What is the "lsass.exe" ?

Our database contains 1671 different files for filename lsass.exe . You can also check most distributed file variants with name lsass.exe. This files most often belongs to product Microsoft® Windows® Operating System. and were most often developed by company Microsoft Corporation. This files most often have description Local Security Authority Process. Agregate rating is 4(4) stars - based on 50 reviews.This is executable file. You can find it running in Task Manager as the process lsass.exe.

lsass.exe is in most cases the Windows Local Security Authority Subsystem Service which is responsible for authenticating users for the winlogon service. If authentication is sucessful, then user's access token is generated and used to launch initial shell. Other user's processes inherit generated access token.

lsass.exe Process

File details of most used file with name "lsass.exe"

Product:
Microsoft® Windows® Operating System
Company:
Microsoft Corporation
Description:
Local Security Authority Process
Version:
6.1.7601.17725
MD5:
c118a82cd78818c29ab228366ebf81c3
SHA1:
a61609fe669d05d7fac08104d767c66e8cd6aa01
SHA256:
00820f3065871dcba52a27c7f73ba470c4f2cb26efb7f76fef8b1207f81b284d
Size:
31232
Directory:
C:\Windows\System32
Operating System:
Windows 7
Occurence:
High oc2

Is the Process "lsass.exe" Safe or Threat ?

Loading Graph
67% of reviewed files are marked as Safe .
33% of reviewed files are marked as Threat .
33% of reviewed files are marked as System file.
Latest new variant of the file with name "lsass.exe" was discovered 4274 days ago. Our database contains 187 variants of the file "lsass.exe" with final rating Safe and 236 variants with final rating Threat . Final ratings are based on file reviews, discovered date, users occurence and antivirus scan results.
Process with filename "lsass.exe" can be Safe or Threat. You must define more file attributes to determine right rating. Our freeware awards winning tool provides easiest way to check your files via our database. Tool contains many useful functions for keep your system under control and uses minimum system resources.
Click Here to Download System Explorer for Free.
Filename "lsass.exe" is used by Microsoft Windows System files. Many threats uses filenames of System Processes to camouflage itself. You should consider suspected any file which uses system filename and is not stored in system directory or has invalid file version information. Correct system file contains full file version information from Microsoft.

User Reviews of the "lsass.exe"

There are multiple files in compliance with actual filter settings. All reviews for this files will be displayed.

Reviews for all files with name "lsass.exe"

  • SAFErating from user jimmybolts for file C:\Windows\System32\lsass.exe (Variant: 29678077)

    they say its safe. i sasy its required.

  • SAFErating from user Timmyh13 for file C:\Windows\System32\lsass.exe (Variant: 34087591)

    Necessary file for the operating system.

  • SAFErating from user ben for file C:\Windows\System32\lsass.exe (Variant: 40502485)

    ok

  • SAFErating from user Ben for file C:\Windows\System32\lsass.exe (Variant: 40502485)

    ok

  • SAFErating from user Serge for file C:\Windows\System32\lsass.exeflag ru

  • SAFErating from user Alex for file C:\Windows\System32\lsass.exe

  • SAFErating from user Tom for file C:\Windows\System32\lsass.exe

  • SAFErating from user Doris for file C:\Windows\System32\lsass.exe

  • SAFErating from user localhost for file C:\Windows\System32\lsass.exe (Variant: 24862899)

    But this program why uses 50 % processor time approx 10-20 seconds long time after booting?

  • SAFErating from user loki for file C:\Windows\System32\lsass.exe

  • SAFErating from user BlackRoby for file C:\Windows\System32\lsass.exe (Variant: 24851057)

    IS OK,GOOD FILE,NO PROBLEM TO VIRUS

  • SAFErating from user Mikel for file C:\Windows\System32\lsass.exe

  • THREATrating from user MikeOne for file C:\Windows\System32\btc\lsass.exe (Variant: 18918815)

    In origin, this file as a core Windows system process: The process lsass.exe is the Local Security Authentication Server. It is a safe file from Microsoft. Lsass.exe is responsible for security policy enforcement within the operating system, verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. It also writes to the Windows Security Log. In this case this file should be a target for lot of viruses. In this version, this file was changed to a bitcoiner, which can be marked as an attack.

  • SAFErating from user MikeOne for file C:\Windows\System32\lsass.exe (Variant: 18953017)

    This file as a core Windows system process: The process lsass.exe is the Local Security Authentication Server. It is a safe file from Microsoft. Lsass.exe is responsible for security policy enforcement within the operating system, verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. It also writes to the Windows Security Log. In this case this file should be a target for lot of viruses.

  • THREATrating from user MikeOne for file %SystemDiskRoot%\Win\lsass.exe (Variant: 19184563)

    In origin, this file as a core Windows system process: The process lsass.exe is the Local Security Authentication Server. It is a safe file from Microsoft. Lsass.exe is responsible for security policy enforcement within the operating system, verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. It also writes to the Windows Security Log. In this case this file should be a target for lot of viruses. It should be located in the %system32% directory. Check the MD5 sumcheck. In this version, this file is infected by a virus.

  • SAFErating from user Admin for file C:\Windows\System32\lsass.exe (Variant: 12228930)

    Windows 8 version of the Local Security Authority Process.

  • SAFErating from user MikeOne for file C:\Windows\System32\lsass.exe (Variant: 10115325)

    "Local Security Authority Subsystem Service (LSASS), is a process in Microsoft Windows operating systems that is responsible for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.[1] It also writes to the Windows Security Log." - check more on Wikipedia : http://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service

  • SAFErating from user 3hlav for file C:\Windows\System32\lsass.exe (Variant: 508534)

    "lsass.exe" is the Local Security Authentication Server. It verifies the validity of user logons to your PC or server. Lsass generates the process responsible for authenticating users for the Winlogon service. This is performed by using authentication packages such as the default, Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates then inherit this token. More info Note: The lsass.exe file is located in the folder C:\Windows\System32. In other cases, lsass.exe is a virus, spyware, trojan or worm!

  • SAFErating from user 3hlav for file C:\Windows\System32\lsass.exe (Variant: 505274)

    Safe, LSA Shell

  • SAFErating from user lfischl for file C:\Windows\System32\lsass.exe

  • SAFErating from user a for file C:\Windows\System32\lsass.exe

  • SAFErating from user Al K. Loid for file C:\Windows\System32\lsass.exe

  • SAFErating from user Moraxv for file C:\Windows\System32\lsass.exe

  • SAFErating from user Nestai for file C:\Windows\System32\lsass.exe

  • SAFErating from user UPieper for file C:\Windows\System32\lsass.exe

  • SAFErating from user SadasPoeta for file C:\Windows\System32\lsass.exe

  • THREATrating from user MikeOne for file %SystemDiskRoot%\Win\lsass.exe (Variant: 65081)

    In this MD5 version, this file was marked by most antiviruses as Worm / Trojan-Spy.Win32.KeyLogger virus. Remove it from Your computer. Scan is recommended. Check the MD5 hash and file location, there can more files with this name.

  • SAFErating from user CCW for file C:\Windows\System32\lsass.exe (Variant: 10728)

    Windows 7 64-but German Fileversion: 6.1.7600.16385 (win7_rtm.090713-1255)

  • THREATrating from user MikeOne for file C:\Windows\Syn_c\4E656C65\lsass.exe (Variant: 48463)

    In this MD5 version, this file was marked by most antiviruses as W32/YahLover.worm.gen / Trojan.Win32. Remove it from Your computer. Scan is recommended. Check the MD5 hash and file location, there can more files with this name.

  • THREATrating from user MikeOne for file %SystemDiskRoot%\SmartIT\lsass.exe (Variant: 36349)

    In this MD5 version, this file was marked by most antiviruses as Backdoor/Trojan. Remove it from Your computer. Scan is recommended. Check the MD5 hash and file location, there can more files with this name.

  • THREATrating from user MikeOne for file %APPDATA%\SystemProc\lsass.exe (Variant: 16448)

    In this MD5 version, this file was marked by most antiviruses as Virus.Win32.Dracur. Remove it from Your computer. Scan is recommended. Check the MD5 hash and file location, there can more files with this name.

  • THREATrating from user MikeOne for file %APPDATA%\lsass.exe (Variant: 13945)

    In this MD5 version, this file was marked by most antiviruses as Trojan.Generic virus. Remove it from Your computer. Scan is recommended. Check the MD5 hash and file location, there can more files with this name.

  • THREATrating from user MikeOne for file C:\Windows\lsass.exe (Variant: 8092)

    In origin, this file as a core Windows system process: The process lsass.exe is the Local Security Authentication Server. It is a safe file from Microsoft. Lsass.exe is responsible for security policy enforcement within the operating system, verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. It also writes to the Windows Security Log. In this case this file shoub be a target for lot of viruses. It should be located in the %system32% directory. Check the MD5 sumcheck. In this version, this is a Worm.Win32.VB virus.

  • SAFErating from user TheDutchJewel for file C:\Windows\System32\lsass.exe (Variant: 141)

    The process lsass.exe serves as the Local Security Authentication Server by Microsoft, Inc. It is responsible for the enforcement of the security policy within the operating system. This process checks whether a user’s supplied identification is valid or not whenever he or she tries to access the computer system. With the execution of the file lsass.exe, the system acquires security by preventing the access of unwanted users to any private information. The file lsass.exe also handles the password modifications done by the user. The process lsass.exe mainly operates in the system through its ability to create access tokens. These tokens encapsulate the file’s security descriptor, which contains the necessary information to process user authentication such as data on which user holds access to the system and whether the access is mandatory or discretionary. Source: http://www.processlibrary.com/directory/files/lsass/

  • SAFErating from user Admin for file C:\Windows\System32\lsass.exe