The Local Security Authority Subsystem Service or LSASS.exe is a process in the Windows operating system that is valuable as it enforces the security policy on the computer. Every time you log in to the Windows Server, the LSASS.exe is the one that handles the password changes and creates the access tokens while updating the security log. However, it is also frequently targeted by malware and is often imitated. The original location of this file is at “C:/Windows/System32” so if you open the Task Manager and notice that a process with a similar name has a different location then it is definitely a threat and is exploiting the security of your computer.
To resolve issues related to LSASS.exe, here are some fixes that could help.
Option 1 – Use the Performance Monitor’s Active Directory Data Collector
Note that this option will only work on the recent Windows server versions. Refer to the steps below to use the Performance Monitor’s Active Directory Data Collector set on your computer.
- Tap the WINKEY + R button to open the Run dialog box.
- Then type “Perfmon.msc” in the field and hit Enter to open the Performance Monitor and from there open the Server Manager.
- Next, navigate to Diagnostics > Reliability and Performance > Data Collector Sets > System from the left side of the navigation bar.
- Then right-click on “Active Directory Diagnostics” and select Start from the context menu. This will take about 5 minutes or 300 seconds depending on the performance capabilities of your hardware to gather the data required and then take some more time to compile a report from the gathered data. Note that these timings are dependent on one another.
- After the report is compiled, you can find it under Diagnostics > Reliability and Performance > Reports > System > Active Directory Diagnostics. The report will contain all the information as well as conclusions. However, it does not mean that it will also contain the exact cause of the problem with LSASS.exe. Nevertheless, it should help you in fixing the problem.
Option 2 – Try to run the System File Checker
System File Checker or SFC is a built-in command utility that helps in restoring corrupted files as well as missing files. It replaces bad and corrupted system files to good system files that might be the cause why the LSASS.exe file is having some issues. To run the SFC command, follow the steps given below.
- Type “cmd” in the Start search and then right-click on the appropriate search result.
- Next, select “Run as administrator” to open Command Prompt with admin privileges.
- After opening Command Prompt, type in sfc /scannow
The command will start a system scan which will take a few whiles before it finishes. Once it’s done, you could get the following results:
- Windows Resource Protection did not find any integrity violations.
- Windows Resource Protection found corrupt files and successfully repaired them.
- Windows Resource Protection found corrupt files but was unable to fix some of them.
Now restart your computer and see if the problem is fixed or not.
Option 3 – Put your computer in a Clean Boot State
If none of the options given above helped, you can try putting your computer in a Clean Boot State as this can help you in finding any incompatible programs that’s causing the problem.
- Log onto your PC as an administrator.
- Type in MSConfig in the Start Search to open the System Configuration utility.
- From there, go to the General tab and click “Selective startup”.
- Clear the “Load Startup items” check box and make sure that the “Load System Services” and “Use Original boot configuration” options are checked.
- Next, click the Services tab and select the “Hide All Microsoft Services” check box.
- Click Disable all.
- Click on Apply/OK and restart your PC. (This will put your PC into a Clean Boot State. And configure Windows to use the usual startup, just simply undo the changes.)
- From there, start to isolate the problem by checking which one of the programs you installed recently is the root cause of the problem.
Once you’ve found any incompatible programs, you need to uninstall them. Refer to the steps below to do so.
- In the search box, type in “control” and then click on Control Panel (desktop app) among the search results.
- After that, select Programs and Features from the list which will give you a list of all the programs installed on your computer.
- From there, look for the concerned program and select it and then uninstall it.
Note: If you have downloaded the app from the Windows Store, you can simply right-click on it from the application list and then uninstall it.