Skip go content

LsaIso.exe

Windows ProcessMicrosoft Corporation

Catalog search terms lsaiso, lsa isolated, isolated lsa, credential guard

WindowsSystem Component

Isolated LSA. When Credential Guard dey on, dis trustlet dey keep NTLM hashes and Kerberos tickets inside Virtual Secure Mode, far from lsass.exe.

Wetin you need know

Dis one na Isolated LSA, no be second copy of lsass.exe wey you fit kill for RAM.

LsaIso.exe dey run as Isolated User Mode trustlet when Credential Guard dey enabled. lsass.exe still dey authenticate for normal world. Secrets dey stay here. You no fit attach debugger to am.

E safe?
Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.
Same tin wit lsass?
No. Dis one dey isolated
I suppose end am?
No
Feex tok say
If LsaIso dey di list, Credential Guard dey do di work wey Microsoft document. I no go end am make I take "speed up logon." Na dat process make stolen lsass dumps dey come back empty.

Wetin be LsaIso.exe?

LsaIso.exe na di Isolated LSA process. Credential Guard dey move password hashes and Kerberos TGTs come here so dat normal lsass.exe memory no go useful to steal.

Wetin e dey do?

E dey talk to lsass.exe through restricted RPC channel. E no dey host third-party drivers. E no dey draw lock screen.

Wetin make am dey run?

Di PC get virtualization-based security and Credential Guard turned on. Windows 11 dey enable dat one by default for hardware wey qualify. If LsaIso no dey, e usually mean say Guard dey off, no be say lsass vanish.

Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'LsaIso.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the file-identity guide to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

E dey safe?

Check dis running file

Microsoft Isolated LSA trustlet suppose dey when Credential Guard dey on. Random LsaIso.exe inside Downloads no be dat trustlet. You no fit still dump dis process usefully from user mode.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

C:\Windows\System32\LsaIso.exe

  • Expected publisher: Microsoft Corporation
  • Dey present when Credential Guard dey enabled
  • Sibling for normal world: lsass.exe

I fit end am?

No

To end LsaIso.exe dem dey treat am as security-process failure. E no be RAM cleanup. Microsoft document high CPU as vendor-injection wahala, no be sometin to kill.

I fit comot am?

No

No delete LsaIso.exe. Turn Credential Guard off only wit documented policy if line-of-business app no dey compatible.

E suppose start with Windows?

wininit dey start Isolated LSA wit secure process path. E no be Startup Apps checkbox.

Measure resource use

Measure the current process rather than assume a universal baseline
CPU and memory Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)
Disk and network Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm)

File information

LsaIso.exe file information
Executable name LsaIso.exe
Recorded installation path C:\Windows\System32\LsaIso.exe
Publisher Microsoft Corporation
Signature check Inspect the actual file; this entry no dey certify its certificate identity. (pcm)

Common wahala dem

High CPU on LsaIso

Microsoft talk say apps wey dey inject DLLs or queue APCs inside Isolated LSA fit make am unstable. Remove di last security or overlay vendor before you disable Guard.

Empty lsass dumps after "audit"

Na Credential Guard dey work be dat. Di hashes no dey inside lsass again.

How to troubleshoot

Diagnose before you change anything wey fit scatter things.

Confirm say Credential Guard dey on

System Information or msinfo32 dey show Virtualization-based security. LsaIso suppose match dat state.

No attach debugger

IUM processes dey reject normal debug. Follow Microsoft vendor-elimination steps instead.

Technical details

Technical details
LsaIso.exe technical details
Image name LsaIso.exe
Role Isolated LSA / Credential Guard trustlet

Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. How we dey do research.

Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Dis article make sense to you?