Advanced Threat Protection

 View Only
  • 1.  lsass.exe question

    Posted Jul 28, 2019 01:47 PM

    Hi

    I get the following message:

    Local security authority process has changed since the last time you used it. 

    Name: LOcal security authority process

    application: Lsass.exe

    Do you want to allow it to access the network?

     

    Name:  Local Security Authority Process
    Version:  6.1.7601.24387
    File Path:  C:\Windows\System32\lsass.exe

    Connection Origin:  local initiated
    Protocol:  TCP
    Local Address:  192.168.1.11
    Local Port:  49772 
    Remote Name:  crl.verisign.com
    Remote Address:  93.184.220.29
    Remote Port:  80 (HTTP - World Wide Web)

    the lsass.exe file size is 30K

    Should I allow this ? 

    Thanks

    Adam

     

     

    DDD



  • 2.  RE: lsass.exe question

    Posted Jul 28, 2019 09:26 PM

    It's a critical Windows process reaching out to verify certs so yes.