Update from ATIH 2016

Logged on as a standard user the following processes consume contantly more the 20% of available CPU (Intel Core i5 2500):
- schedul2.exe
- lsass.exe

With no explicitely started user program it should be a "quiet" system.

If I logon as a priviledged user it is a "quiet" system!

Does anyone has the same issue? Could it corrected?

I am asking this before doing a clean installation of ATIH 2017.

Thank you.

Attachment Size
taskmanager_details.jpg 63.29 KB
0 Users found this helpful

Other than a few minutes after the computer startsup or when a backup is actually running, scheduler service CPU utilization is at 0%.  I'm running Windows 10 Pro x64 v1607 (14393.105) and Acronis 2017 5534.  I upgraded from 2016 v6571 to 2017 beta 1, to beta 2, to 5534 and haven't noticed any major resource use on either of my home systems. 

How often do your backups run (any Non-stop backup jobs?).  I stop 3 services in 2017 and set them to disabled as I don't use them to free up unnecsary processes, but doesn't look related:  

afcdpsrv = Acronis Nonstop Backup Service
ArcSch2Svc = Acronis Scheduler 2 Service
syncagentsrv = Acronis Sync Agent Service
mobile_backup_server = Acronis Mobile Backup Server
mobile_backup_status_server = Acronis Mobile Backup Status Server

Looks like the documenation hasn't been updated for 2017 yet, but here is the services information from 2016

------------------------------------------------

Your CPU utilization looks like it is highest with lsass.exe.  Are you sure that process is running with the lsass.exe under System32?  That file is often associated with viruses if it's running from a different location

------------------------------------------------

What is your system authenticating to so often? Do you have any system encryption and/or protected files/folders?

Protected Storage Service

The Protected Storage Service component provides support for the Protected Storage service, which runs within the lsass.exe process. This service provides protected storage for sensitive data from users, processes, and services, that are not authorized access to the data. Sensitive data typically includes passwords and encrypted data.

lsass.exe using lots of CPU--WTF is it?

lsass = "Local Security Authentication Subystem" 

It's responsible for:
- validating login credentials (i.e. username/password pairs) for local logins (that is, logins to your workstation in a workgroup environment)
- passing login credentials to your domain controller and getting responses for domain logins
- enforcing some aspects of local security policy (which accounts and groups have which rights, which accounts and groups can login at what times and via what means, etc.) 
- running the "protected storage" service

To this end it hosts three services, "PolicyAgent", "ProtectedStorage", and "SamSs" (security authorization monitor subsystem)
Check the output of tasklist /svc - if there are any OTHER services in your lsass process, report back here. And google on the additional service names. 
(they REALLY love to label things "subsystems" in Windows...)

None of the above except "protected storage" should be particularly taxing, as logins don't happen that often... unless something on your network is repeatedly attempting logins (maybe network share access) to your machine. Does the problem go away if you disconnect the Ethernet cable? 

"Protected storage" is exactly that, a secure area of memory that is protected by encryption and by the various controls on cross-process access to memory. Does this heavy CPU usage by lsass happen to correlate with heavy CPU usage by anything else at the same time?

Some more facts

Using properties from process explorer (sysinternals) I found the culprit:
- lsass.exe is started from wininit
- schedul2.exe is started at boottime from services
- TrueImageMonitor is started at logon of unpriviledged user
- Killing TrueImageMonitor results promptly in a "quiet" system

After killing TrueImageMonitor I can still explore tib-files.

So I think it is a priviledge problem within ATIH 2017 since I did not notice that behaviour in ATIH 2016 and it does not occur when I logon as a priviledged user.

 

PS:

Attachment Size
389600-133141.jpg 328.13 KB

Good to know. I haven't tested under a non-privileged account yet, but will.  With trueimagemonitor killed in taskmanager, my backup still seems to run when I launch it and it didn't return when I launched Acronis again or when running a backup.  Now that it's disabled,   I just don't see the little notification in the system tray when a backup is running or if a backup was cancelled or failed.  If you can live without that, you can disable it from startup on the non-privileged user account. 

Solved!

Finally I did a clean install from a priviledged user and the problem has gone.

IIRC I did the previous install from the unpriviledged user of my sytem. And that probably caused the autorun entry for that unprivledged user.

Within program feedback I will point to this entry.

 

 

Hello,

Also I have this problem on all fifteen PCs!
The CPU utilization is partly so high, that one can no longer work properly.
Is there a way to stop the start of "TrueImageMonitor"?

Andy, is it the Trueimagemonitor process that is constantly running and causing the CPU to saturate? Can you post some screenshots?

You should be able to disable the service, but may prevent some functionality. However, depending on how the software was installed (as in the case of AcroBS, posted above), the software was not installed with maximum privileges and, as a result, services did not register correctly. I would try removing the software and re-installing "fresh" on a one machine. Make sure that you uninstall with an admin account and reboot to update the registry. Then, download the latest installer and before you install, right click and "run as administrator" even if already logged in with an admin account. Due to Windows UAC, unless you install with the "run as admin" option, you are not using the admin accounts full potential which may be required to modify system services and/or .dll files.

Looking Screenshot. I have the version 5554 During the installation I entered the admin-data in the UAC. Now I have TI uninstalled and with rightclick, as administrator, installed. That unfortunately did not help. When I quit TrueImageMonitor in Task Manager, or uninstall the whole program, I have 0% CPU usage.

 

EDIT:

I have tested something else.
If you install the program under a non-privileged account, the problem occurs immediately after the installation.
If you log on to the same PC with an Admin account and install TI2017, then everything is fine. Also, when you log in again with the non-privileged account.

Attachment Size
395488-134317.jpg 144.01 KB

Elevated Admin account is reqired for application install as you have found out.  Hope things are smooth for you now.

An elevated account is also required to launch the appliction too - it needs to run with UAC which requires admin elevation.

This is not a user-level application by default.  If you want users to be able to launch the application, you need to put them in the "Backup Operators" group from computer management >>> local users and groups >>> groups >>> backup operators.

OK. It is nevertheless strange.
If the UAC comes with the installation, I enter the user name and password of the admin account. So far it has been enough with every other program. It is also the first time I have TI installed on the clients.
Users may not have elevated rights.
But now I know :-)         Thank you very much!

Yeah, there are other applicaitons that requier UAC to run as well - most of these run with admin privileges as well and will also prompt UAC and request that you enter the credentials or just fail too.  

Here's the Microsoft KB article about it (going back to Windows 7, but still applies through Windows 10)...  Pretty much any backup application that relies on admnistrative access needed to start VSS and/or backup files/folders that also have admin persmissions set on them (most of the OS folder path), will need admin access to back those up.  Otherwise, any computer user could just start modifying, changing, deleting these files/folders and render the computer unbootable.

An Application Cannot Run as a Standard User

 

Hello

I have the same problem with schedul2.exe but only IF I login as Admin. I have not this problem as restricted user.

Could you please help?

 

Greeetings and thanks!

 

EDIT: my first install was as restricted user with elevated right. I believe I had that problem then as restricted user too. As "workaround" I had uninstalled. Then I reinstalled with Admin account ...

My best advice is that when you wish to run the applicaiton in the admin account user session that when you change from the restricted user account to the admin account you do so by using the Power Options Menu choice of Sign Out, then select Restart from the Power Options Menu, then finally logon as the admin user. 

One caveat in this is that if you do not have a password set for the Restricted user account upon restart the machine will automatically boot into the Restricted user account.  The workaround is that when you Sign Out of the Restricted user session you then click on the Admin account icon on the lower left corner of the screen prior to doing the Restart.  This will then open to the logon screen and allow selection of which account you want to use.

Thank you, but this was not the problem. Even after a reboot I had this problem.

However: it seems the described trick above with deactivating the True Image Monitor works here too (was necessary to deactivate for Admin-Account).

Glad you got the behavior corrected.  I would encourage you to send feedback using the in app Feddback feature found in the Help screen.  Reporting gets the problem in front of the developement team so that problems can be addressed.

I sent this detailed as Support case (not just as Feedback) to Acronis Support (DE).

I will report it here, if I have news ...

I have Acronis 2017 update. I updated my Acronis 2016 which did not have below problems. I am currently logged in with administrative rights.

I am getting almost 100% CPU usage from Acronis. I go to Task Manager and see that Acronis Mobile Backup Server (32 bit) is taking up 50% and Acronis Mobile Backup Status Server is taking the other 50%. When I end the task of one, the other will move up to 100% CPU usage (actually 99.5%). This happens daily when I boot up. I am only running Edge and Excel right now when it happens.

I have been just shutting of those two processes (which right now drops CPU usage to around 1%).

Attachment Size
397028-134743.png 75.51 KB
397028-134746.png 73 KB

Duane, if you are not using the Acronis Mobile Backup functions then go into the Services.MSC panel and disable them / change the startup type from Automatic to Disabled.

I'll try that but those two services came back, I believe when I ran Acronis (though I didn't see this until about an hour after and it did the 100% CPU usage. I would shut the services down and call up Acronis and at least one would pop back up, something is triggering them.

Attachment Size
397044-134749.png 77.52 KB

Duane, if you stop the service, that only stops them for that Windows session - the next reboot will start them up if you do not set the service from automatic to disabled as well.

If you want, you can use these scripts.  One stops the mobile servies and nonstop backup service (I don't use any of them) and sets them to disable.  

**EDIT** The other starts all of the other services besides these three and sets them back to automatic (just in case).  You can add or remove :: in front of any of he service code to make it active or block it out so you can stop and start the services you want with the click of a button.  Adding :: in front of a line of code comments it out.  Removing :: in front of a line of code will activate it.  

I can only upload .txt files here so download them and rename them from .txt to .bat.  When you run them, be sure to right click and "run as administrator" to ensure they have full administrative access to make the necessary changes. 

 

Attachment Size
397062-134755.txt 2.7 KB
397062-134758.txt 2.68 KB

I had the same problems of super high CPU usage after i upgraded from ATI2016 to ATI2017. on my system (windows 10 pro) the problem only occurs if actually some backup is configured in ATI2017. then with every windows start the CPU usage is that high from the beginning. if i delete any configured backup the CPU usage goes immediately down to normal low and remains that low after windows restart. but without a configured backup ATI2017 is useless of course ;)

i began a support case with aconis support on september 4th, but they couldn't help until now, claiming that i was the only one with that problem. now i see that a lot of users have that problem and that it was debated even 3 days before i opened my support case. maybe acronis support doesn't take notice of this forum. i will send another answer to acronis support hinting them to this forum thread.

meanwhile i uninstalled ATI2017 and i am using ATI2016 again, which does not have that CPU usage problem. i'll try ATI2017 again when the developers have fixed that serious bug.

Duane, launching Acronis GUI should not start any of these services if they have been stopped and the startup type set to DISABLED.  

I keep the mobile services and NSB off and the startup type to disabled and they do not startup - ever.  They do get reset when upgrading to each new version though, but until then stay off as long as they are not only stopped, but set to startup type: disabled.

Likewise, you can disable each of the others in red if you don't need the service it provides and set it to disabled and they should stay off.  

The only one that should remain active is the scheduler service (as I understand things it is needed to function properly).  I use scheduled jobs all the time so have never disabled it myself though. 

:: mmsminisrv = Acronis Managed Machine Service Mini - communicates with Family Dashboard
:: afcdpsrv = Acronis Nonstop Backup Service - performs nonstop backup for partitons
:: ArcSch2Svc = Acronis Scheduler 2 Service - task scheduling for Acronis True Image
:: syncagentsrv = Acronis Sync Agent Service - performs synchronization
:: mobile_backup_server = Acronis Mobile Backup Server - mobile phone backup server service
:: mobile_backup_status_server = Acronis Mobile Backup Status Server - mobile phone status service