一些用户可能会遇到LSAISO.exe（LSA 隔离）进程在Windows 10计算机上遇到高 CPU 使用率的问题。^{(high CPU usage)}该过程与Credential Guard & Key Guard相关联。在这篇文章中，我们来看看这个问题的可能原因和推荐的解决方案。

LSAISO 进程 CPU 使用率高

VSM使用称为虚拟信任级别^{(Virtual Trust Levels)}( VTL ) 的隔离模式来保护IUM进程（也称为 trustlet）。IUM进程（例如LSAISO ）在^(LSAISO)VTL1中运行，而其他进程在VTL0中运行。在VTL1^(VTL1)中运行的进程的内存页面受到保护，不受在VTL0中运行的任何恶意代码的影响。

本地安全机构子系统服务 (LSASS)进程负责管理本地系统策略、用户身份验证和审核，同时它还处理敏感的安全数据，例如密码哈希和Kerberos密钥。

为了利用VSM的安全优势，在VTL1^(LSAISO)中运行的LSAISO trustlet^(VTL1)通过RPC通道与在 VTL0 中运行的LSAISO进程进行通信^(VTL0)。LSAISO机密在发送到LSASS之前被加密，并且LSAISO的页面受到保护，不受任何在 VTL0 中运行的恶意代码的^(LSAISO)影响^(VTL0)。

LSAISO 进程 CPU 使用率高的可能原因^{(Possible cause of LSAISO process high CPU usage)}

在 Windows 10 中，LSAISO 进程在称为^{(LSAISO process)}虚拟安全模式^{(Virtual Secure Mode)}(VSM)的新安全环境中作为独立用户模式^{(Isolated User Mode)}​​( IUM ) 进程运行。^(IUM)

尝试将DLL（动态链接库）^{(DLL (Dynamic Link Library))}加载到IUM进程、注入线程或提供用户模式​​APC的应用程序和驱动程序可能会破坏整个系统的稳定性。这种不稳定会触发Windows 10中的高^{(Windows 10)}LSAISO CPU使用率。

如何修复 LSAISO 进程高 CPU 使用率问题^{(How to fix LSAISO process high CPU usage issue)}

若要解决此问题，Microsoft建议使用以下方法之一。

1. 使用消除过程。
2. 检查排队的 APC。

现在，让我们深入研究这两种推荐的解决方案。

1]使用消除过程^{(1] Use the process of elimination)}

某些应用程序（例如防病毒程序）将DLL^(DLLs)或APC^(APCs)排队到LSAISO进程是很常见的。这会导致LSAISO进程遇到高CPU使用率。

在这种情况下，“消除过程^{(process of elimination)}”故障排除方法要求您禁用应用程序和驱动程序，直到CPU峰值得到缓解。确定导致问题的软件后，请与供应商联系以获取软件更新。

2]检查排队的APC^{(2] Check for queued APCs)}

在这种情况下，您需要先下载免费的Windows 调试 (WinDbg)工具。该工具还包含^{(tool is also included)}在Windows 驱动程序工具包^{(Windows Driver Kit)}(WDK) 中。

下载WinDbg^(WinDbg)工具后，您可以继续执行下面概述的步骤，以确定哪个驱动程序将APC排队到LSAISO。

注意：^(Note:)不建议使用完整的内存转储，因为如果在系统上启用了VSM ，则需要解密。^(VSM)

要启用内核转储，请执行以下操作：

• 按Windows键 + R。在“运行”^(Run)对话框中，键入control system ，按 Enter 键在“^{(control system)}控制面板^{(Control Panel)}”中打开“系统^(System)”小程序，然后选择“高级系统设置^{(Advanced system settings)}” 。
• 在“系统属性^{(System Properties)}” 对话框 的“高级^(Advanced) ”选项卡上 ，在“ 启动和恢复^{(Startup and Recovery)}” 区域中选择“设置”  。^(Settings )
• 在“启动和恢复^{(Startup and Recovery)} ”对话框中，  在“ 写入调试信息^{(Write debugging information)}”下拉列表中选择“内核内存转储”。^{(Kernel memory dump)}
• 记下要在步骤 5中使用的^{(step 5)}转储文件^{(Dump File)} 位置 ，然后单击“确定^(OK)” 。

2. 单击开始^(Start)按钮，在开始菜单上找到并单击^(Start)Windows Kits条目，然后选择WinDbg(x64/x86)以启动该工具。

https://msdl.microsoft.com/download/symbols

4. 接下来，在文件^(File) 菜单上，单击 打开故障转储^{(Open Crash Dump)}。

5.浏览^(Browse)到您在步骤 1 中记下的内核转储文件的位置，然后选择打开^(Open)。检查.dmp文件上的日期，以确保它是在此故障排除会话期间新创建的。

6. 在命令^(Command) 窗口中，输入 !apc，按 Enter。

您将收到类似的输出，如下所示。

7. 搜索LsaIso.exe的结果。如果名为“ <ProblemDriver>.sys ”的驱动程序列在LsaIso.exe下，如上面的输出所示 - 请联系供应商，然后将其参考此Microsoft 文档^{(Microsoft document)}以获取针对隔离用户模式^{(Isolated User Mode)}​​( IUM ) 的推荐缓解措施) 过程。

如果Lsaiso.exe^(Lsaiso.exe)下没有列出任何驱动程序，这意味着LSAISO进程没有排队的APC^(APCs)。

That’s it!

Fix LSAISO process high CPU usage in Windows 10

Somе users might bе faced with the рroblem in which the LSAISO.exe (LSA Isolated) process experiences high CPU usage on a Windows 10 computer. The process is associated with Credential Guard & Key Guard. In this post, we have a look at the possible cause and the recommended solution to this issue.

LSAISO process high CPU usage

VSM uses isolation modes that are known as Virtual Trust Levels (VTL) to protect IUM processes (also known as trustlets). IUM processes such as LSAISO run in VTL1 while other processes run in VTL0. The memory pages of processes that run in VTL1 are protected from any malicious code that is running in VTL0.

The Local Security Authority Subsystem Service (LSASS) process is responsible for managing the local system policy, user authentication, and auditing while it also handled sensitive security data such as password hashes and Kerberos keys.

To use the security benefits of VSM, the LSAISO trustlet that runs in VTL1 communicates through an RPC channel with the LSAISO process that is running in VTL0. The LSAISO secrets are encrypted before they are sent to LSASS, and the pages of LSAISO are protected from any malicious code that is running in VTL0.

Possible cause of LSAISO process high CPU usage

In Windows 10, the LSAISO process runs as an Isolated User Mode (IUM) process in a new security environment that is known as Virtual Secure Mode (VSM).

Applications and drivers that try to load a DLL (Dynamic Link Library) into an IUM process, inject a thread, or deliver a user-mode APC may destabilize the entire system. This destabilization can trigger the high LSAISO CPU usage in Windows 10.

How to fix LSAISO process high CPU usage issue

To resolve this issue, Microsoft recommends using one of the following methods.

1. Use the process of elimination.
2. Check for queued APCs.

Now, let’s delve into details for the two recommended solutions.

1] Use the process of elimination

It is common for some applications (such as antivirus programs) to inject DLLs or queue APCs to the LSAISO process. This causes the LSAISO process to experience high CPU usage.

In this scenario, the “process of elimination” troubleshooting method requires that you disable applications and drivers until the CPU spike is mitigated. After you determine which software is causing the problem, contact the vendor for a software update.

2] Check for queued APCs

In this scenario, you’ll need to first download the free Windows Debugging (WinDbg) tool. The tool is also included in the Windows Driver Kit (WDK).

Once you have the WinDbg tool downloaded, you can then proceed with the steps outlined below to determine which driver is queuing an APC to LSAISO.

Note: A complete memory dump is not recommended because it would require decryption if VSM is enabled on the system.

To enable the kernel dump, do the following:

• Press Windows key + R. In the Run dialog box, type control system, hit Enter to open the System applet in Control Panel, and then select Advanced system settings.
• On the Advanced tab of the System Properties dialog box, select Settings in the Startup and Recovery area.
• In the Startup and Recovery dialog box, select Kernel memory dump in the Write debugging information drop-down list.
• Make a note of the Dump File location to use in step 5, and then click OK.

2. Click the Start button, locate and click Windows Kits entry on the Start menu, then select WinDbg(x64/x86) to launch the tool.

https://msdl.microsoft.com/download/symbols

4. Next, on the File menu, click Open Crash Dump.

5. Browse to the location of the kernel dump file that you noted in step 1, and then select Open. Check the date on the .dmp file to make sure that it was newly created during this troubleshooting session.

6. In the Command window, type !apc, hit Enter.

You’ll receive a similar output as shown below.

7. Search the results for LsaIso.exe. If a driver that is named “<ProblemDriver>.sys” is listed under LsaIso.exe, as shown in the output above – contact the vendor, and then refer them to this Microsoft document for the recommended mitigation for the Isolated User Mode (IUM) processes.

If no drivers are listed under Lsaiso.exe, this means that the LSAISO process has no queued APCs.

That’s it!

Related posts

• 如何在Windows 10修复GSvr.exe高CPU usage问题

• 如何在Windows 10中更改CPU Process Priority

• 7 Ways至Windows 10中的Fix Critical Process Died

• 修复 Windows 10 中的 MoUSO 核心工作进程

• 如何在Windows 10上Fix High CPU Usage

• Fix Sticky Notes TaskBar上的图标在Windows 10中不组合

• 如何修复 Windows 10 上的“iastordatasvc”高 CPU 使用率

• 修复“您的 PC 的 CPU 与 Windows 8/10 不兼容”错误

• 什么是 Shell 基础架构主机进程，它是否安全？

• Windows 10 Chrome中的Fix ERR_CONNECTION_TIMED_OUT issue

• Windows 10中的splwow64.exe进程是什么，我可以禁用吗？

• 什么是lsass.exe在Windows 10中，怎么知道它是否是Virus？

• 无法连接到Xbox Live; Windows 10中的Fix Xbox Live Networking issue

• Fix Access Control Entry在Windows 10中腐败错误

• Windows 10中的Fix AKSFridge.sys Blue Screen error

• Fix Ntfs.sys上Windows 10失败BSOD Error

• Windows 10中的Device Census（deviceCensus.exe）文件是什么？

• Fix NTLDR缺失，Press Ctrl-Alt-Del在Windows 10重新启动错误

• 无法在Windows 10 Task Manager中设置Process Priority

• 如何System Idle Process到Fix High CPU Usage