Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


lsass.exe activity

  • Please log in to reply
2 replies to this topic

#1 Machinist60


  • Members
  • 5 posts
  • Local time:04:50 AM

Posted 05 July 2013 - 11:18 AM


I am running win xp pro sp3 and have noticed of late that lsass.exe is beating quite a lot on the hdd.  Is is normal for it to to make about 350 I/O reads and 320 writes in one minute?  They are reported by task manager in high update rate in increments of three usually.  At times it appears to prevent sleep mode.  csrss.exe is equally or more active but only with reads.


Advice appreciated,


Thanks, John.



Attached Files

  • Attached File  wtm.jpg   110.96KB   3 downloads

BC AdBot (Login to Remove)


#2 hamluis



  • Moderator
  • 56,562 posts
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:50 AM

Posted 05 July 2013 - 01:17 PM

Well...I don't monitor or concern myself with input/ouput reads and writes...I only become conerned with CPU usage or memory usage seems out of line.


But, for comparative purposes only...my lsass reflects I/O reads of over 1.5 million, while my writes are over 700,000.


I have no concerns, no system problems at all.



Edited by hamluis, 09 July 2013 - 10:47 AM.

#3 Animal


    Bleepin' Animinion

  • Members
  • 35,905 posts
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:12:50 AM

Posted 08 July 2013 - 03:54 PM

Local Security Authority Subsystem Service also known as lsass.exe is just doing it's job by making sure everything is secure within your operating system. I wouldn't worry about it.

I would however make sure that there is only one instance of lsass.exe and it is in the following path: C:\Windows\System32

Any other instances of lsass.exe elsewhere should be suspect.

The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown (1938-1994)

A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams (1952-2001)

"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)

Follow BleepingComputer on: Facebook | Twitter | Google+

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users