| Local Security Authority | |
|---|---|
| Name | Local Security Authority |
| Abbreviation | LSA |
| Type | Component |
| Developed by | Microsoft |
| Initial release | Windows NT 3.1 |
| Written in | C, C++ |
| Operating system | Microsoft Windows |
| License | Proprietary |
Local Security Authority
The Local Security Authority is a core authentication and policy subsystem in Microsoft Windows derived from designs used in Windows NT 3.1, Windows 2000, and later Windows XP and Windows Server 2003 releases. It mediates logon, credential storage, security policy enforcement and inter-process trust relationships used by Active Directory, Kerberos (protocol), and legacy NTLM authentication across workgroups, domains and cloud-integrated environments such as Azure Active Directory. The component integrates with system services like the Security Accounts Manager and platform features in Windows Vista, Windows 7, Windows 10, and Windows 11.
LSA initializes early in the boot sequence and runs in kernel or user mode variants depending on platform evolution between Windows NT generations and Windows Server editions. It collaborates with account databases such as the SAM (Security Account Manager) and directory services like Active Directory Domain Services to validate identities presented by interactive sessions, network logons, and service startup using protocols that include Kerberos (protocol), NTLM, and extensions for Smart card logons. Administrators interact with LSA-related configuration via tools and MMC snap-ins tied to Group Policy, Local Group Policy Editor, and command-line utilities used in Microsoft Management Console contexts.
The architecture splits responsibilities across user-mode and kernel-mode components, notably the user-mode service often known as the LSA process and the kernel-mode Security Support Provider Interface driver. Key components include the Security Accounts Manager, authentication packages (providers), the LSA Policy Database, and the Credentials Manager. LSA hosts authentication packages such as the Kerberos (protocol) package, the NTLM package, and third-party SSPI implementations. It exposes interfaces used by subsystems including the Winlogon process, LSASS.exe runtime, and the Local Security Authority Subsystem Service (LSASS) interactions with the Windows Logon Service.
LSA coordinates multi-protocol authentication flows: it issues and validates Kerberos (protocol) tickets for domain-authenticated principals, negotiates NTLM challenge-response for legacy clients, and supports credential provider frameworks introduced in Windows Vista and later. Credential storage mechanisms include LSA Secrets, the Credential Manager, and the DPAPI envelope for protecting secrets. Integration points include the Secure Channel used by domain members to contact Domain Controllers, trust relationships with Active Directory Federation Services and protocols used by Remote Desktop Services and Network Policy Server.
LSA Secrets store machine and service credentials, cached domain secrets, and other sensitive artifacts protected by LSA access controls. The LSA Policy subsystem defines account rights, audit policy, and system privileges referenced in administrative tools like secpol.msc and command-line utilities such as sc.exe and net user. Policy enforcement influences operations in Task Scheduler, Service Control Manager, and authentication realms used by IIS and SQL Server when running under system accounts. Hardening guidance often references Microsoft Security Compliance Toolkit baselines and mitigations recommended for enterprise deployments.
LSA exposes programmatic surfaces through documented and undocumented APIs including the Security Support Provider Interface (SSPI), LsaLogonUser, LsaRegisterLogonProcess, and registry-backed policy keys under HKEY_LOCAL_MACHINE\SECURITY. Third-party authentication packages and credential providers integrate via interfaces similar to Gina in legacy systems or the newer Credential Provider APIs. Remote administration and diagnostic scripting interact with LSA-related functions through PowerShell cmdlets, WMI classes, and management APIs used by System Center and other orchestration tools.
LSA and its hosted process LSASS.exe have been high-value targets in multiple incident response cases, exploitation techniques, and research disclosed at venues such as Black Hat USA and DEF CON. Attack patterns include credential dumping using tools inspired by Mimikatz, pass-the-hash attacks leveraging NTLM artifacts, ticket forging against Kerberos (protocol) (golden ticket, silver ticket), and privilege escalation through LSA injection or DLL hijacking. Historical advisories involving CVE identifiers have prompted mitigations via Windows Update, Defender protections, and guidance from US-CERT and industry vendors. Detection and mitigation strategies invoke Event Viewer logs, Sysinternals utilities, and endpoint detection platforms standardized in MITRE ATT&CK matrices.
Administrators manage LSA-related settings through MMC snap-ins, Group Policy Management Console, command-line tools, and registry editing in controlled scenarios. Troubleshooting common issues involves analyzing Event Viewer entries for Security and System logs, using klist and nltest for authentication diagnostics, employing Process Explorer and Procmon from Sysinternals for process diagnostics, and leveraging recovery workflows documented by Microsoft Learn and vendor knowledge bases. Incident response workflows typically involve isolating compromised hosts, resetting machine account passwords in Active Directory, rotating credentials stored as LSA Secrets, and monitoring for residual artifacts using SIEM platforms operated by enterprises and managed service providers.
Category:Microsoft Windows security components