Local Security Authority Subsystem Service
Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing the security policy on the system.  It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. It also writes to the Windows Security Log.

Forcible termination of  will result in the system losing access to any account, including NT AUTHORITY, prompting a restart of the machine.

Because  is a crucial system file, its name is often faked by malware. The  file used by Windows is located in the directory  and the description of the file is Local Security Authority Process. If it is running from any other location, that  is most likely a virus, spyware, trojan or worm. Due to the way some systems display fonts, malicious developers may name the file something like  (capital "i" instead of a lowercase "L") in efforts to trick users into installing or executing a malicious file instead of the trusted system file. Sasser (computer worm) spreads by exploiting a buffer overflow in the LSASS on Windows XP and Windows 2000 operating systems.

References

External links
Security Subsystem Architecture
LSA Authentication
MS identity management

Microsoft Windows security technology
Windows NT architecture
Access control software
Windows components