What is the "lsass.exe (Local Security Authority Process)" system executable program on Windows Server 2008? I want to know how lsass.exe is used to host services.

"lsass.exe (Local Security Authority Process)" is a Windows Server 2008 system executable program that is used to launch and host multiple Windows security related services.

If a service is configured to be launched and hosted by lsass.exe, it will provide a DLL file as a registry setting associated with this service. This DLL file contains the actual code for this service.

For example, service "VaultSvc (Credential Manager)" is configured to be launched and hosted by lsass.exe. It has the following registry setting: File=C:\Windows\system32\vaultsvc.dll.

So if "VaultSvc (Credential Manager)" service is started, vaultsvc.dll will be loaded to system and hosted by the lsass.exe process, together with other services in this group.

Detailed information on "lsass.exe" program:

Name: lsass.exe
Location: C:\Windows\system32\lsass.exe
Description: Local Security Authority Process
File version: 6.1.7601.23915
Size: 30.0 KB (30,720 bytes)
Modified: Wednesday, September 13, 2017, 10:52:23 AM 

⇒Executable Programs on Windows Server 2008

⇒⇒Windows Server 2008 Tutorials