Citrix Offline Plugin can cause High CPU from Credential Guard & Key Guard

Citrix Offline Plugin can cause High CPU from Credential Guard & Key Guard

book

Article ID: CTX341704

calendar_today

Updated On:

Description

In task manager, you might see Credential Guard & Key Guard using high CPU. If you inspect the details, you will find that the process name is LsaIso.exe. 
Credential Guard & Key Guard using high CPU
 

Environment

Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.

Resolution

A possible cause can be Citrix Offline Plugin. This is a legacy application that is not removed when Receiver or Workspace app is removed. 

If Citrix Offline Plugin is installed on the computer, uninstall this and reboot to verify that this is the cause of the high CPU for Credential Guard & Key Guard. 

If the CPU is still high for Credential Guard & Key Guard, follow the steps in this Microsoft article to identify other applications or drivers might have loaded into this process.   https://docs.microsoft.com/en-us/troubleshoot/windows-client/performance/lsaiso-process-high-cpu-usage 

Problem Cause

In Windows, the LsaIso.exe process runs as an Isolated User Mode (IUM) process in a new security environment that is known as Virtual Secure Mode (VSM).  Applications and drivers that try to load a DLL into an IUM process, inject a thread, or deliver a user-mode APC may destabilize the entire system. This destabilization can include the high LSAISO CPU scenario.
See here in this sample memory dump, ctxpidmn is loaded in the thread:
driver loaded in the lsaiso.exe thread

Issue/Introduction

When troubleshooting performance issues, review all the programs installed and check for legacy or unsupported products that might be causing your issue.