I have a user who has been noticing slowdowns with his machine frequently. When investigating his system (Windows Server 2008 R2) processes, we saw that lsass.exe was using 2.4GB of memory. A reboot took it back down to 80MB. It kept happening every day though and today we were able to identify what action he was taking that skyrocketed lsass's memory usage.
All he did was access a web page on another server. This should only be sending his cert with the web page request, correct? Why would a local security process care about that?
Does anybody have any idea what might be going on here and how to fix it?