How to identify the lsass.exe process on and its hosted services on Task Manager on Windows 7? I want to know how much memory is used by lsass.exe.

You can easily identify the lsass.exe process and its hosted services on Task Manager using these steps:

1. Type in "taskmgr" in the Start button search box to start the Task Manager.

2. Click the "Process" tab. Then click the "Image Name" to sort the process list by name.

3. Locate the "lsass.exe" line in process list, And note done the Memory usage. For example:

Name       PID  User    CPU Memory   Description

lsass.exe  600  SYSTEM  00  5,184 K  Local Security Authority Process

4. Right-mouse click on "lsass.exe", and select "Go to process(es)" from the context menu. The "Services" tab will open with services running under "lsass.exe" highlighted.

5. Review the highlighted services. For example:

Name     PID Description                  Status

SamSs    600 Security Accounts Manager    Running
Netlogon 600 Netlogon                     Running
KeyIso   600 CNG Key Isolation            Running
EFS      600 Encrypting File System (EFS) Running

This confirms that all 4 services are running under a single shared process of "lsass.exe" with PID = 600.

⇒ Other System Services on Windows 7

⇐ What Is lsass.exe Program on Windows 7

⇑ 'lsass.exe' Services on Windows 7

⇑⇑ Windows 7 Services Tutorials