View Full Version : LSASS.exe - what is it?

27-11-2003, 12:41 PM
I've just installed a firewall (nortons) - and when I go on the net - it comes up that LSASS.EXE is trying to reach the net - outbound anyways, it recommends to permit it, and then - a few seconds later - it says something is trying to reach it (inbound) - sometimes it recommends to permit it - but other times it says to block it..

I haven't ticked the "always use this action" yet - as I'm not to sure waht it is.

Could some one please let me no if LSASS.exe is a system program - or some trojan?


27-11-2003, 01:25 PM
Process File: lsass or lsass.exe

Process Name: Local Security Authority Service

Description: The Windows Local Security Authority Server Process handles Windows Security Mechanisms

27-11-2003, 01:37 PM
There's also a trojan with a very similar name (I think it was lssass.exe). Discovered that on my Windows 2000 computer last week, because HDD activity was up a fair bit when the computer wasn't being used.

So it would pay to be wary about allowing applications permission to have outbound or inbound connections. Myself, I never let Microsoft applications access the internet unless it's absolutely essential. I believe General Host Process something-or-rather is safe to block access.

27-11-2003, 02:48 PM
Here's the information from Answers-that-work:

Windows NT4/2000/XP/2003 only. LSASS is the Local Security Authentication Server. It verifies the validity of user logons to your PC/Server (in technical jargon : it generates the process that is responsible for authenticating users for the Winlogon service).

Recommendation :
An integral part of the operating system, leave alone.