Local Security Authority Subsystem Service
From Wikipedia, the free encyclopedia
Local Security Authority Subsystem Service (LSASS), is a process in Microsoft Windows operating systems that is responsible for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server and creates security tokens.
[edit] Trivia
The Sasser worm exploited a vulnerability in LSASS [1] to spread via a remote buffer overflow in computers running Microsoft Windows XP and Windows 2000. The worm is particularly potent in that it can spread without any interaction with humans, nor does it 'travel by email' like many other worms.
Should the lsass.exe program end, for example, by the Sasser worm's effects, then a countdown timer will appear on the screen, advising the user to save their work and close all programs before the computer shuts off. This timer, however, can be thwarted by changing the computer's date and time settings or by typing shutdown -a in the run window.
Forcible termination of lsass.exe will result in the Welcome screen losing its accounts, prompting a restart of the machine.
