---
description: What is Local Security Authority (LSA) ?
---

# Local Security Authority (LSA)

1. Understanding Local Security Authority (LSA)
2. How it Works
3. LSA in Windows 10 and 11
4. Components of LSA
5. LSA Security Mechanisms
6. LSA and Active Directory
7. Best Practices for Managing LSA Security
8. References

***

### <mark style="color:blue;">Understanding Local Security Authority (LSA)</mark>

## **Definition and Key Responsibilities**

* The <mark style="color:blue;">**Local Security Authority**</mark> (LSA) is a critical component within the Microsoft Windows operating system, tasked with enforcing security policies on the system.
* It acts as the <mark style="color:blue;">**gatekeeper**</mark> for accessing the computer, handling user logins, authentication, and authorization processes.
* The <mark style="color:blue;">**LSA**</mark> is responsible for verifying user credentials when they attempt to access the system and determines whether they should be granted access based on <mark style="color:blue;">**configured policies**</mark>.
* &#x20;Additionally, it manages <mark style="color:blue;">**password changes and creates access tokens**</mark>, which define the resources and operations the user can access and perform during their session.
* The Local Security Authority (LSA) is responsible for managing <mark style="color:blue;">**interactive logons**</mark> to the system.

<figure><img src="https://3849832254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0VV5UVf1Opf7lSgalz6c%2Fuploads%2FktG3BVfgVJcGvdP8Asu7%2Fimage.png?alt=media&#x26;token=d72ed2cb-cc51-4396-8c5d-de9684ba7b69" alt=""><figcaption><p><mark style="color:blue;"><strong>LSA – Local Security Authority</strong></mark></p></figcaption></figure>

### _<mark style="color:yellow;">Historical Context and Evolution</mark>_

Historically, the LSA has been a cornerstone of Windows security since its early versions, evolving alongside the operating system to address the growing complexity and sophistication of cybersecurity threats. In earlier Windows versions, the LSA’s primary focus was on managing local and network logins using various authentication protocols. Over time, as Windows transitioned from a predominantly standalone operating system to a networked environment, the role of the LSA expanded to include more advanced security mechanisms, such as Kerberos protocol support for domain environments and integration with Active Directory.

***

## <mark style="color:blue;">How it Works</mark>

### <mark style="color:blue;">How it Works(</mark>**Local Authentication**<mark style="color:blue;">)</mark>

* When a user attempts to log on locally to the system by entering a username and password in the logon dialog box, the logon process invokes the LSA, which passes the user’s credentials to the Security Accounts Manager (<mark style="color:blue;">**SAM**</mark>), which manages the account information stored in the local SAM database.
* The SAM compares the user’s credentials with the account information in the SAM database to determine whether the user is authorized to access the system. If it finds the user account information in the SAM database, the SAM authenticates the user by creating a logon session and returning the security identifier (<mark style="color:blue;">**SID**</mark>) of the user and the SIDs of global groups of which the user is a member to the LSA.
* The LSA then grants the user an [<mark style="color:blue;">access token</mark>](https://networkencyclopedia.com/access-token/) that contains the user’s individual and group SIDs and their rights; these enable the user to access resources for which he or she has permissions.

### <mark style="color:blue;">Steps of local authentication  :</mark>&#x20;

1. A user provides their username and password during login.
2. The LSA (via the **LSASS process**) receives the credentials.
3. The LSA uses the **MSV1\_0 authentication package** to verify the credentials against the local SAM database.
4. If the credentials match, the user is granted access; otherwise, access is denied.

***

### <mark style="color:blue;">How it Works(</mark>**Token Generation**<mark style="color:blue;">**)**</mark>

* After successful authentication, the LSA generates an **access token** for the user. This token contains the user’s **Security Identifier (SID)**, group SIDs, and privileges.

### <mark style="color:blue;">**Purpose of the token**</mark>

* The token is attached to the user’s session and is used by the system to enforce **access control** on local resources (e.g., files, folders, and registry keys).
* It ensures that the user can only access resources they are authorized to use.

***

### <mark style="color:blue;">How it Works(</mark>**Enforcement of Local Security Policies**<mark style="color:blue;">**)**</mark>

* The LSA enforces **local security policies** configured on the machine.

### &#x20;<mark style="color:blue;">These policies are stored in the local registry and include:</mark>

* **Password Policies**:
  * Minimum password length.
  * Password complexity requirements.
  * Password expiration and history.
* **Account Lockout Policies**:
  * Number of failed login attempts before an account is locked.
  * Duration of the lockout.
* **User Rights Assignment**:
  * Determines which users or groups have specific privileges (e.g., "Log on locally," "Shut down the system," "Change the system time").
* **Audit Policies**:
  * Specifies which security events are logged (e.g., logon attempts, object access, privilege use).
* <mark style="color:blue;">**These policies are configured using the Local Security Policy tool (**</mark><mark style="color:blue;">**`secpol.msc`**</mark><mark style="color:blue;">**) or the Group Policy Editor (**</mark><mark style="color:blue;">**`gpedit.msc`**</mark><mark style="color:blue;">**) on the local machine.**</mark>

***

### <mark style="color:blue;">How it Works(</mark>**Management of Local Accounts and Groups**<mark style="color:blue;">**)**</mark>

#### <mark style="color:blue;">**The LSA manages local user accounts and groups stored in the SAM database. This includes:**</mark>

* Creating, modifying, and deleting local user accounts.
* Managing group memberships (e.g., adding users to the **Administrators** or **Users** group).
* Storing and verifying user credentials (e.g., password hashes).

***

### <mark style="color:blue;">**How it Works(**</mark>**Storage and Protection of LSA Secrets**<mark style="color:blue;">**)**</mark>

The LSA stores sensitive information, known as **LSA secrets**, in a secure portion of the registry. These secrets include:

* **Service Account Passwords**: Passwords for services configured to run under specific user accounts.
* **Encryption Keys**: Keys used by the system for encryption and decryption.
* **Cached Credentials**: Credentials for accessing shared resources on other workgroup computers.

_<mark style="color:red;">**🎯 LSA secrets are encrypted and protected by the system, but they can be targeted by attackers using tools like**</mark> Mimikatz_

***

### <mark style="color:blue;">**How it Works(**</mark>**Auditing and Logging**<mark style="color:blue;">**)**</mark>

The LSA is responsible for **auditing security events** on the local machine. This includes logging events such as:

* Successful and failed logon attempts.
* Changes to user accounts or groups.
* Access to sensitive resources (if auditing is enabled).

<mark style="color:blue;">**These logs are stored in the Security Event Log and can be viewed using the Event Viewer (**</mark><mark style="color:blue;">**`eventvwr.msc`**</mark><mark style="color:blue;">**).**</mark>

***

### <mark style="color:blue;">**How it Works(**</mark>**Handling Interactive and Network Logons**<mark style="color:blue;">**)**</mark>

<mark style="color:blue;">**In a workgroup, the LSA handles both interactive logons (local logins) and network logons (accessing shared resources on other workgroup computers).**</mark>

* <mark style="color:green;">**Interactive Logons:**</mark>
  * The user logs in directly to the local machine.
  * The LSA verifies the credentials against the local SAM database.
* <mark style="color:green;">**Network Logons:**</mark>
  * When a user accesses a shared resource (e.g., a file or printer) on another workgroup computer, the LSA verifies the credentials provided by the remote machine.
  * The LSA may cache credentials for future use.

***

### <mark style="color:blue;">**How it Works(**</mark>**Supporting Workgroup-Specific Scenarios**<mark style="color:blue;">**)**</mark>

In a workgroup, the LSA also handles scenarios unique to non-domain environments, such as:

* <mark style="color:blue;">**Peer-to-Peer Resource Sharing:**</mark>
  * When a user accesses a shared folder or printer on another workgroup computer, the LSA verifies the credentials provided by the remote machine.
* <mark style="color:blue;">**Cached Credentials**</mark><mark style="color:blue;">:</mark>
  * If a user has previously accessed a shared resource, the LSA may cache their credentials to simplify future access.

***

## <mark style="color:blue;">Components of LSA</mark>

### <mark style="color:blue;">Breakdown of LSA Architecture</mark>

* The architecture of the Local Security Authority (LSA) in Windows is designed to be both robust and flexible, enabling it to manage various security-related functionalities efficiently.
* At its core, the LSA consists of the Local Security Authority Subsystem Service (LSASS), which runs as a process on Windows systems.
* This service is responsible for enforcing security policies, handling authentication and authorization processes, and managing credentials and access tokens.

<details>

<summary><mark style="color:blue;"><strong>The LSA architecture is modular, comprising several components that interact with each other to provide comprehensive security services:</strong></mark></summary>

*

</details>

### <mark style="color:blue;">LSA Security Mechanisms</mark>

Content for this section...

### <mark style="color:blue;">LSA and Active Directory</mark>

Content for this section...

### <mark style="color:blue;">Best Practices for Managing LSA Security</mark>

Content for this section...

### <mark style="color:blue;">References</mark>

Content for this section...



