lsass.exe_什么是Windows lsass.exe（本地安全机构子系统服务）？

lsass.exe

lsass.exe is an executable which is related to the Local Security Authority Subsystem Service. lsass.exe is a popular executable file that runs on Windows operating systems in order to authenticate users, logins and permissions. lsass.exe is very crucial because of its importance and gets a lot of attacks in order to get higher privileges like Administrator from the hackers.

lsass.exe是与Local Security Authority Subsystem Service有关的可执行文件。 lsass.exe是一个流行的可执行文件，在Windows操作系统上运行，以对用户，登录名和权限进行身份验证。 lsass.exe非常重要，因为它很重要，并且为了从黑客那里获得更高的权限(如管理员)，遭受了很多攻击。

本地安全机构子系统服务 (Local Security Authority Subsystem Service)

Local Security Authority Subsystem Service is a service used to manage local security, login, and permissions.It is also responsible for enforcing security policy on Windows operating systems. The “lsass.exe” is the executable file and service of the “Local Security Authority Subsystem Service”.

Local Security Authority Subsystem Service是用于管理本地安全性，登录名和权限的服务，还负责在Windows操作系统上实施安全策略。 “ lsass.exe”是“本地安全机构子系统服务”的可执行文件和服务。

lsass.exe的位置或路径 (lsass.exe Location or Path)

“lsass.exe” is located under the Windows operating system folder “System32” folder. The complete or absolute path is “C:\Windows\System32” is the Windows operating system is installed on partition “C:”. The absolute path is %WINDIR%\System32 which is free of operating system partition path.

“ lsass.exe”位于Windows操作系统文件夹“ System32”文件夹下。 如果Windows操作系统安装在分区“ C：”上，则完整或绝对路径为“ C：\ Windows \ System32”。 绝对路径为%WINDIR%\System32 ，没有操作系统分区路径。

lsass.exe Location or Path

lsass.exe的位置或路径

是lsass.exe间谍软件还是病毒？(Is lsass.exe Spyware or Virus?)

By default and originally the “lsass.exe” is not a spyware or virus. It is originally provided by the Windows operating system and created for authorization, login, permission, etc. which makes it very important for security. In some cases, hackers, attackers, trojans, viruses, malware can modify the “lsass.exe” and add some extra code to this file.

默认情况下，默认情况下，“ lsass.exe”不是间谍软件或病毒。 它最初由Windows操作系统提供，并为授权，登录，许可等创建，因此对于安全性而言非常重要。 在某些情况下，黑客，攻击者，木马，病毒，恶意软件可以修改“ lsass.exe”并向该文件添加一些额外的代码。

If you think it is infected and want to remove the spyware, virus, or malware use antivirus software in order to complete this job. Do not try to remove manually the “lsass.exe” which will crash the system because it is a crucial and critical system process where the operating system relies on it.

如果您认为它已被感染并且想要删除间谍软件，病毒或恶意软件，请使用防病毒软件来完成此工作。 不要尝试手动删除将导致系统崩溃的“ lsass.exe”，因为这是操作系统所依赖的至关重要的系统进程。

从任务管理器删除/结束lsass.exe安全吗？ (Is It Safe To Remove/End lsass.exe from Task Manager?)

Simply the answer is “No”. Removing or ending the “lsass.exe” from the task manager is not safe because by default it can not removed from the task manager because it is ciritical system process and if we try to remove from the task manager we will get the followin error.

答案简单地是“不”。 从任务管理器中删除或结束“ lsass.exe”并不安全，因为默认情况下，由于它是系统系统进程，因此无法从任务管理器中将其删除，如果尝试从任务管理器中删除，则会出现跟随错误。

This is a critical system process. Task Manager cannot end this process.

We can see that the “lsass.exe” file provides 3 services named CNG Key Isolation ,Security Accounts Manager , Encrypting File System .

我们可以看到“ lsass.exe”文件提供了3个服务，分别为CNG Key Isolation ， Security Accounts Manager和Encrypting File System 。

But we can enforce the “lsass.exe” to end which will show the following screen which means ending the lsass.exe will reboot the system and all unsaved data may lost.

但是我们可以强制“ lsass.exe”结束，这将显示以下屏幕，这意味着结束lsass.exe将重新启动系统，所有未保存的数据可能会丢失。

We will see the following warning where the system will be restart in 1 minute.

我们将在系统在一分钟后重启的情况下看到以下警告。

翻译自: https://www.poftut.com/what-is-windows-lsass-exe-local-security-authority-subsystem-service/

lsass.exe