lsass.exe is an important Windows security process used for sign-in checks and security rules. High CPU or memory use needs checking, but it does not by itself prove that the process is malware.
Why it matters
Windows’ Local Security Authority handles sign-in checks and sensitive security information. Microsoft‘s LSA protection documentation explains protections around this process. It is not an application to remove simply because it appears in Task Manager.
Inspect the actual file
- Open Task Manager and locate the process.
- Use its Properties or Open file location where available.
- Check the path and verified Microsoft publisher information.
- Compare the filename carefully; look-alike names can be different files.
The normal system executable is under %SystemRoot%\System32\lsass.exe. A name or folder alone is not a complete safety test. Use multiple signals and a current security scan when the origin is uncertain.
If access is restricted
Protected-process settings can limit inspection. Do not disable LSA protection just to look at a process, and do not create or share an LSASS memory dump as a casual diagnostic file: it can contain passwords and other sensitive sign-in information.
Investigate high resource use
| Pattern | Useful next step |
|---|---|
| A brief spike during sign-in checks | Observe whether it settles and record the trigger. |
| Sustained high use after an update | Check for updates and known issues for your exact Windows build. |
| Work/domain machine | Ask IT to check sign-in and service activity. |
| Uncertain file origin | Check the file and run Windows Security rather than guessing from CPU use. |
Do not end the real process
Ending the genuine security process can cause a serious system failure. Save work and use supported diagnosis, repair or a normal restart when appropriate. A security detection should be handled through the security product, rather than manually deleting a critical system file.
For another helper with a less clear filename, see how to inspect identity_helper.exe.
Reviewed October 12, 2026, using the sources linked above.