# lsass.exe

Windows Process: Microsoft Corporation

Also called lsass, local security authority

Windows, System Component

Local Security Authority Subsystem Service. It handles local logon and security policy.

## What you need to know

This is the Windows logon security process.

lsass.exe checks who you are when you sign in and applies local security policy. Ending it can force Windows to restart.

- **Safe?**: Yes, if it is in System32

  **Can I end it?**: No

  **High CPU?**: Investigate. Do not delete it

Feex says

I never tell someone to kill lsass.exe to free memory. If it is busy, I look at sign-in, domain, or a security product. I do not delete the file.

## What is lsass.exe?

lsass.exe is Local Security Authority Subsystem Service. It is the Windows process behind local authentication and security policy.

## What does it do?

It validates sign-in, stores security policy, and talks to credential providers. Other security products may hook it. That does not make the System32 file optional.

## Why is it running?

Windows starts it at boot so sign-in works.

## Is it safe?

Critical and normally safe

The legitimate file is in System32. Copies elsewhere are not the Windows LSA. Do not delete System32 lsass.exe.

A legitimate copy normally runs from:

`C:\Windows\System32\lsass.exe`

- Expected publisher: Microsoft Corporation
- Expected path: System32 only

## Can I end it?

No

Ending lsass.exe typically reboots the PC. That is a last-resort crash, not a tune-up.

## Can I remove it?

No

Do not delete lsass.exe. You will break sign-in.

## Should it start with Windows?

It starts with Windows. There is no supported way to keep a normal desktop without it.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Can rise during sign-in or a security scan that touches LSA

  **Memory**: Modest to moderate

  **Disk**: Low

  **Network**: Domain-joined PCs may talk to a domain controller

## File information

| Executable name        | lsass.exe                     |
| ---------------------- | ----------------------------- |
| Common legitimate path | C:\Windows\System32\lsass.exe |
| Publisher              | Microsoft Corporation         |
| Signature expectation  | Signed by Microsoft Windows   |

## Common problems

### High CPU at logon

A broken credential provider or a security suite can stall LSA. Safe Mode and vendor support beat deleting the process.

### Scare articles

The name is used in malware stories because malware wants credentials. The System32 file is still Windows.

## Troubleshooting

Diagnose before you change anything destructive.

### Confirm the path and signature

Open the process properties and check that lsass.exe runs from the expected folder and is signed by the expected publisher. This is the first check, not a Registry edit.

### See what the process is doing

Task Manager can show CPU, memory, disk, and GPU. High use during an obvious job is often normal. High use when the PC is idle needs a closer look at the related app or service.

### Avoid destructive first steps

Do not delete lsass.exe, disable critical services without knowing the effect, or edit the Registry as the first move.

## Technical details

Technical details

| Image name | lsass.exe                |
| ---------- | ------------------------ |
| Role       | Local Security Authority |

## Related

These entities connect to this article. Type is shown on every link.

[csrss.exe: Windows Process](https://feex.it/wiki/process/csrss.exe)[Windows Security: Application](https://feex.it/wiki/software/windows-security)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: LSASS ](https://learn.microsoft.com/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection)· LSA protection documentation

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: lsass.exe

  **Typical path**: C:\Windows\System32\lsass.exe

  **Importance**: Critical

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/lsass.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)