lsass.exeSafeWhat is lsass.exe?
C:\Windows\System32\lsass.exelsass.exe is a legitimate Windows system process from Microsoft called the Local Security Authority Subsystem Service. It helps Windows sign you in and enforces security policies.
What it does
lsass.exe handles important security tasks such as verifying user logins, managing password changes, and applying local security rules. Windows depends on it, so it normally runs in the background all the time.
Is it safe?
Yes. The real lsass.exe is a core Windows component and should be left alone. However, malware can sometimes use the same name to hide. The real file is usually located in C:\Windows\System32\lsass.exe and is signed by Microsoft Corporation.
Why it causes high CPU or disk usage
- 1Windows is processing sign-in or authentication activity
- 2A security policy, domain login, or password-related task is busy
- 3Malware or a fake lsass.exe copy is masquerading under the same name
- 4System file corruption or a Windows security component issue
How to check if it's legitimate
- In Task Manager, right-click lsass.exe and choose Open file location.
- Confirm the file is in
C:\Windows\System32. - Right-click the file, open Properties, and check that the digital signer/publisher is Microsoft Corporation.
- If it is running from another folder, has no Microsoft signature, or you see multiple copies, treat it as suspicious and scan for malware.
- If the file location and publisher are correct but CPU stays high, restart the PC and install the latest Windows updates.
How to remove it
Do not try to delete or end the real lsass.exe. It is required for Windows security and stopping it can force a sign-out or restart. If you suspect a fake copy, remove that suspicious file only after confirming it is not in C:\Windows\System32 and is not signed by Microsoft. Then run a full malware scan and check for Windows updates. If the process is legitimate but still causing problems, restart the device and scan for malware or system file issues instead of removing lsass.exe.
Recommended fixes
Restart your device
A restart clears temporary state that often causes transient errors.
- Save your work and close open apps.
- Restart the device from the power menu.
- Reproduce the issue to check whether it persists.
Install Windows updates
- Open Settings > Windows Update.
- Click Check for updates and install everything available.
- Restart if prompted.
Run System File Checker and DISM
- Open Command Prompt as administrator.
- Run
sfc /scannowand let it complete. - Then run
DISM /Online /Cleanup-Image /RestoreHealth. - Restart your PC.
Scan for malware (Windows)
- Open Windows Security > Virus & threat protection.
- Run a Full scan.
- Quarantine or remove anything detected, then restart.
Need more help?
Run a free diagnostic scan to identify and fix issues automatically.
Download Quickfix AI