What Is Local Security Authority Process? Is It Safe to Disable at Startup?

What Is Local Security Authority Process?

Local Security Authority Process (lsass.exe) is a core Windows process that enforces security policy. It handles parts of sign-in, password changes, authentication tokens, and other security checks used by Windows and many apps.

It is not a normal startup app and it should not appear as something you turn on or off in Startup. Windows starts it as part of the operating system, and other components depend on it.

Is It Safe?

Yes, if it is the real Microsoft process. The legitimate file is lsass.exe and is normally located in C:\Windows\System32.

Because malware sometimes pretends to be system processes, check these points if you are unsure:

• In Task Manager, right-click Local Security Authority Process and open its file location.
• The real file should be in C:\Windows\System32.
• In the file properties, the digital signature should show Microsoft Windows or Microsoft Corporation.
• Be cautious if you see lsass.exe running from a user profile, temp folder, Downloads, or any folder outside System32.

Do not end the real LSASS process. On Windows, terminating it can force a shutdown or crash because it is critical to system security.

Should I Disable It at Startup?

No. You should not disable Local Security Authority Process at startup.

It is a required Windows component, not an optional background app. If a tool claims to disable lsass.exe, do not use that change unless you are doing advanced troubleshooting and know exactly what is being modified.

If you are seeing lsass.exe listed somewhere unusual, treat that as a reason to investigate, not a reason to disable the real process.

Why Is It Using High CPU or Memory?

Short spikes can happen during sign-in, password-related activity, policy updates, or when security software interacts with Windows authentication. That can be normal.

If usage stays high for a long time, common causes include:

• a stuck authentication or domain-related task
• corrupted system files
• security software conflicts
• malware using the lsass.exe name

First, confirm the file location and signature. If it is the real file in System32, restart the PC and check whether the usage returns. If it continues, review recent security software changes and run a malware scan. On Windows, system file checks such as SFC and DISM can also help if Windows components are damaged.

How to Disable or Remove It

You generally do not disable or remove Local Security Authority Process. It is part of Windows.

If you suspect a fake lsass.exe:

1. Check the process file location.
2. Verify the Microsoft digital signature.
3. Run a malware scan.
4. If the file is outside C:\Windows\System32, investigate it before deleting anything manually.

If the real process is causing errors, focus on repairing Windows rather than trying to remove LSASS.

Where Kudu Helps

Kudu can help you check whether high resource use is coming from the real lsass.exe or from something pretending to be it. In Performance Monitor, you can watch CPU and memory use live and inspect the process by PID.

If you suspect malware, use Malware Scanner to check for suspicious files, persistence, and known malicious patterns. If Windows security components seem damaged, Disk Repair can guide you through SFC and DISM.

Kudu's Startup Manager is useful for finding optional apps that load at boot, but LSASS itself is not something you should disable there.

Download Kudu Free →