Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. lsass.exe
FileRisk: Do not touch

lsass.exe C:\Windows\System32\lsass.exe

lsass.exe: the Local Security Authority Subsystem Service, which authenticates users, enforces local policy and creates access tokens. A sensitive target.

Updated on By AltF4 Formation

What it’s for

lsass.exe is the Local Security Authority. It checks credentials at sign-in, enforces the local security policy, creates access tokens and writes to the Security log (events 4624 and 4625 included). On a domain controller it also hosts the directory services. Never terminate it: Windows shuts down or restarts right away.

What it contains

  • An executable signed by Microsoft in C:\Windows\System32.
  • A single instance, started by wininit.exe in session 0.
  • In memory, authentication secrets: tokens, tickets, sometimes credentials. That is what makes it the favorite target of credential theft tools.

Risks and best practices

  • Turn on LSA protection (RunAsPPL) and, where hardware allows, Credential Guard. Test the compatibility of the modules loaded by lsass.exe first: in protected mode an unsigned module is refused (events 3033 and 3063 in the Microsoft-Windows-CodeIntegrity/Operational log).
  • Only dump lsass.exe memory for an authorized diagnostic: the file holds credentials. The same operation outside that frame is a sign of attack, so look for it in your EDR alerts.
  • A second lsass.exe is suspect: there is only one, in System32, whose parent is wininit.exe. Watch for look-alike names too (lsaas.exe, isass.exe).

Useful commands

Fenêtre de terminal
# Inspect the process (path, session, parent): run as administrator to see the path
Get-CimInstance Win32_Process -Filter "Name='lsass.exe'" | Select-Object ProcessId, ParentProcessId, SessionId, ExecutablePath


# Check the file's digital signature
Get-AuthenticodeSignature "$env:windir\System32\lsass.exe" | Select-Object Status, @{n="Signer";e={$_.SignerCertificate.Subject}}


# Check whether LSA runs as a protected process (non-zero value = enabled)
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -ErrorAction SilentlyContinue


# See Credential Guard / VBS state
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object SecurityServicesRunning, VirtualizationBasedSecurityStatus

Report a mistake