# LsaIso.exe

Windows Process: Microsoft Corporation

Also called lsaiso, lsa isolated, isolated lsa, credential guard

Windows, System Component

Isolated LSA. When Credential Guard is on, this trustlet holds NTLM hashes and Kerberos tickets in Virtual Secure Mode, away from lsass.exe.

## What you need to know

This is Isolated LSA, not a second copy of lsass.exe you can kill for RAM.

LsaIso.exe runs as an Isolated User Mode trustlet when Credential Guard is enabled. lsass.exe still authenticates in the normal world. Secrets stay here. You cannot attach a debugger to it.

- **Safe?**: Yes. It is Credential Guard

  **Same as lsass?**: No. This one is isolated

  **Should I end it?**: No

Feex says

If LsaIso is on the list, Credential Guard is doing the job Microsoft documented. I would not end it to "speed up logon." That process is why stolen lsass dumps come back empty.

## What is LsaIso.exe?

LsaIso.exe is the Isolated LSA process. Credential Guard moves password hashes and Kerberos TGTs here so the normal lsass.exe memory is less useful to steal.

## What does it do?

It talks to lsass.exe over a restricted RPC channel. It does not host third-party drivers. It does not draw the lock screen.

## Why is it running?

The PC has virtualization-based security and Credential Guard on. Windows 11 enables that by default on hardware that qualifies. No LsaIso usually means Guard is off, not that lsass vanished.

## Is it safe?

Usually safe

A Microsoft Isolated LSA trustlet is expected when Credential Guard is on. A random LsaIso.exe in Downloads is not that trustlet. You also cannot usefully dump this process from user mode.

A legitimate copy normally runs from:

`C:\Windows\System32\LsaIso.exe`

- Expected publisher: Microsoft Corporation
- Present when Credential Guard is enabled
- Sibling in the normal world: lsass.exe

## Can I end it?

No

Ending LsaIso.exe is treated as a security-process failure. It is not a RAM cleanup. Microsoft documents high CPU as a vendor-injection problem, not a kill target.

## Can I remove it?

No

Do not delete LsaIso.exe. Turn Credential Guard off only with a documented policy if a line-of-business app is incompatible.

## Should it start with Windows?

wininit starts Isolated LSA with the secure process path. It is not a Startup Apps checkbox.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Should be low. A spike often means a driver is poking an IUM process

  **Memory**: Small. The point is isolation, not cache

  **Disk**: None that you manage

  **Network**: None by itself

## File information

| Executable name        | LsaIso.exe                     |
| ---------------------- | ------------------------------ |
| Common legitimate path | C:\Windows\System32\LsaIso.exe |
| Publisher              | Microsoft Corporation          |
| Signature expectation  | Signed by Microsoft Windows    |

## Common problems

### High CPU on LsaIso

Microsoft says apps that inject DLLs or queue APCs into Isolated LSA can destabilize it. Eliminate the last security or overlay vendor before you disable Guard.

### Empty lsass dumps after an "audit"

That is Credential Guard working. The hashes are not in lsass anymore.

## Troubleshooting

Diagnose before you change anything destructive.

### Confirm Credential Guard is on

System Information or msinfo32 shows Virtualization-based security. LsaIso should match that state.

### Do not attach a debugger

IUM processes reject normal debug. Follow Microsoft's vendor-elimination steps instead.

## Technical details

Technical details

| Image name | LsaIso.exe                               |
| ---------- | ---------------------------------------- |
| Role       | Isolated LSA / Credential Guard trustlet |

## Related

These entities connect to this article. Type is shown on every link.

[lsass.exe: Windows Process](https://feex.it/wiki/process/lsass.exe)[Secure System: Windows Process](https://feex.it/wiki/process/secure-system)[What is a Windows process: Guide](https://feex.it/wiki/software/system/what-is-a-windows-process)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: Credential Guard ](https://learn.microsoft.com/windows/security/identity-protection/credential-guard/how-it-works)· LsaIso stores secrets under VBS
- [Microsoft Learn: IUM processes ](https://learn.microsoft.com/windows/win32/procthread/isolated-user-mode--ium--processes)· Trustlets cannot be injected
- [Microsoft: LsaIso high CPU ](https://learn.microsoft.com/troubleshoot/windows-client/performance/lsaiso-process-high-cpu-usage)· APC and DLL injection side effects
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: LsaIso.exe

  **Typical path**: C:\Windows\System32\LsaIso.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

  **Related process**: [lsass.exe](https://feex.it/wiki/process/lsass.exe)

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/lsaiso.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)