Issue to defender of Win 2016 server

Question

Hi,
How to ensure Win defender is working fine below? ![72740-a22.png][1] Win 2016 server is having extremely big transport below. How to stop it? ![72871-a25.png][2] [1]: /api/attachments/72740-a22.png?platform=QnA [2]: /api/attachments/72871-a25.png?platform=QnA

Answer 1

If you want to find the cause , you need to trace network traffic and monitor the requests coming from which port. Tool such as Network Monitor and Process Monitor can be considered . However, analysis of log is beyond our forum support level and due to forum security policy, we have no such channel to collect user log information. You may need to analyze by yourself.

Please refer to the following video, see if this can help with you:

lsass.exe high network traffic from the internet FIX! server 2012 r2

Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

Answer 2

Hi ,

How to ensure Win defender is working fine

You can make sure if Windows Defender service is running using this PowerShell command:

Get-Service WinDefend  

If the the service is started , then status will show running.

For your reference:

Windows Defender Antivirus on Windows Server 2016

Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

Win 2016 server is having extremely big transport below. How to stop it? !

Go to resource monitor and then check which process is sending large traffic, like picture below:

It will show you which processes are consuming the most network resources.

Best Regards,

Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Hi,
How to resolve issue below?

Answer 4

So based on my understanding, the server 2016 is a DC and has internet access. Is that right?

Please check the following steps:

Go to windows firewall > Inbound Rules > Active Directory Domain Controller - LDAP (UDP-in) and change the connection to "Allow the connection if it is secure"

For your reference:

How to reduce lsass.exe bandwidth traffic

Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

Answer 5

I've applied the firewall rule and have rebooted server but traffic below is still big