I'm copying my question from another board:
on traffic times (about only 250 users), the cpu of the lsass process is becoming high. I didn't see any problem with the db (sql server express), and I also use a cache (iis ouput cache). When a user is trying to access a page that is not cached (usually because of a different query string) the load time is slow. This is a classic ASP website.
To summarize - when there are a few users, all pages are loading fast. on load time (250 users), the main page is still loading fast, because it's cached, but a newly seen page is loading slow. not ASP pages are loading fast.