# lsass.exe

Windows Process: Microsoft Corporation

Catalog search terms lsass, local security authority

Windows, System Component

Local Security Authority Subsystem Service. E dey handle local logon and security policy.

## Wetin you need know

Dis na di Windows logon security process.

lsass.exe dey check who you be when you sign in and e dey apply local security policy. To end am fit force Windows to restart.

- **E safe?**: Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.

  **I fit end am?**: No

  **High CPU?**: Investigate. No delete am

Feex tok say

I no fit ever tell pesin to kill lsass.exe make e free memory. If e dey busy, I dey look sign-in, domain, or security product. I no dey delete di file.

## Wetin be lsass.exe?

lsass.exe na Local Security Authority Subsystem Service. Na di Windows process behind local authentication and security policy.

## Wetin e dey do?

E dey validate sign-in, store security policy, and talk to credential providers. Other security products fit hook am. Dat one no make di System32 file optional.

## Wetin make am dey run?

Windows dey start am at boot make sign-in fit work.

## Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

`Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'lsass.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List`

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the [file-identity guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/) to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

## E dey safe?

Critical and normally safe

Di real file dey inside System32. Copies elsewhere no be di Windows LSA. No delete System32 lsass.exe.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

`C:\Windows\System32\lsass.exe`

- Expected publisher: Microsoft Corporation
- Expected path: System32 only

## I fit end am?

No

To end lsass.exe usually dey reboot PC. Dat one na last-resort crash, no be tune-up.

## I fit comot am?

No

No delete lsass.exe. You go break sign-in.

## E suppose start with Windows?

E dey start wit Windows. No supported way dey to keep normal desktop without am.

## Measure resource use

| CPU and memory   | Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)               |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| Disk and network | Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm) |

## File information

| Executable name            | lsass.exe                                                                          |
| -------------------------- | ---------------------------------------------------------------------------------- |
| Recorded installation path | C:\Windows\System32\lsass.exe                                                      |
| Publisher                  | Microsoft Corporation                                                              |
| Signature check            | Inspect the actual file; this entry no dey certify its certificate identity. (pcm) |

## Common wahala dem

### High CPU at logon

Credential provider wey break or security suite fit stall LSA. Safe Mode and vendor support beta pass to delete di process.

### Scare articles

Dem dey use di name for malware tori because malware want credentials. Di System32 file still be Windows.

## How to troubleshoot

Diagnose before you change anything wey fit scatter things.

### Confirm the path and signature

Open process properties make you check say lsass.exe dey run from di expected folder and e get signature from di expected publisher. Dis na di first check, no be Registry edit.

### See wetin di process dey do

Task Manager fit show CPU, memory, disk, and GPU. High use during work wey dey clear dey normal. High use when PC dey idle need closer look for di related app or service.

### Avoid first steps wey fit scatter things

No delete lsass.exe, no disable critical services without knowing wetin go happen, and no edit Registry as your first move.

## Technical details

Technical details

| Image name | lsass.exe                |
| ---------- | ------------------------ |
| Role       | Local Security Authority |

## Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

## Related

Dis entities connect to dis article. Type dey show for every link.

[csrss.exe: Windows Process](https://feex.it/wiki/l/pcm/process/csrss.exe/)[Windows Security: Application](https://feex.it/wiki/l/pcm/software/windows-security/)[Check an executable path and digital signature: Guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/)[Read Task Manager and compare process activity: Guide](https://feex.it/wiki/l/pcm/software/system/how-to-read-task-manager/)[Security processes: Category](https://feex.it/wiki/process/security/)

## Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. [How we dey do research](https://feex.it/wiki/research/).

- [Microsoft Learn: LSASS ](https://learn.microsoft.com/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection)· LSA protection documentation
- [Microsoft Sysinternals: Sigcheck ](https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck)· Dey explain how to check file signatures. Dis reference no establish the identity or safety of any particular running file.
- [Microsoft: Get-CimInstance ](https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance)· Read-only local process-query method. (pcm)
- [Microsoft: Win32_Process properties ](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process)· Documents process IDs, executable paths, creation dates and parent-ID reuse. (pcm)

## Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Quick facts

The short identity of dis page. Specs, sources, and the full story still dey inside the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: lsass.exe

  **Typical path**: C:\Windows\System32\lsass.exe

  **Importance**: Critical

Recorded source status: Feex Reviewed: Recorded source label: August 2026. Dis label no establish independent verification.

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/l/pcm/process/lsass.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)