What is lsass.exe?

Lsass.exe file information

The process known as Local Security Authority Process or LSA Shell (Export Version) or LSA Shell or pikachu or Windows host process (Rundll32) or Bonjour or CNG Key Isolation, Security Accounts Manager or igfxCUIService Module

belongs to software Microsoft Windows Operating System or IPSEC Services, Protected Storage, Security Accounts Manager or CNG Key Isolation, Security Accounts Manager or Encrypting File System (EFS), CNG Key Isolation, Security Accounts Manager or Project1 or CNG Key Isolation, Protected Storage, Security Accounts Manager or CNG Key Isolation, Security Accounts Manager, Credential Manager or NT LM Security Support Provider, IPSEC Services, Protected Storage, Security Accounts Manager

by Microsoft (www.microsoft.com) or www.microsoft.com or Nenad Hrg (SoftwareOK.com) or Blackburn Laocoon or NETGATE Technologies s.r.o (www.netgate.sk) or Ci78JjFt5o9WNk or qYpbf.

Description: The original lsass.exe from Microsoft is an important part of Windows, but often causes problems. The lsass.exe file is located in the C:\Windows\System32 folder. Known file sizes on Windows 10/11/7 are 13,312 bytes (68% of all occurrences), 22,528 bytes and 18 more variants.  
The program is not visible. It is a Microsoft signed file. The process uses ports to connect to or from a LAN or the Internet. Therefore the technical security rating is 13% dangerous, however you should also read the user reviews.

Recommended: Identify lsass.exe related errors

Viruses with the same file name

Is lsass.exe a virus? No, it is not. The true lsass.exe file is a safe Microsoft Windows system process, called "Local Security Authority Process". However, writers of malware programs, such as viruses, worms, and Trojans deliberately give their processes the same file name to escape detection. Viruses with the same file name are for instance Trojan.Gen or W32.Imaut (detected by Symantec), and TROJ_GEN.R47C3LG or Mal_OtorunN (detected by TrendMicro).
To ensure that no rogue lsass.exe is running on your PC, click here to run a Free Virus Scan.

How to recognize suspicious variants?

• If lsass.exe is located in a subfolder of C:\Windows, the security rating is 87% dangerous. The file size is 1,591,808 bytes (13% of all occurrences), 3,902,464 bytes and 25 more variants. The lsass.exe file is not a Windows core file. The program is not visible. The lsass.exe file is located in the Windows folder, but it is not a Windows core file. The program has no file description. Lsass.exe is able to monitor applications, manipulate other programs and record keyboard and mouse inputs.
• If lsass.exe is located in a subfolder of C:\, the security rating is 62% dangerous. The file size is 551,669 bytes (15% of all occurrences), 552,448 bytes and 23 more variants. The lsass.exe file is not a Windows system file. There is no description of the program. The program has no visible window. The process starts when Windows starts (see Registry key: MACHINE\Run, Run, Userinit, User Shell Folders, Winlogon\Shell, TaskScheduler). Lsass.exe is able to monitor applications, record keyboard and mouse inputs and manipulate other programs.
• If lsass.exe is located in a subfolder of the user's profile folder, the security rating is 63% dangerous. The file size is 42,687 bytes (15% of all occurrences), 42,713 bytes and 24 more variants.
• If lsass.exe is located in a subfolder of "C:\Program Files", the security rating is 75% dangerous. The file size is 4,606,976 bytes (39% of all occurrences), 196,919 bytes and 11 more variants.
• If lsass.exe is located in the C:\Windows folder, the security rating is 80% dangerous. The file size is 13,179,660 bytes (25% of all occurrences), 185,344 bytes, 983,552 bytes or 528,398 bytes.
• If lsass.exe is located in the Windows folder for temporary files, the security rating is 90% dangerous. The file size is 1,591,808 bytes (33% of all occurrences), 24,064 bytes or 6,790,656 bytes.
• If lsass.exe is located in a subfolder of C:\Windows\System32, the security rating is 96% dangerous. The file size is 460,288 bytes (50% of all occurrences) or 471,040 bytes.
• If lsass.exe is located in the C:\Windows\System32\drivers folder, the security rating is 72% dangerous. The file size is 32,768 bytes.
• If lsass.exe is located in the "C:\Program Files\Common Files" folder, the security rating is 40% dangerous. The file size is 32,256 bytes.
• If lsass.exe is located in the user's profile folder, the security rating is 76% dangerous. The file size is 473,001 bytes.

External information from Paul Collins:
There are different files with the same name:

• "MicrosoftSourceSafe" definitely not required. Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process, which should not appear in Msconfig/Startup!
• "lsass" definitely not required. Added by the RATSOU.B TROJAN! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup!
• "Microsoft UPDATER32" definitely not required. Added by the RANDEX.AR WORM! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup!
• "System Handler" definitely not required. Added by the NIMOS WORM! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup!
• "Traybar" definitely not required. Added by the MYDOOM.L WORM! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup!

Important: Some malware disguises itself as lsass.exe, particularly when not located in the C:\Windows\System32 folder. Therefore, you should check the lsass.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.