Why is lsass.exe accessing hard drive continually?

February 6, 2010 7:16 AM

Why is the lsass.exe process in Vista 64 constantly accessing my hard drive?

I've noticed my hard drive is always running/thrashing. I looked in Task Manager and enabled the I/O Read-Write columns and it appears that lsass.exe (Local Security Authority Process) is continually reading and writing to my hard drive causing it to thrash. I'm running MS Security Essentials and Defender and everything comes up clean (doesn't appear to be a sasser worm). Is there any reason this process would need to be constantly reading and writing to my hard drive?

posted by KevinSkomsvold to Computers & Internet (4 answers total)

That process is involved in authorizing access to resources on your computer. Every file and registry key has Access Control Lists that need to be checked. On this computer a Vist domain connected machine, I see lsass' I/O steadily move north. On another Win7 standalone machine those values go up more slowly. My guess is that you have something else on your computer that is doing a lot of I/O that then requires lsass to do more work. If you want a firehose of data about your system, check out SysInternals ProcessMon. There is a crazy amount of stuff that goes on behind the scenes of your computer.
posted by mmascolino at 8:47 AM on February 6, 2010

Do you have a virus checker that checks files every time they're accessed?
posted by rhizome at 10:08 AM on February 6, 2010

Is this machine new or old? If you turn off indexing does it help ? How much ram does this machine have?
posted by majortom1981 at 10:17 AM on February 6, 2010

Response by poster: Thanks for the answers/questions:

mmascolino - Thanks. I downloaded it and will take a look.

rhizome - Yes. MS Security Essentials has an option "Monitor file and program activity on your computer" which I will turn off and see if that makes a difference.

majortom1981 - It's a brand new HP with 4GB of memory. I did have indexing turned off as well as Superfetch. We'll see if any of these options make a difference.
posted by KevinSkomsvold at 7:29 PM on February 6, 2010