What is lsass.exe?

LSASS, or local security authority subsystem service, is a function or process that is part of the Microsoft Windows operating system. Essentially, LSASS is part of the process for maintaining and enforcing the security protocols on the operating system. To this end, LSASS performs several important functions to ensure that the system remains free of unauthorized access and is not infected by a wide range of viruses and bugs.

What Does LSASS Specifically Do?

Perhaps the most common task that LSASS oversees is the access to the computer or server. LSASS recognizes any restrictions on access to any information on the hard drive or the server, and will make sure that only recognized access codes or other login credentials will allow persons to interact with those data files. This means that LSASS comes into play each time someone logs into the server, or uses a desktop computer and gains access to password protected files.

LSASS can also allow administrators or any user that is granted the proper privileges to make changes and updates to passwords and user profiles. For example, it is through LSASS that authorized personnel may delete, change, or create new passwords and user files. Any and all changes are noted in the Windows Security Log.

How Does The Sasser Worm Relate To LSASS?

The Sasser Worm was an electronic worm virus that was specifically created to take advantage of a design vulnerability in versions of LSASS that were found in Windows 2000 and Windows XP. Essentially, the worm would make use of LSASS to create what is known as a buffer overflow. This overflow would make it possible for the worm to use the system resources to spread to other machines on the network. Unlike many other worm viruses, the Sasser worm was not spread by email. But once in any one computer, it could quickly spread to any other computers that were connected to the same network.

Can an Infected LSASS be repaired?

Yes, it is possible to remove the Sasser worm from LSASS and restore full functionality without damaging any of the aspects of the process. Because the Sasser worm can cause LSASS to end abruptly, LSASS will flash a timer on the screen, warning users to save work in progress before the operating systems shuts down. Once the system is down, it is possible to reboot the system and use immunizations software to isolate the worm, banish it from the system, and restore the function of LSASS.