Domain Controller - AD Core - AD LSASS Status

How do we verify the results received on the Compass client?

The Compass client is running a WMI query and collecting data from the performance counters periodically to collect the status of the LSASS.  Note that not all this information is not logged, but the results are stored in the following folder location:

\Program Files (x86)\ENow\Mailscape Agent\Cache\NetworkAgentMessage.xml

To capture the LSASS Usage from the DC or RODC manually using PowerShell, please run the following command:

Get-Counter -Counter "\Process(lsass)\% Processor Time" -SampleInterval 2  -MaxSamples 4 | Select-Object @{Name = "CPUUsage"; Expression = {$_.CounterSamples[0].CookedValue}}

Based on how Compass functions, the status of the test is dependent upon the LSASS usage and the actual threshold set in the console. Below is the sample syntax and results from PowerShell:

PS C:\Users\Administrator> Get-Counter -Counter "\Process(lsass)\% Processor Time" -SampleInterval 2  -MaxSamples 4 | Select-Object @{Name =

 "CPUUsage"; Expression = {$_.CounterSamples[0].CookedValue}}

         CPUUsage

         --------

                0

0.772521587590451

                0

                0