Windows 10: Lsass.exe constantly reading registry for DefaultAuthLevel NAME NOT FOUND - in Process Monitor

I see it relates to DCOM Default Authentication Level, which has in total, 7 fields in the Component Services Windows admin tool. That is in this order, from top of the list to the bottom as it appears; Default, None, Call, Connect, Packet, Packet integrity and Packet Privacy.I only see one resources on the internet, as of yet:"I've found another workaround by setting HKLM\SOFTWARE\Microsoft\Rpc\SecurityService\DefaultAuthLevel=6. This takes effect immediately, and changes outbound RPC to attempt connection with packet privacy"I'm guessing if we count 0 as a value in the dword key, and packet

:)

 

What actually the process LSASS does and why it actually consumes a large amount of bandwidth quota?

What actually the process LSASS does and why it actually consumes a large amount of bandwidth quota? This machine runs on Windows 2016. What are the troubleshooting steps to minimize the bandwidth consumption.

 

Process Monitor 1.2 Released

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.Process Monitor runs on Windows 2000 SP4 with Update Rollup 1, Windows XP SP2, Windows Server 2003 SP1, and Windows Vista as well as x64 versions of Windows XP, Windows Server 2003 SP1 and Windows Vista.

Source: ProcessMonitor

 

Weird system process named Registry"

Upgrading to Windows Insider Preview always enables a process with the name "Registry" running as System account.

The PID is always 96.

Only description is "Registry".

Anyone know what this process i about?