> For the complete documentation index, see [llms.txt](https://red.infiltr8.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://red.infiltr8.io/redteam/persistence/windows/lsa.md).

# LSA Persistence

## Theory

The Local Security Authority (LSA) is a protected system process that authenticates and logs users on to the local computer. The LSA is responsible for enforcing security policies and managing user authentication and authorization. It validates user information by checking the Security Accounts Manager (SAM) database. We may abuse some of its mechanisms to acheive persistencce.

## Practice

{% content-ref url="/pages/nDJti97wHGmnDEdUozll" %}
[Security Support Provider DLLs](/redteam/persistence/windows/lsa/security-support-provider-dlls.md)
{% endcontent-ref %}

{% content-ref url="/pages/54ObOZg4vknDbdg4ExXq" %}
[Authentication Package](/redteam/persistence/windows/lsa/authentication-package.md)
{% endcontent-ref %}