PROCESSMicrosoft-signedCritical process
lsass.exeLocal Security Authority Subsystem Service
lsass.exe (Local Security Authority Subsystem Service) enforces the security policy on Windows: it verifies logons, changes passwords, creates access tokens and writes the security log. It is essential, must not be ended, and holds credentials in memory, which makes it a prime target for attackers. The genuine file lives in System32 and is signed by Microsoft.
What lsass.exe does
The Local Security Authority Subsystem Service is the heart of Windows authentication and authorisation. When you sign in, lsass.exe checks your credentials, and on success it builds the access token that determines what you can do. It also handles password changes, enforces the local security policy, and writes entries to the Security event log. On domain-joined machines it drives Kerberos and NTLM authentication and talks to domain controllers over LDAP.
The token lsass builds is what whoami reports; the concepts are in authentication basics.
Why it is critical
lsass.exe is a protected, single-instance process started early in boot by wininit.exe. Windows cannot function without it. If it stops, the system loses its security subsystem and reboots. That is by design: a system that cannot enforce security must not keep running.
Why attackers target it
To do its job, lsass keeps authentication secrets in memory: Kerberos tickets, NTLM hashes, and, in some configurations, more. Credential-theft tools read lsass memory to harvest these and move laterally across a network. Windows counters this with:
- LSA Protection (RunAsPPL): runs lsass as a Protected Process Light so ordinary tools cannot read its memory.
- Credential Guard: isolates secrets in a virtualisation-based secure environment separate from lsass.
Security products alert on unusual processes opening a handle to lsass, which is a strong sign of credential theft.
Resource use
Brief CPU activity during logon, screen unlock, certificate operations and policy refresh is normal. On domain controllers, lsass is one of the busiest processes because it services authentication for the whole domain. On a workstation, sustained high CPU or growing memory is unusual; confirm the process is genuine and, if it is, investigate what is driving repeated authentication (a misconfigured service reconnecting in a loop, for example).
Confirming it is genuine
- One instance only. Several lsass.exe processes is a red flag.
- Path: exactly
C:\Windows\System32\lsass.exe. - Signature: Microsoft, via Properties → Digital Signatures.
- Spelling: beware look-alikes such as
lsas.exe,lsass32.exeorisass.exe.
Do not terminate it to "test" anything; on a healthy system it is meant to be untouchable.
Frequently asked questions
Is it safe to end lsass.exe?
No. Ending it terminates the security subsystem and Windows will shut down or restart, usually with a "critical process died" or a one-minute shutdown warning. There is never a reason to end it manually.
Why is lsass.exe using high CPU or memory?
Occasional spikes accompany logons, group policy processing, certificate operations and Active Directory activity on servers. Sustained high usage on a domain controller can indicate heavy authentication load or LDAP queries; on a workstation it is unusual and worth checking for the correct path and signature.
Why do security tools flag access to lsass.exe?
Because its memory contains authentication material such as Kerberos tickets and password hashes, tools like Mimikatz read lsass memory to steal credentials. Windows Credential Guard and RunAsPPL protect it; alerts on lsass access are a standard detection.
Is lsass.exe a virus?
The genuine process is a single instance in C:\Windows\System32, signed by Microsoft. Malware has used names like lsas.exe, lsass32.exe or a copy in another folder. Check the exact spelling, path and signature.