LsaIso.exe

Windows ProcessMicrosoft Corporation

Also called lsaiso, lsa isolated, isolated lsa, credential guard

WindowsSystem Component

Isolated LSA. When Credential Guard is on, this trustlet holds NTLM hashes and Kerberos tickets in Virtual Secure Mode, away from lsass.exe.

What you need to know

This is Isolated LSA, not a second copy of lsass.exe you can kill for RAM.

LsaIso.exe runs as an Isolated User Mode trustlet when Credential Guard is enabled. lsass.exe still authenticates in the normal world. Secrets stay here. You cannot attach a debugger to it.

Safe?: Yes. It is Credential Guard
Same as lsass?: No. This one is isolated
Should I end it?: No

Feex says

If LsaIso is on the list, Credential Guard is doing the job Microsoft documented. I would not end it to "speed up logon." That process is why stolen lsass dumps come back empty.

What is LsaIso.exe?

LsaIso.exe is the Isolated LSA process. Credential Guard moves password hashes and Kerberos TGTs here so the normal lsass.exe memory is less useful to steal.

What does it do?

It talks to lsass.exe over a restricted RPC channel. It does not host third-party drivers. It does not draw the lock screen.

Why is it running?

The PC has virtualization-based security and Credential Guard on. Windows 11 enables that by default on hardware that qualifies. No LsaIso usually means Guard is off, not that lsass vanished.

Is it safe?

Usually safe

A Microsoft Isolated LSA trustlet is expected when Credential Guard is on. A random LsaIso.exe in Downloads is not that trustlet. You also cannot usefully dump this process from user mode.

A legitimate copy normally runs from:

C:\Windows\System32\LsaIso.exe

Expected publisher: Microsoft Corporation
Present when Credential Guard is enabled
Sibling in the normal world: lsass.exe

Can I end it?

Ending LsaIso.exe is treated as a security-process failure. It is not a RAM cleanup. Microsoft documents high CPU as a vendor-injection problem, not a kill target.

Can I remove it?

Do not delete LsaIso.exe. Turn Credential Guard off only with a documented policy if a line-of-business app is incompatible.

Should it start with Windows?

wininit starts Isolated LSA with the secure process path. It is not a Startup Apps checkbox.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Should be low. A spike often means a driver is poking an IUM process
Memory: Small. The point is isolation, not cache
Disk: None that you manage
Network: None by itself

File information

LsaIso.exe file information
Executable name	LsaIso.exe
Common legitimate path	C:\Windows\System32\LsaIso.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

High CPU on LsaIso

Microsoft says apps that inject DLLs or queue APCs into Isolated LSA can destabilize it. Eliminate the last security or overlay vendor before you disable Guard.

Empty lsass dumps after an "audit"

That is Credential Guard working. The hashes are not in lsass anymore.

Troubleshooting

Diagnose before you change anything destructive.

Confirm Credential Guard is on

System Information or msinfo32 shows Virtualization-based security. LsaIso should match that state.

Do not attach a debugger

IUM processes reject normal debug. Follow Microsoft's vendor-elimination steps instead.

Technical details

LsaIso.exe technical details
Image name	LsaIso.exe
Role	Isolated LSA / Credential Guard trustlet

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Credential Guard · LsaIso stores secrets under VBS
Microsoft Learn: IUM processes · Trustlets cannot be injected
Microsoft: LsaIso high CPU · APC and DLL injection side effects
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.