lsass.exe

Windows ProcessMicrosoft Corporation

Catalog search terms lsass, local security authority

WindowsSystem Component

Local Security Authority Subsystem Service. E dey handle local logon and security policy.

Wetin you need know

Dis na di Windows logon security process.

lsass.exe dey check who you be when you sign in and e dey apply local security policy. To end am fit force Windows to restart.

E safe?: Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.
I fit end am?: No
High CPU?: Investigate. No delete am

Feex tok say

I no fit ever tell pesin to kill lsass.exe make e free memory. If e dey busy, I dey look sign-in, domain, or security product. I no dey delete di file.

Wetin be lsass.exe?

lsass.exe na Local Security Authority Subsystem Service. Na di Windows process behind local authentication and security policy.

Wetin e dey do?

E dey validate sign-in, store security policy, and talk to credential providers. Other security products fit hook am. Dat one no make di System32 file optional.

Wetin make am dey run?

Windows dey start am at boot make sign-in fit work.

Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'lsass.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the file-identity guide to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

E dey safe?

Critical and normally safe

Di real file dey inside System32. Copies elsewhere no be di Windows LSA. No delete System32 lsass.exe.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

C:\Windows\System32\lsass.exe

Expected publisher: Microsoft Corporation
Expected path: System32 only

I fit end am?

To end lsass.exe usually dey reboot PC. Dat one na last-resort crash, no be tune-up.

I fit comot am?

No delete lsass.exe. You go break sign-in.

E suppose start with Windows?

E dey start wit Windows. No supported way dey to keep normal desktop without am.

Measure resource use

Measure the current process rather than assume a universal baseline
CPU and memory	Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)
Disk and network	Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm)

File information

lsass.exe file information
Executable name	lsass.exe
Recorded installation path	C:\Windows\System32\lsass.exe
Publisher	Microsoft Corporation
Signature check	Inspect the actual file; this entry no dey certify its certificate identity. (pcm)

Common wahala dem

High CPU at logon

Credential provider wey break or security suite fit stall LSA. Safe Mode and vendor support beta pass to delete di process.

Scare articles

Dem dey use di name for malware tori because malware want credentials. Di System32 file still be Windows.

How to troubleshoot

Diagnose before you change anything wey fit scatter things.

Confirm the path and signature

Open process properties make you check say lsass.exe dey run from di expected folder and e get signature from di expected publisher. Dis na di first check, no be Registry edit.

See wetin di process dey do

Task Manager fit show CPU, memory, disk, and GPU. High use during work wey dey clear dey normal. High use when PC dey idle need closer look for di related app or service.

Avoid first steps wey fit scatter things

No delete lsass.exe, no disable critical services without knowing wetin go happen, and no edit Registry as your first move.

Technical details

lsass.exe technical details
Image name	lsass.exe
Role	Local Security Authority

Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. How we dey do research.

Microsoft Learn: LSASS · LSA protection documentation
Microsoft Sysinternals: Sigcheck · Dey explain how to check file signatures. Dis reference no establish the identity or safety of any particular running file.
Microsoft: Get-CimInstance · Read-only local process-query method. (pcm)
Microsoft: Win32_Process properties · Documents process IDs, executable paths, creation dates and parent-ID reuse. (pcm)

Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.