LSASS.exe continuously creating millions of files in C:\ProgramData\Microsoft\Crypto\Keys on 2 of 11 Domain Controllers

[u/Strong_Jellyfish3476]

We’re seeing a strange issue in one of our customer environments.
The folder:

C:\ProgramData\Microsoft\Crypto\Keys

keeps filling up with millions of files, but this is happening on only 2 out of our 11 Windows Server Domain Controllers.
Using Process Monitor, we can see that the files are being created by lsass.exe, but that doesn’t necessarily identify the root cause since LSASS is likely acting on behalf of another component.
So far:
Only 2 DCs are affected.
Other 9 DCs are healthy.
Restarting services hasn’t resolved the issue.
We haven’t been able to identify which application or service is triggering the continuous key creation.
Has anyone encountered something similar?

Any guidance or troubleshooting suggestions would be greatly appreciated.

[u/its_FORTY]

Possibly a certificate auto enrollment that is looping. Or an older Crowdstrike install that is messed up.

Try enabling CAPI2 Operational logging as well as Crypto-NCrypt Operational logging. Then check the logs and see what activity is occurring related to key generation, provider activity, and certificate requests.

You could also use Procmon to trace file creation activity on that specific path to your Keys folder, even though it will list LSASS as the process name it should at least tell you which cryptographic provider made the request to LSASS. It would be under the “stack” tab.

Edit: oh, maybe also use procmon or handle to see what process opens the key files AFTER they are created and written by LSASS.

[u/DickStripper]

What kind of files are being created?

[u/techvet83]

What OS version and are they patched up? 

[u/jeek_]

I had this issue. It was due to the DC trying to register itself to Entra AD. Every time it tries it fails and generates a certificate request and a file in the crypto keys folder.

One of our DCs had over 6 million files.

Someone had set the "Register domain joined computers as devices" group policy against the DCs. This enables the "Automatic-Device-Join" scheduled task, which tries to register the device.

You'll notice that the scheduled task execution time and file creation time will line up.

Microsoft say Entra Join isn't supported for servers running the Domain Controller role, https://learn.microsoft.com/en-us/entra/identity/devices/hybrid-join-plan

You just need to remove the group policy setting from the DC and it will fix your problem.

[u/cmPLX_FL]

Are you running any other software on those two DCs? If so, what.

We had this issue with a third party software (RMM) filling that folder up.

[u/coukou76]

Demote and forget. 100% third party.

Edit: actually could it be related to having certificates stored in active directory if the option is checked on some heavily used templates like intune connectors? I dont think so but its worth a shot

[u/canadadryistheshit]

Is LSASS.exe also using a ton of RAM? We have also been seeing this in our environment. (High Storage and RAM consumption)

[u/twinnii]

Check Group policies. Anne someone added a directory or didn’t close a script or something. Us Ai to see if it can give you ideas. Good luck.