Re: is this normail?

C:\WINDOWS\system32\lsass.exe

lsass.exe is a Windows XP file called LSA Shell (Export Version).

It is also called the Local Security Administration Subsystem Service .

Local Security Authority Subsystem Service (LSASS) provides an interface for
managing local security, domain authentication, and Active Directory
processes. LSASS handles authentication for the client and for the server.
It also contains features that are used to support Active Directory
utilities.

I got this somewhere at ZoneAlarms site, but cannot find the link.

[[LSA Shell (Export Version) is trying to connect to the Internet or your
local network

What should I do?
Give LSA Shell (Export Version) permission to connect.

Why?
LSA Shell (Export Version) (file name lsass.exe) is a component of Windows
NT and 2000 operating systems that helps administer access permissions. It
sometimes requires access to the Internet to perform legitimate tasks. It is
normal for this program to request access permission, and it is safe to
grant permission.

LSA Shell (Export Version) is trying to connect to the Internet or your
local network
ZoneAlarm is asking you whether to allow the connection. No breach in your
security has occurred. Your computer is safe.

How LSA Shell (Export Version) uses the Internet
LSA Shell (Export Version) (filename lsass.exe) is the Local Security
Administration Subsystem, the process that runs the Local Security Authority
component of the Windows NT Security Subsystem. (It is also a feature of the
Windows 2000 operating system.) This process handles aspects of security
administration on local computers, including access and permissions. For
example, LSA Shell (Export Version) generates the process responsible for
authenticating users for the Winlogon service.]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:eEIIRKODHHA.1224@xxxxxxxxxxxxxxxxxxxx,
gs <gs@xxxxxxxxxxxxxx> hunted and pecked:
what should I do about this?

Event Type: Failure Audit
Event Source: Security
Event Category: Detailed Tracking
Event ID: 861
Date: 2006-11-20
Time: 08:36:59
User: NT AUTHORITY\SYSTEM
Computer: IEI-A64
Description:
The Windows Firewall has detected an application listening for incoming
traffic.

Name: -
Path: C:\WINDOWS\system32\lsass.exe
Process identifier: 1064
User account: SYSTEM
User domain: NT AUTHORITY
Service: Yes
RPC server: No
IP version: IPv4
IP protocol: UDP
Port number: 4500
Allowed: No
User notified: No

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

.

Relevant Pages

  • RE: Page cannot be displayed
    ... hashing, and signing in" under Local Security policies, and it turns out ... I have Windows XP SP2 and use Internet Explorer 6.0. ... > to "System Cryptography:Use FIPS compliant algorithims for encryption, ... >> web browser or how windows is handling the web browsers. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Windows update 0*800c0008
    ... For error message 0x800c0008 please try the steps suggested in the ... This error may occur if you have enabled the following local security ... "Local Security Policy". ... If the problem persists please post the last 20-30 lines of the Windows ...
    (microsoft.public.windowsupdate)
  • Any way to change ForceGuest w/o using Regedit?
    ... the following registry key: ... According to Microsoft Windows XP Professional: ... ForceGuest is enabled by default, but can be disabled on Windows XP ... Professional by disabling the local security policy Network Access: ...
    (microsoft.public.windowsxp.security_admin)
  • Re: lsass.exe
    ... Please Reply to Newsgroup for the benefit of others ... Lsass.exe is the LSA Shell or Local Security Authority ... Lsass.exe is a process which also relates to trojan and worm security ... MS-MVP Windows Shell/User ...
    (microsoft.public.windowsxp.general)
  • RE: i have the message ( object name not found)
    ... Lsass.exe is a system process of the Microsoft Windows security mechanisms. ... It specifically deals with local security and login policies. ... MCSA w2k/ MCSA MESSAGING w2k ...
    (microsoft.public.windows.server.general)