Win11 High Disk Utilisation

[KarlGoddard]

I'm currently looking into a bit of a puzzler...

 

We have a few PCs that, after having Win11 deployed suffer from high disk utilisation, when I say high I mean 100%. The process causing causing the high disk writes is LSAS. After running procmon, LSAS is writing to C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Diagnostic.log continually. On some PCs the high disk util subsides after 10 mins, others it literally makes the PC unusable.

 

We've done the usual checks for malware / nasties, disabled pretty much every service feasible, removed pretty much every bit of software we think may cause the issue. Removed pretty much all GPOs. Disabled Core Isolation, thinking it may be a TPM related issue - no joy.

 

Reset profiles / appdata - no joy.

 

Doesn't happen with Win10, only Win11 - a clean iso deployment via mdt. The high disk util happens on different makes/models of PC & hardware - HP Prodesks, Stone Desktops, HP Laptops, so it's not a driver issue.

 

Clutching at straws, I remapped my home directory / profile etc to a temp share I created on a different server, not our usual staff/pupil file servers. The problem suddenly went away. Set the paths back to the original file servers, the problem re-appeared.

 

This would lead you to think that it must be related to staff file server(s)... but it doesn't affect every user or pc.

 

Any ideas where I should / could look at next? As any pointers would be appreciated.

 

Thanks

[Tai.ly]

Hi Karl, did you ever find a solution to this issue? We are experiencing a similar scenario.

[Dos_Box]

 

Sorry. I hope he gets back to you soon @Tai.ly, but it was too good to resist!

[mikes]

We didn't have high disk usage based on the resource monitor, but we once had an issue where our SAN was severely loaded (turned out it was Impero trying to compress its log files, failing due to low disk space, and trying again over and over maxing out the HDD usage when doing so) - it would cause our students to take 20+ minutes to log on and this was even with local profiles - can't see how it would cause local HDD  usage though unless offline files is trying to sync?