Skip to main content

NinjaOne Backup — Lockhart High CPU/Disk Usage & ReFS Interaction

Audience: T2 Use when: Lockhart.exe is consuming abnormal CPU or disk I/O — slowing the server or workstation while backups run, or causing disk queue issues overnight.

Normal vs. Abnormal Lockhart Resource Usage

Normal:

  • Lockhart uses elevated disk I/O during the backup window (midnight by default) — this is expected
  • During the initial full backup (first run), CPU and disk usage will be high for hours — also expected
  • After the first run, incremental backups should be much lighter

Abnormal:

  • Lockhart consuming >50% CPU continuously outside the backup window
  • Disk queue length sustained above 2-3 during the backup window on a server with dental databases
  • Lockhart.exe consuming several GB of RAM

The ReFS Connection

NinjaOne's own documentation calls this out: Lockhart.exe can have high disk usage when backing up volumes formatted with ReFS (Resilient File System).

ReFS uses a different on-disk structure that causes Lockhart's block-comparison logic to work significantly harder. Microsoft's guidance for this is in KB article referenced in NinjaOne's troubleshooting docs — in short, ReFS's copy-on-write metadata creates more "changed" blocks than NTFS for the same amount of data change.

# Check filesystem types on all local volumes
Get-Volume | Select DriveLetter, FileSystemType, HealthStatus, SizeRemaining, Size |
Where-Object {$_.DriveLetter} | Format-Table -AutoSize

# If any volume shows ReFS — that's likely the culprit

DTC environment context: Most dental servers use NTFS. ReFS is more common on Hyper-V hosts (VM datastore volumes are sometimes formatted ReFS for its resiliency features). If you're seeing this on an HV01-style host, ReFS is the prime suspect.

Diagnosing High Resource Usage

# Check Lockhart's current CPU and memory usage
Get-Process | Where-Object {$_.Name -like "*Lockhart*" -or $_.Name -like "*lockhart*"} |
Select Name, CPU, @{N='MemMB';E={[math]::Round($_.WorkingSet/1MB,1)}}, Id | Format-Table

# Check disk queue length (elevated = disk bottleneck)
Get-Counter '\PhysicalDisk(*)\Avg. Disk Queue Length' -SampleInterval 5 -MaxSamples 3

# Check which process is causing disk I/O
# (Run as Admin — requires Sysinternals or Process Monitor for full detail)
Get-Counter '\Process(lockhart*)\IO Data Bytes/sec' -SampleInterval 3 -MaxSamples 3

Mitigation Options

Option 1 — Bandwidth/I/O throttling (NinjaOne console) NinjaOne backup plans support bandwidth throttling to limit how aggressively Lockhart uploads to cloud during business hours:

  1. NinjaOne → Organization → Backup → Edit the backup plan
  2. Under Bandwidth Throttling: set a limit during business hours (e.g., 5 Mbps during 8AM–6PM)
  3. This reduces cloud upload pressure but does not limit local NAS write speed

Option 2 — Adjust backup schedule If Lockhart is saturating disk during business hours, the backup window may have shifted or the machine is always running when the job fires:

  1. Confirm the backup plan is set to midnight (DTC standard)
  2. Check that "Run plan immediately if missed" is enabled — this can trigger a daytime run if the machine was off at midnight

Option 3 — For ReFS volumes — convert to NTFS (if appropriate) If the ReFS volume is not a production Hyper-V datastore and the performance impact is unacceptable, converting to NTFS is an option — but requires taking the volume offline. This is a T3/Nate decision for production servers.

Option 4 — Exclusions for large, rarely-changed directories If the server has a specific folder causing the bulk of backup churn (e.g., a temp cache directory), adding an exclusion to the backup plan reduces Lockhart's workload:

NinjaOne → backup plan → Exclusions → add the folder path

If Lockhart Is Consuming Resources Outside the Backup Window

This is abnormal and warrants investigation:

# Check Lockhart's last activity in the log
$logPath = "C:\ProgramData\NinjaRMM\NinjaOneBackup\logs\lockhart.log"
Get-Content $logPath -Tail 50

# Look for: is a job actively running? Or is it stuck/looping?
# A healthy idle Lockhart should show no active job activity

If Lockhart appears stuck in a loop or running a job indefinitely: restart the service and trigger a fresh run. If it recurrs, escalate to NinjaOne support with logs.

Back to top