Role of LSASS in Microsoft Windows 2000

The Local Security Authority Subsystem Service (LSASS) is a core component of the Microsoft Windows 2000 operating system responsible for enforcing system security policies and handling user authentication. Running as the protected user-mode process lsass.exe, it verifies user credentials, generates access tokens for authorized sessions, enforces local password and privilege policies, and writes events to the security audit log.

User Authentication and Validation

In Windows 2000, LSASS serves as the central engine for authenticating both local and network logons. When a user attempts to log into a workstation or server, the Winlogon process captures the credentials and passes them to LSASS.

LSASS utilizes security packages known as Security Support Providers (SSPs) to validate these credentials:

  • Kerberos v5: Introduced natively to Windows in Windows 2000, this is the default authentication protocol for Active Directory domain environments. LSASS communicates directly with the Key Distribution Center (KDC) on a domain controller to issue and verify Kerberos tickets.
  • NTLM: Retained for backward compatibility with Windows NT 4.0 domains, non-Active Directory networks, and standalone local machine accounts.

If the credentials are valid, LSASS confirms the authentication; if not, it returns an access-denied status.

Access Token Generation

Once a user is successfully authenticated, LSASS queries the Security Accounts Manager (SAM) database for local accounts, or Active Directory for domain accounts, to retrieve user information. This includes the user’s Security Identifier (SID) and the SIDs of all groups to which the user belongs, along with assigned user rights.

LSASS consolidates this information to create an access token. This token is attached to the initial user shell process (such as explorer.exe) and is inherited by every subsequent process launched during that session. The operating system references this token to determine permissions whenever the user attempts to access securable objects like files, registry keys, or printers.

Enforcement of Security Policies

LSASS maintains and enforces the Local Security Policy on the host machine. These responsibilities include:

  • Account Policies: Enforcing password length, complexity requirements, history retention, and account lockout thresholds.
  • User Rights Assignment: Determining which accounts or groups have rights to perform system-level tasks, such as logging on locally, backing up files, or shutting down the computer.
  • Audit Policies: Determining which system events (successful or failed logons, object access, policy changes) must be tracked and recorded.

Audit Logging

Whenever an event configured under the audit policy occurs, LSASS receives the notification, formats the audit record, and sends it to the Windows Event Log service. These records are committed directly to the Security Log in the Event Viewer, allowing administrators to monitor system activity and detect unauthorized access attempts.

System Stability and Criticality

Because LSASS is essential to the security architecture of Windows 2000, it is treated as a critical system process. If lsass.exe is terminated, crashes, or encounters an unrecoverable error, the Windows 2000 kernel automatically triggers a system shutdown or a Blue Screen of Death (BSOD) to prevent unauthenticated access or system compromise.