The lsass.exe (Local Security Authority Subsystem Service) process is one of the most critical security components in Windows 11. It handles user authentication, password validation, security policies, and access tokens. Because of this, any issue with lsass.exe—such as unexpected termination or very high CPU / disk usage—can severely impact system stability and performance.
If you are seeing errors like “lsass.exe terminated unexpectedly”, frequent system slowdowns, or sustained high CPU/disk usage linked to lsass.exe, this guide will walk you through every reliable fix, step by step.
Why lsass.exe Causes High CPU or Disk Usage (or Terminates)
Before fixing the issue, it helps to understand the common causes:
- Corrupted system files or security databases
- Malware disguising itself as lsass.exe
- Broken Windows updates or domain policy sync loops
- Excessive authentication requests (common on work or domain PCs)
- Disk or file system errors
- Faulty security software or credential providers
- Insufficient system resources or failing storage
The real lsass.exe file is essential—you should never delete it. The goal is to stabilize it, not remove it.
1. Confirm lsass.exe Is Legitimate (Very Important)
Malware often pretends to be lsass.exe.
- Press Ctrl + Shift + Esc to open Task Manager
- Find Local Security Authority Process (lsass.exe)
- Right-click it and select Open file location
Legitimate file location:
C:\Windows\System32\lsass.exe
If it’s running from any other location, your system is likely infected.
If the location is wrong, skip directly to the malware scan step below.
2. Restart the PC and Observe Usage
Temporary authentication loops can spike lsass.exe usage.
- Restart your PC
- Do not open any apps immediately
- Open Task Manager → Performance / Processes
- Observe CPU and disk usage for 5–10 minutes
If usage drops to normal levels, the issue was likely temporary.
If it spikes again, continue.
3. Run a Full Malware Scan (Critical Step)
lsass.exe-related issues are commonly malware-related.
- Open Windows Security
- Go to Virus & threat protection
- Click Scan options
- Select Full scan
- Start the scan and wait for completion
If threats are found:
- Remove them
- Restart the system
- Re-check lsass.exe usage
If malware was present, this step alone may fully resolve the issue.
4. Run System File Checker (Fix Corrupted Security Files)
Corrupted system files can destabilize lsass.exe.
- Press Windows + X → Terminal (Admin)
- Run:
sfc /scannow - Wait for the scan to complete
- Restart your PC
If corrupted files were repaired, lsass.exe behavior often returns to normal.
5. Repair Windows Image Using DISM (Highly Recommended)
If SFC is not enough, repair the Windows image.
- Open Terminal (Admin)
- Run the following commands one by one:
DISM /Online /Cleanup-Image /CheckHealth DISM /Online /Cleanup-Image /ScanHealth DISM /Online /Cleanup-Image /RestoreHealth - Restart your PC
This fixes deep system corruption that directly affects security services.
6. Check Disk Health (High Disk Usage Fix)
lsass.exe reads security databases from disk. Disk errors can cause constant retries.
- Open Terminal (Admin)
- Run:
chkdsk C: /f - Press Y when prompted
- Restart your PC and let the scan finish
Bad sectors or file system errors often cause persistent lsass.exe disk usage.
7. Temporarily Disable Third-Party Security Software
Some antivirus or endpoint protection tools conflict with lsass.exe.
- Temporarily disable third-party antivirus or security tools
- Restart your PC
- Monitor lsass.exe CPU and disk usage
If usage drops significantly, update or replace the conflicting software. Do not leave your system unprotected—this is only for testing.
8. Check Windows Update Status
Broken or looping updates can cause lsass.exe authentication spikes.
- Open Settings → Windows Update
- Install all pending updates
- Restart your PC
If the issue started after a recent update, note the date—it may be relevant.
9. Check for Domain or Work Account Loops (Work PCs)
On work or school PCs, lsass.exe may spike due to account sync issues.
- Open Settings → Accounts → Access work or school
- Check connected accounts
- Disconnect and reconnect the work account (if allowed)
- Restart the system
This resolves repeated authentication loops.
10. Test in Safe Mode
Safe Mode loads minimal services.
- Boot into Safe Mode
- Observe lsass.exe behavior
- Normal usage in Safe Mode → third-party software is the cause
- High usage persists → system-level issue
Wrapping Up
High CPU or disk usage—and especially crashes—related to lsass.exe are serious but fixable. In most cases, the root cause is malware, corrupted system files, disk errors, or security software conflicts. By carefully verifying the file, scanning for malware, repairing Windows components, and checking disk health, you can restore system stability without reinstalling Windows.
