Local Security Authority Subsystem Service
 | This article needs additional citations for verification. (July 2009) |
Local Security Authority Subsystem Service (LSASS)[1] is a process in Microsoft Windows operating systems that is responsible for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.[2] It also writes to the Windows Security Log.
Forcible termination of lsass.exe will result in the system losing access to any account, including NT AUTHORITY, prompting a restart of the machine. Because, lsass.exe is a crucial system file, its name is often faked by malware. The lsass.exe file used by Windows is located in the
worm. Due to the way some systems display fonts, malicious developers may name the file something like Isass.exe (capital "i" instead of a lowercase "L") in efforts to trick users into installing or executing a malicious file instead of the trusted system file.[3] The Sasser worm spreads by exploiting a buffer overflow in the LSASS on Windows XP and Windows 2000
operating systems.
References
- ^ "Configuring Additional LSA Protection". Microsoft. Retrieved 2022-02-04.
- ^ "Windows 7 Services | Windows CMD". SS64.com. Retrieved 2016-05-24.
- ^ "The Best Way To Remove Lsass.exe Virus - Fix Lsass Process". Errorboss.com. 23 December 2014. Retrieved 2016-05-24.
