Lsass.exe

The Lsass.exe process is a baseline aspect of all Windows operating systems and shouldn't be closed in ordinary situations. Forcing Lsass.exe to stop running will usually result in an immediate reboot. In some situations, a fake Lsass.exe process may actually be a malware threat, which necessitates Lsass.exe's quick removal! The use of a Lsass.exe disguise doesn't reflect on the nature of the malware, except insofar as Lsass.exe's attempting to remain hidden. Typical stealth-oriented malware include backdoor Trojans that lower your PC's security and spyware that record personal information to send out to remote attackers. If you find a spare Lsass.exe process on your computer, you should be suspicious and immediately begin a thorough anti-malware scan.

What Lsass.exe Does for Your PC

Lsass.exe enforces security-based permissions for actions taken on your computer. A security log is recorded to keep track of some of these permitted activities; Lsass.exe also handles account permission levels and login details like passwords. The Lsass.exe process runs with Windows naturally and uses up a certain amount of system memory.

Under usual conditions, Lsass.exe doesn't have a visible presence on your computer and refrains from using up large amounts of RAM. In some cases, particularly with Windows Server 2003 machines, Lsass.exe can unintentionally use up excessive memory due to a memory leak error. Microsoft does provide a fix for this problem, however. In other cases, too much memory usage can indicate that the Lsass.exe process is a fake.

How PC Threats Hide Under the Lsass.exe Umbrella

Many different types of malware, such as keyloggers, Trojans and viruses can all hide under the Lsass.exe process name. You can always find Lsass.exe running under the System32 subfolder of your main Windows folder; if you see Lsass.exe running from any other location, Lsass.exe is not the real thing! There are applications that let you check the location of a currently running process; these processes can be seen in Task Manager (accessed via Ctrl+Alt+Delete).

There should never be more than one instance of Lsass.exe running at any given time, and any duplicates are malware. Don't try to shut down or delete a fake Lsass.exe process unless you're very self-assured in your computer skills, since harming the real Lsass.exe will damage your operating system.

Many viruses and other malware can attack Lsass.exe and replace Lsass.exe with their own bodies; this will cause the computer to emit a Lsass.exe-related error during startup and will probably disable OS access. Stay frosty and grab a relevant Windows OS repair CD or similar source of a fresh copy of Lsass.exe, and you should be able to remote the malware threat once your system is repaired.