LSASS.EXE and CSRSS.EXE constant I/O Read/Write in Vista

Question

I have 2 processes that always seem to be reading/writing to the hard disk: LSASS.EXE and CRSS.EXE

• CSRSS.EXE reads 1-2/sec
• LSASS.EXE writes/reads 1/sec

Both of the processes start at bootup. Is there a reason they should be reading/writing so much?

Answer 1

CSRSS is the "Client/Server Run-Time Subsystem" and it's the user mode part of the system (in contrast to the Kernel mode, see link for more explanation).

According to this site:

CSRSS is responsible for console windows, creating and/or deleting threads, and implementing some portions of the 16-bit virtual MS-DOS environment.

There's also a Wikipedia entry on it.

---

LSASS is the "Local Security Authentication Server". Here's what it does:

[...] is responsible for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. It also writes to the Windows Security Log.

---

I am not a Windows expert, but as you can see, those two processes are essential for the operation of Windows and I wouldn't wonder if they need constant reads/writes from the hard disk to perform their tasks.

Note that those two files are often target of viruses, who disguise themselves as the process.

Answer 2

I'm investigating the same problem; procmon reports constant I/O from lsass.exe and explorer.exe, mostly towards the registry. Even suspending the processes wit Process Explorer doesn't stop the I/O, which is a bit strange. The drive can be heard constantly, all other running programs have been terminated, so it isn't an AV scan or anything else and the computer has been checked for malware.

One further possible solution is that it is related to page file access, but I can't see why Windows (XP) would want to constantly page to disk when there are so few running processes. Windows Update has also been switched off.

Answer 3

Are you using "Task Manager" to monitor the I/O? If so, Task Manager maybe the cause of the unexpected I/O. Refer to the reply from David Manley in the MicroSoft Vista Security forum for a possible step-by-step diagnosis.