What’s LsaIso.exe (Credential Guard & VBS Key Isolation)? Is it safe or a virus?

Did you find LsaIso.exe (Credential Guard & VBS Key Isolation) running in your Windows Task Manager? If so, you're probably wondering what it is and if it's safe. Well, it's a bit complicated to explain what this executable does... It all starts with helping to secure your Windows PC logon and password.

Microsoft started isolating sensitive parts of the Windows OS with virtualization technology similar to the LsaIso.exe process, as far back as Windows 8.1. Microsoft describes Credential Guard aka LsaIso.exe, as "Virtualization-based security (VBS) to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks like pass the hash and pass the ticket."

You may already know that credentials in Windows PCs refer to the usernames and passwords used to access the computer and network resources, including local user accounts, domain user accounts, and online accounts linked to Microsoft services like Office, Outlook, etc...

Therefore, LsaIso.exe is running on your PC, helping protect your Windows credentials from spyware, malware, and other threats.

Here in Austin, Texas at our SpyShelter Cybersecurity Lab, on the day we investigated this process, we found LsaIso.exe running on every PC we have here. You can be sure it's safe a safe process, as long as it's signed by Microsoft.

You can check who signed a process by using Windows Properties, or use our free SpyShelter Antispyware app.

Researched by Jon @ SpyShelter Labs