What is the relation between LSA and LSASS in Windows?

I know that LSA and LSASS stands for "Local Security Authority" And "Local Security Authority Subsystem Service", respectively.

The LSASS is an executable within Windows that stores credentials in memory etc, both for local and domain users (right?)

Is LSASS merely an implementation of LSA, or what is the relationship between these two?

1 Answer

Yes, there is "LSA" the concept, and "lsass.exe", a process that implements many of the functions of LSA. Besides "authentication" itself (validating user's credentials against the SAM database) this does include storage of credentials, secure key storage (if your system has no other place to store them), and so on. If you have auditing enabled on e.g. files, it is the Lsass.exe that formats and sends the entries to the security log.

btw, in a domain, when you log into a domain account, the actual job of authentication of course happens on the domain controller. The authentication credentials are then still stored in your local machine.

There are also APIs whose names start with "Lsa", and these provide interfaces to LSA functions.

The term "ss" for "subsystem" is more jargon. There is no clear definition I've ever seen that explains exactly what in Windows gets named a "subsystem". In the case of lsass.exe the term "subsystem" may refer to the fact that this process implements several different upper-level functions, even a few services. But that explanation doesn't fit, for example, csrss.exe, the "helper" process for Win32 APIs.

On a Windows 10 system with modern hardware, with virtualization features turned on in the firmware, you may also see the LSAiso.exe process running. This is "LSA isolated". It is a "trustlet" - Microsoft jargon for an executable running in "VTL 1", virtual trust level 1, in a mechanism called "virtualization-based security". VBS is very clever and effective. In this design, things like the credential store are stored in areas of memory where they cannot be accessed from "normal" (VTL 0) user or kernel mode. VBS gets turned on automatically with a late-enough version of Windows 10 and if your CPU supports it.