RIVET
Home / Process library / lsass.exe
What is lsass.exe?
lsass.exe is Local Security Authority. Checks sign-ins and enforces the PC's security policy. It holds credentials in memory, which is why it is a common target for attackers.
| Name | lsass.exe |
|---|---|
| Full name | Local Security Authority |
| Publisher | Microsoft Windows |
| Normal location | C:\Windows\System32 |
| Safe to end? | Keep No. lsass.exe is part of Windows and should keep running. |
| If you end it | Windows forces a restart. |
How to check it's the real lsass.exe
- Open Task Manager (Ctrl+Shift+Esc) and go to Details.
- Right-click lsass.exe and choose Open file location. It should open
C:\Windows\System32. - Right-click the file, choose Properties, then Digital Signatures. The signer should be Microsoft Windows.
A file called lsass.exe somewhere else, or without that signature, is worth scanning with Microsoft Defender.
What RIVET shows
RIVET's process list shows lsass.exe with this explanation, the verdict above, and a signature check, so you can see at a glance whether it is the genuine Windows file. Ending a process can't be undone, and RIVET warns you before it ends anything Windows needs.
Questions
Is lsass.exe a virus?
The genuine lsass.exe is part of Windows, signed by Microsoft Windows, and runs from C:\Windows\System32. Malware sometimes copies the name, so check the location and signature as shown above.
Can I end lsass.exe?
No. lsass.exe is part of Windows and should keep running. Windows forces a restart.