How to Fix LSASS High RAM and Disk usage on Windows 11?

Some Windows 11 users report that a lot of their CPU and RAM resources are constantly being used by LSASS (Local Security Authority Process Subsystem Service). This is a massive problem for many people stuck with a low PC configuration as their PC slows down to the point where they can barely do anything. 

Note: The legitimate Local Security Authority Subsystem Service (LSASS) process is a genuine part of Windows 11. Its job is to enforce the currently active security policies of the system. Among other things, LSASS.exe is tasked with verifying all users logged into a Windows computer. 

If you’re one of the users affected by this issue, you should immediately get rid of the Dell Support Assist Remediation app, as it’s known to cause this issue (along with several 3rd party apps). However, high RAM and disk usage by LSASS can also be a symptom of system corruption or even some kind of malware infection. 

Here’s a list of confirmed fixes that you should follow:

1. Uninstall the Dell SupportAssist Remediation app (if applicable)

It turns out that a proprietary product called Dell SUpportAssist Remediation is the most frequent offender that will result in this excessive resource use by the LSASS.exe process. 

If this scenario is applicable and the Dell SupportAssist Remediation app is installed on your Windows 11 PC, you should attempt to temporarily uninstall it and see if the high resource usage by LSASS.exe is now fixed.

Here’s how to do this:

1.  Press the Windows key + R to open up a Run dialog box.
2. Next, type ‘appwiz.cpl’ and press Ctrl + Shift + Enter to open the Programs and Features menu with admin access.

   

3. If you are prompted by the User Account Control (UAC), click Yes to grant access. 
4. Once you’re inside the Programs and Features menu, scroll down through the list of installed apps and locate the entry associated with Dell SupportAssist Remediation.
5. After you find the correct location, right-click on it and choose Uninstall from the context menu that just appeared. 

   

6. Inside the uninstallation screen, follow the on-screen prompt to complete the uninstallation, then reboot your PC and see if the resource usage of LSASS.exe has gone down. 

If the problem is not fixed yet or this method did not apply to your particular scenario, move down to the next method below. 

2. Perform a Clean Boot

There are several more apps outside the Dell Support Assist Remediation software that might take advantage of the LSASS.exe process and make it consume a lot of system resources (CPU & RAM).

In this instance, you need to perform a clean boot and verify if the symptom stops occurring. 

While booting in this state, your computer will launch without any third-party services, processes, or starting items, and hopefully, the high resource usage of LSASS.exe will no longer be there.

The precise steps to take to boot in a clean boot on Windows 11 are listed in this article. 

If the problem is still not fixed even though you have already achieved a clean boot state, move down to the following method below. 

3. Install Pending Updates

The problem is pretty old at this point, and Microsoft has previously made several hotfixes to restrict the CPU and RAM bandwidth available to the idle LSASS.exe. Install each update available from the WU component if your Windows 11 computer is out of the current.

Make sure your version of Windows 11 is up to date by visiting the Windows Update component and finding the problem. How to accomplish this:

1. Press Windows + R will open the Run dialog box.
2. To reach the Windows Update tab of the Settings program, type “ms-settings:windowsupdate” in the text box and press Enter.

   

3. Unless you played around with the default UAC settings, you could now get a User Account Control prompt asking you to grant additional permissions. Select Yes to provide admin access in this instance.
4. Next, select Check for Updates on the right-hand side.

   

5. To start the installation process when the update has been downloaded locally, select Install Now.s.
6. Lastly, restart your computer to see whether the issue has been fixed.

If you’re still seeing the Local Security Authority Process Subsystem Service consuming many system resources, try the following method below. 

4. Check for Malware

Some security experts believe that LSASS.exe may not be a genuine service. You can be dealing with malware that poses as the legitimate Local Security Authority Subsystem Service and imitates its features. By running a system-wide scan and scanning each individual LSASS.exe file, you may verify to see if this is true.

IMPORTANT: Before you deploy an anti-malware scan, you must check whether the LSASS.exe is fake or if you’re dealing with a genuine service. If you discover foul play, we’ll show you the quickest and most efficient way to get rid of the malware and remove the virus disguising itself as the LSSS.exe program.

Here’s how to check if the LSASS.exe process is genuine or it’s malware in disguise:

1. Press Ctrl + Shift + Esc to open up Task Manager. 
2. If the simple interface opens by default, click More details to bring up the expert interface. 

   

3. Next, select the Processes tab and scroll down through the list of services until you locate the LSASS.exe service.
4. Once you locate it, right-click on it and choose Open File Location. 

   

5. If the location of the lsass.exe is anywhere else than in C:\Windows\System32, chances are you’re dealing with a virus infection.
   Note: Another dead giveaway that you’re dealing with malware that is posing as a legitimate system file is a scenario in which the file has a slightly different name, e.g., lass.exe or Iass.exe (with a capital ‘i’ instead of ‘l’)
6. If all signs point towards a virus infection, our recommendation is to deploy a system-wide Malwarebytes scan to eliminate the chameleon malware as well as any points of interest that it has managed to infect. 

   

7. After the scan has been successfully performed, reboot your PC and check Task Manager once the next startup is complete to see if the high usage of lsass.exe has gone down. 

If this method has allowed you to determine that this problem is not related to virus infection, try the next method below.

5. Deploy SFC and DISM scans

In some cases, system file corruption that affects the LSASS.exe process or a related dependency may cause you to encounter this issue.

If the corruption is superficial and doesn’t affect kernel files, utilities like SFC (System File Checker) and DISM (Deployment Image Servicing Management) should allow you to effectively replace the LSASS.exe process with a new equivalent as well as do the same with every dependency. 

For the best results, our recommendation is to run both utilities in quick succession:

1. Press the Windows key + R to bring up the Run dialog box.
2. To open a Command Prompt with admin rights, put “cmd” into the Run box and hit Ctrl + Shift + Enter.

   

3. Select Yes when the User Account Control asks you to provide admin access.
4. To start an SFC scan, type or paste the command ‘sfc /scannow’ inside the elevated CMD line and press Enter.
   

   

   Note: Keep in mind that System File Checker is local and doesn’t require an active internet connection. It works by dispatching healthy copies of damaged system files drawn from a locally cached system file backup.

5. Execute the following command from the same elevated CMD window when the SFC scan is complete (regardless of the results):

   DISM /Online /Cleanup-Image /RestoreHealth

   IMPORTANT:  DISM is a newer repair utility that will require a constant Internet connection. This is crucial because DISM will use a portion of WU to locate sound replacements for the damaged files that need to be changed.

6. Check to see if the problem has been fixed by restarting your computer again and checking if the high resource usage of LSASS.exe went down.

If you’re still experiencing the same general system slowness because the Local Security Authority Process Subsystem Service takes a lot of CPU and RAM resources, move down to the following method below.

6. Perform a System Restore

It turns out that a recent system modification may have harmed the Local Security Authority Process Subsystem Service, leading it to consume more resources than it should have. In this instance, you can try to solve the problem by using System Restore to return your PC to a previous state in which the problem was not present.

 You may use the built-in System Restore application to return your PC to a previous state where the issue was not present, and the LSASS process was not hogging up your system’s resources. 

IMPORTANT: Bear in mind that applying this technique would nullify all changes made after the System Restore point was created. Everything will be gone, including installed programs, modified system preferences, and more.

If you’ve made the decision to restore your system, proceed as follows:

1. To start the System Restore wizard, open a Run dialog box and enter “rstrui” before pressing Enter.

   

2. Click Yes if the User Account Control prompts you to provide admin access.
3. On the first screen of the System Restore window, click Next to continue.
4. Before clicking Next, choose a good restoration point, then select the box next to Show additional restore points.

   

5. After that, pick a restore point created before you first encountered this issue, then click Next to start the restoration procedure.
6. To see if the issue has been resolved, reboot your PC and open Task Manager again to see if the high usage problem has been resolved.

If you have no possible restore point, try the final available fix below. 

7. Perform a Clean install

If you’ve tried every solution in this guide so far and still see the LSASS.exe file consuming most of your system resources,  you most likely have a severe corruption problem that cannot be resolved with built-in tools like SFC and DISM. 

In this case, you must effectively replace every part of Windows to ensure that all instances of corrupt system files are eliminated.

Most users choose a clean install, which completes the process and deletes all personal data, including applications, games, movies, and documents.

Choose a repair install if you wish to upgrade your Windows components less radically without causing any harm to your personal digital property (games, apps, images, papers, etc.). You may keep all of your personal information by using this method.