parent process: wininit.exe
account: system
start time: within seconds of boot
description: the Local Security Authentication Subsystem Server (LSASS) process is responsible for authing users by calling an appropriate Security Service Provider (SSP) authentication package specified in HKLM\SYSTEM\CurrentControlSet\Control\Lsa. Typically this will be the Kerberos SSP for domain accounts or the MSVI__0 SSP for local accounts.
Once a user is auth'd, lsass.exe generates an access token for the user that specifies security rights and contstraints for the user and the user's processes. Only one instance of this process should occur and it should never have a child process.
