Local Security Authority Process - what is it in "Task Manager"? The lsass exe process loads the processor What to do if it is a virus.

You may have seen in Task Manager a service in the Local Security Authority Process whose properties list the name lsass.exe. This is an important executable file in Windows 10 that handles many of the operations performed under the Windows operating system (OS) and serves to keep the system safe. Sometimes you may misinterpret this as a virus due to the .exe extension. Let's take a look at the details related to lsass.exe and how it works.

What is lsass.exe in Windows 10

Lsass.exe means local security subsystem service, where .exe indicates that it is an executable file. It works as a policy component Windows Security 10, such as user verification on the server, password changes, and user authentication during login or logout. lsass.exe is activated when winlogon.exe is started, and if the password is correct, it transfers authority, or displays a message that the password does not match. The location of the Lsass.exe file is always the path C:\Windows\System32.

Is lsass.exe a virus?

No, lsass.exe is not a virus, it is an official file from Microsoft Corporation. You don't need to worry about any damage from this process as long as it's intact. The details of lsass.exe are as follows:

• File Description - Local Security Authority Process ( Local Security Center).
• Application product name - Operating Microsoft system Windows.
• Copyright - Microsoft Corporation. All rights reserved.
• Size - 56.6 KB.
• English language.
• The original file name is lsass.exe.

How does lsass.exe work in Windows 10?

lsass.exe in Windows 10 is the main system file that is involved in root work. If your system reboots repeatedly, it's because the lsass.exe file is corrupt or it could be a password error. The executable is known to work in four different ways on your computer.

1. Encryption file system(EFS)- This file helps in processing and storing the encrypted file on your desktop. Encryption is a means of encoding information so that only an authorized user can access it. You can read more about encryption.
2. CNG key isolation (keyiso)- Works as a data protection process for private keys and cryptographic file. In the event that CNG key isolation does not work, the Extensible Authentication Protocol cannot be initialized.
3. Security Accounts Manager (SamSs)- It helps to reduce data crash when transmitting a signal from one server to another.
4. Credential Manager - Software also works for internet protocol control when connected to a network.

How to recognize it is a virus or not?

Sometimes developers malware create a file with the same name for the purpose of cheating, but you can easily distinguish original file lsass.exe from dubious. If a file named lsass.exe is located not along the path C:\Windows\System32, then there are big doubts about its originality, and you should delete it. To check this, simply open Task Manager and go to the Processes tab. Here you can view a list of all executable files. Find Local Security Authority Process, right-click on it, and then click Open file location. You will be transferred to the C:\Windows\System32 directory, and you will see there lsass.exe. If you were transferred to another place, then most likely this is malware. A virus similar to the lsass.exe service can heavily load the processor.

Should I disable lsass.exe in Windows 10?

As mentioned above, lsass.exe is a Windows security management program, there is no need to deactivate this file. You simply won't be able to delete this file in Windows 10 as it can damage the system.

Sometimes lsass.exe and other system errors EXE errors may be related to problems in the Windows registry. Several programs can use the lsass.exe file, but when those programs are removed or changed, orphaned (invalid) EXE registry entries are sometimes left behind.

Basically, this means that while the actual path to the file may have been changed, its incorrect former location is still recorded in the Windows registry. When Windows tries looking up these incorrect file references (file locations on your PC), lsass.exe errors can occur. In addition, malware infection may have corrupted the registry entries associated with Windows. Thus, these invalid EXE registry entries need to be repaired in order to fix the root of the problem.

Manually editing the Windows registry to remove invalid lsass.exe keys is not recommended unless you are PC service professional. Mistakes made while editing the registry can render your PC unusable and cause irreparable damage to your operating system. In fact, even a single comma in the wrong place can prevent your computer from booting up!

Because of this risk, we highly recommend using a trusted registry cleaner such as %%product%% (Developed by Microsoft Gold Certified Partner) to scan and repair any lsass.exe-related registry problems. Using a registry cleaner automates the process of finding invalid registry entries, missing file references (like the one causing your lsass.exe error), and broken links within the registry. Before each scan, an automatically created backup copy, which allows you to undo any changes with a single click and protects you from possible damage to your computer. The best part is that fixing registry errors can drastically improve system speed and performance.

Warning: Unless you are an advanced PC user, we do NOT recommend manually editing the Windows Registry. Incorrect use of the Registry Editor can lead to serious problems and require you to reinstall Windows installation. We do not guarantee that problems resulting from misuse of Registry Editor can be resolved. You use the Registry Editor at your own risk.

Before manually restoring Windows registry, you need to create a backup by exporting a part of the registry related to lsass.exe (eg. Windows):

1. Click on the button To begin.
2. Enter " command" in search bar... DO NOT PRESS YET ENTER!
3. Holding keys CTRL-Shift on the keyboard, press ENTER.
4. An access dialog will be displayed.
5. Click Yes.
6. The black box opens with a blinking cursor.
7. Enter " regedit" and press ENTER.
8. In the Registry Editor, select the lsass.exe-related key (eg. Windows) you want to back up.
9. On the menu File select Export.
10. Listed Save to select the folder where you want to save the backup Windows key.
11. In field File name enter a name for the backup file, for example " Windows Backup copy".
12. Make sure the field Export range value selected Selected branch.
13. Click Save.
14. The file will be saved with .reg extension.
15. You now have a backup of your lsass.exe-related registry entry.

The next steps for manually editing the registry will not be covered in this article, as they are likely to damage your system. If you would like more information on editing the registry manually, please see the links below.

The Task Manager of the Windows operating system allows users to monitor processes that are wasting computer resources. Optimizing the system should begin with disabling and removing from startup all applications that are not used, but at the same time negatively affect system performance.

Sometimes they load the processor or RAM computer solutions are not from third-party developers, but directly from Microsoft. In particular, it is common for the lsass.exe process to slow down the computer. This is possible in three cases: active work, if there are crashes, or if the process is infected with a virus. In this article, we will look at what to do if lsass.exe loads the processor and how you can fix it.

Lsass.exe - what is this process

The lsass.exe process is a Microsoft service that is active on a computer by default right after Windows is installed. He first appeared on Windows Vista, and its task is to protect data, thanks to intelligent user verification. It is believed that the process "intelligently" monitors the actions of the user, on the basis of which it makes decisions to enable or disable certain protective functions.

The normal operation of the lsass.exe process implies a load on resources. In the active state, the service can load the processor and RAM by 40-70%, but this should last no more than 10 minutes, usually immediately after turning on the computer. If lsass.exe is using up to 100% CPU, the process in question is most likely infected or malfunctioning.

How to identify and remove the lsass.exe virus

If the lsass.exe process is a virus, you can expect it to use RAM and CPU up to 100% or close to it. In such a situation, we recommend that you follow these steps to resolve the issue:

After that, restart your computer and check if the lsass.exe process continues to load the computer's resources. If the problem has not been resolved, try disabling the service.

How to disable the lsass.exe process

If the lsass.exe process is not viral, but it constantly loads the resources of the computer, you can disable it completely. To do this, follow these steps:

After completing the necessary steps, restart the computer, after which the lsass.exe service should no longer disturb the user and load the processor.

Many users are not even aware of the huge number of processes in the system that ensure the operation of all important components. Some of them are custom and are only responsible for the work individual programs, most often set by the user himself. Others are systemic. They are necessary for the normal functioning of the operating system itself.

The article will focus on the Local Security Authority Process: what it is, what it is for, whether it can be a virus, and how to disable it in order to reduce the consumption of computer resources. We hope that this information will be useful to you.

Local Security Authority Process - what is it?

The first step is to discuss the purpose of this process. So, Local Security Authority Process (lsass.exe) is a service in the operating Windows system developed by Microsoft itself. It is necessary to determine the authenticity of a user entering the system using artificial intelligence technology.

Start process at startup Windows still before you get to the desktop, and after passing the check it continues to work in the background. You can find it by opening the task manager.

Process specifications

Having learned general data about this service, it would be nice to discuss specifications her executable file. This information will be useful in verifying its authenticity.

So, the first thing to do is to tell where the file is located in the system. And the path to it is as follows: drive C:Windows\System32\. The file is called: lsass.exe. Its size is about 56.6 kilobytes, but it may fluctuate slightly. The process can load the processor by a maximum of 50-60%, and then for a short time, about 10 minutes. In the background, the value barely reaches 1%.

Could it be a virus

Well, now let's go directly to the question of whether this process can be a virus, because some users notice suspicious activity behind it. In fact, the Local Security Authority Process, like the lsass.exe process itself, is completely clean. But a virus program developed by an attacker can easily bear the same name, fooling the average user.

To identify a virus, you need to view its executable file, if the specifications do not agree with those previously presented, then it is a virus and must be removed.

How to remove a virus

If the Local Security Authority Process is consuming the processor, it is most likely a virus. After making sure of this, it must be removed.

And now we will tell you how to do it:

1. Close all programs.
2. End the virus process.
3. open Temp folder, which is located along the path: C:\Users\Administrator\AppData\Local\, and delete all files from there.
4. Uninstall the day before installed apps.
5. Install AdwCleaner.
6. Run it and scan the entire system, then clean up all the threats found.
7. Restart your computer.
8. Clean up the registry with using CCleaner.
9. Restart your computer.

These actions are enough to get rid of the virus.

How to disable Local Security Authority Process

Now let's talk about how to shut down a process to reduce resource consumption. This method is good because you do not have to follow the above instructions, but it does not guarantee getting rid of the virus. He is only for a while

Method one: through the "Task Manager"

by the most in a simple way will terminate the process itself in the "Task Manager". This is very easy to do, but there are some pitfalls. So, after restarting the computer at system startup, it will be started again. You can use this method, each time doing the procedure for terminating the process:

• In the "Task Manager" go to the "Processes" or "Details" tab.
• Find the lsass.exe file in the list and select it.
• Click the "End Process" button.

This is how you can easily reduce the CPU load for one session.

Method two: disable the service

We already know that the Local Security Authority Process is a service. Accordingly, to disable the process, you can disable the service. In this case, it will not run every time the system starts. So you can permanently disable Lsass.exe:

1. In Task Manager, go to the Services tab.
2. Find the "Open Services" link and follow it.
3. In the window that appears, find the line "Credential Manager" and double-click on it.
4. In the window that appears, change the startup type to "Disabled".
5. Accept the changes and restart your computer.

Now Lsass.exe will not run, and the load on the processor will decrease.

Method Three: Deleting the Executable File

If you are an adherent of drastic measures, then you can delete the process itself from the computer. But it is still not recommended to do this, since in the future it may be needed to perform some actions.

• Open the lsass.exe executable directory.
• Select a file.
• Press Delete while holding Shift key.
• Give consent to deletion.

After that, it will be completely removed from the computer.

Conclusion

So we found out that the Local Security Authority Process is the process that the system needs to run. However, that doesn't change the fact that it can be terminated after to reduce the load on the processor.

Separately, I would like to note the likelihood of a virus file with the same name entering the system. That is why it is worth periodically doing a system scan to identify such threats.