Local Security Authority Subsystem Service: Difference between revisions

Revision as of 21:24, 17 September 2014

Revision as of 23:20, 26 September 2014

Line 4:

Forcible termination of <tt>lsass.exe</tt> will result in the Welcome screen losing its accounts, prompting a restart of the machine.

Because lsass.exe is a crucial system file, its name is often faked by malware, for instance by naming otherwise-suspect files "Isass.exe" with a capital i, which makes them easy to miss in a cursory inspection of running processes. The lsass.exe file used by Windows is located in the folder C:\Windows\System32. If it is running from any other ___location, that lsass.exe is most likely a virus, spyware, trojan or [[Worm (computing)|worm]].

==See also==