Local Security Authority Subsystem Service
Template:Short description Template:Refimprove Local Security Authority Subsystem Service (LSASS)<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> is a process in Microsoft Windows operating systems that is responsible for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> It also writes to the Windows Security Log.
Forcible termination of Template:Mono will result in the system losing access to any account, including NT AUTHORITY, prompting a restart of the machine. Because, Template:Mono is a crucial system file, its name is often faked by malware. The Template:Mono file used by Windows is located in the directory Template:Mono, and the description of the file is Local Security Authority Process. If it is running from any other location, that Template:Mono is most likely a virus, spyware, trojan or worm. Due to the way some systems display fonts, malicious developers may name the file something like Template:Mono (capital "i" instead of a lowercase "L") in efforts to trick users into installing or executing a malicious file instead of the trusted system file.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> The Sasser worm spreads by exploiting a buffer overflow in the LSASS on Windows XP and Windows 2000 operating systems.