{"id":11018,"date":"2022-05-09T09:18:57","date_gmt":"2022-05-09T16:18:57","guid":{"rendered":"https:\/\/www.coretechnologies.com\/blog\/?p=11018"},"modified":"2022-05-09T09:18:57","modified_gmt":"2022-05-09T16:18:57","slug":"samss","status":"publish","type":"post","link":"https:\/\/www.coretechnologies.com\/blog\/windows-services\/samss\/","title":{"rendered":"Essential Windows Services: Security Accounts Manager \/ SamSs"},"content":{"rendered":"<div align=\"center\"><img loading=\"lazy\" decoding=\"async\" class=\"no-lazy-load\" src=\"\/blog\/images\/security-accounts-manager-150x150.webp\" title=\"Security Accounts Manager Service\" alt=\"Security Accounts Manager Service\" border=\"0\" width=\"150\" height=\"150\" \/><\/div>\n<div id=\"blog-toc-container\" style=\"margin-top:20px;\">\n<p id=\"blog-toc-title\">In this article&#8230;<\/p>\n<ul>\n<li><a href=\"#what-is-samss-service\">What is the Security Accounts Manager (SamSs) service?<\/a><\/li>\n<li><a href=\"#stop-samss\">What happens if I stop SamSs?<\/a><\/li>\n<li><a href=\"#ok-to-disable-samss\">Is it OK to disable the Security Accounts Manager service?<\/a><\/li>\n<li><a href=\"#terminate-samss\">What happens if I kill the SamSs process (lsass.exe)?<\/a><\/li>\n<li><a href=\"#samss-not-starting\">The SamSs service isn\u2019t starting. Help!<\/a><\/li>\n<li><a href=\"#samss-questions\">Questions? Problems?<\/a><\/li>\n<\/ul>\n<\/div>\n<p><a name=\"what-is-samss-service\"><\/a><\/p>\n<h2 class=\"blog-caption\">What is the Security Accounts Manager (SamSs) service?<\/h2>\n<p>The Security Accounts Manager service administers the database of user and group account information stored on your computer. The service helps to authenticate local and remote users logging on to your PC.<\/p>\n<p>The service&#8217;s display name is <b>SamSs<\/b> and it&#8217;s hosted in the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Local_Security_Authority_Subsystem_Service\" target=_blank\">LSA process<\/a>, <b>lsass.exe<\/b>. By default, the service is set to start automatically when your computer boots:<\/p>\n<div align=\"center\"><a href=\"\/blog\/images\/security-accounts-manager-windows-service.png\" class=\"zoomPopup\" title=\"Security Accounts Manager Windows Service\" target=\"_blank\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" class=\"image-padding\" src=\"\/blog\/images\/security-accounts-manager-windows-service.png\" title=\"Security Accounts Manager Windows Service (click to enlarge)\" alt=\"Security Accounts Manager Windows Service\" border=\"0\" width=\"406\" height=\"468\" \/><\/a><\/div>\n<p><a name=\"stop-samss\"><\/a><\/p>\n<h2 class=\"blog-caption\">What happens if I stop SamSs?<\/h2>\n<p>The following services depend on SamSs:<\/p>\n<ul>\n<li>\n<p><a href=\"https:\/\/en.wikipedia.org\/wiki\/Microsoft_Distributed_Transaction_Coordinator\" target=_blank\">Distributed Transaction Coordinator<\/a><\/p>\n<\/li>\n<li>\n<p>KtmRm for Distributed Transaction Coordinator<\/p>\n<\/li>\n<li>\n<p><a href=\"\/blog\/windows-services\/lanmanserver\/\">Server<\/a><\/p>\n<\/li>\n<\/ul>\n<div align=\"center\"><a href=\"\/blog\/images\/samss-windows-service-dependencies.png\" class=\"zoomPopup\" title=\"SamSs Service dependencies\" target=\"_blank\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" class=\"image-padding\" src=\"\/blog\/images\/samss-windows-service-dependencies.png\" title=\"SamSs Service dependencies (click to enlarge)\" alt=\"SamSs Service dependencies\" border=\"0\" width=\"406\" height=\"468\" \/><\/a><\/div>\n<p>That means that if you stop SamSs, those services will stop as well. And that may cripple your computer.<\/p>\n<p>For example, if the Server service stops, file and printer sharing won&#8217;t work. Are those features important to you?<\/p>\n<p>In any case, you may find it next to impossible to stop the SamSs service!<\/p>\n<p>You will notice that the stop button is disabled in the Services application:<\/p>\n<div align=\"center\"><a href=\"\/blog\/images\/samss-stop-button-disabled.png\" class=\"zoomPopup\" title=\"SamSs stop button disabled\" target=\"_blank\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" class=\"image-padding\" src=\"\/blog\/images\/samss-stop-button-disabled.png\" title=\"SamSs stop button disabled (click to enlarge)\" alt=\"SamSs stop button disabled\" border=\"0\" width=\"406\" height=\"468\" \/><\/a><\/div>\n<p>And the <a href=\"\">SC command<\/a> informs us that the service is not stoppable, cannot be paused and ignores shutdown requests:<\/p>\n<div align=\"center\"><a href=\"\/blog\/images\/sc-query-samss-service.png\" class=\"zoomPopup\" title=\"SC Query SamSs\" target=\"_blank\" rel=\"noopener noreferrer\"><img decoding=\"async\" class=\"image-padding\" src=\"\/blog\/images\/sc-query-samss-service.png\" title=\"SC Query SamSs (click to enlarge)\" alt=\"SC Query SamSs\" border=\"0\" width=\"520\" \/><\/a><\/div>\n<p>Apparently Microsoft really doesn&#8217;t want anyone to disturb the Security Accounts Manager service!<\/p>\n<p><a name=\"ok-to-disable-samss\"><\/a><\/p>\n<h2 class=\"blog-caption\">Is it OK to disable the Security Accounts Manager service?<\/h2>\n<p>The service&#8217;s description states:<\/p>\n<div class=\"blog-qa-question-box\"><img loading=\"lazy\" decoding=\"async\" src=\"\/images\/quotes-transparent-21x21.png\" width=\"21\" height=\"21\" \/>&nbsp;Disabling this service will prevent other services in the system from being notified when the SAM is ready, which may in turn cause those services to fail to start correctly. <b>This service should not be disabled.<\/b><\/p>\n<\/div>\n<p>Indeed, Microsoft <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows-server\/security\/windows-services\/security-guidelines-for-disabling-system-services-in-windows-server#security-accounts-manager\" target=\"_blank\" rel=\"noopener\">reiterates their recommendation to keep the service enabled<\/a> on Windows Server 2016 (with Desktop Experience).<\/p>\n<p><a name=\"terminate-samss\"><\/a><\/p>\n<h2 class=\"blog-caption\">What happens if I kill the SamSs process (lsass.exe)?<\/h2>\n<p>The Security Accounts Manager service runs inside the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Local_Security_Authority_Subsystem_Service\" target=_blank\">lsass.exe<\/a> process, which multiple services may share.<\/p>\n<p>For example, here you see three services &mdash; SamSs, VaultSvc (Credential Manager), and Keyslo (CNG Key Isolation) &mdash; all running in the same instance of lsass.exe (with PID 708):<\/p>\n<div align=\"center\"><a href=\"\/blog\/images\/task-manager-smss-process.png\" class=\"zoomPopup\" title=\"lsass.exe is running multiple services\" target=\"_blank\" rel=\"noopener noreferrer\"><img decoding=\"async\" class=\"image-padding\" src=\"\/blog\/images\/task-manager-smss-process.png\" title=\"lsass.exe is running multiple services (click to enlarge)\" alt=\"lsass.exe is running multiple services\" border=\"0\" width=\"520\" \/><\/a><\/div>\n<p>Because all three services are running in the same process, <b>terminating the process will stop all three services<\/b>.<\/p>\n<p>That&#8217;s probably OK for the CNG Key Isolation service but Credential Manager is a building block for another three services. Be sure to understand the implication of terminating the Credential Manager service before killing the shared lsass process.<\/p>\n<p><a name=\"samss-not-starting\"><\/a><\/p>\n<h2 class=\"blog-caption\">The SamSs service isn\u2019t starting. Help!<\/h2>\n<p>If Security Accounts Manager failed to start, it is likely that the important <a href=\"\/blog\/windows-services\/rpcss\/\">Remote Procedure Call (RPC) service<\/a> didn&#8217;t start either.<\/p>\n<p>Open <a href=\"\/blog\/windows-services\/essential-tools-windows-services-msc\/\">Services<\/a> and check if someone has disabled the RPC service. If so, you should definitely re-enable it.<\/p>\n<p>After that, try to start the RPC service. If that works, you can start SamSs next.<\/p>\n<p><a name=\"samss-questions\"><\/a><\/p>\n<h2 class=\"blog-caption\">Questions? Problems?<\/h2>\n<p>If you would like to know more about the Security Accounts Manager service, or you have a specific problem, please feel free to <a href=\"\/support\/\">get in touch<\/a>. We will do our best to help you!<\/p>\n<!-- relpost-thumb-wrapper --><div class=\"relpost-thumb-wrapper\"><!-- filter-class --><div class=\"relpost-thumb-container\"><style>.relpost-block-single-image, .relpost-post-image { margin-bottom: 10px; }<\/style><h3>You may also like...<\/h3><div style=\"clear: both\"><\/div><div style=\"clear: both\"><\/div><!-- relpost-block-container --><div class=\"relpost-block-container relpost-block-column-layout\" style=\"--relposth-columns: 3;--relposth-columns_t: 2; --relposth-columns_m: 2\"><a href=\"https:\/\/www.coretechnologies.com\/blog\/windows-services\/windefend\/\"class=\"relpost-block-single\" ><div class=\"relpost-custom-block-single\"><img decoding=\"async\" loading=\"lazy\" class=\"relpost-block-single-image\" alt=\"Essential Windows Services: Microsoft Defender Antivirus Service \/ WinDefend\"  src=\"https:\/\/www.coretechnologies.com\/blog\/wp-content\/uploads\/microsoft-defender-150x150-1.webp\" style=\"aspect-ratio:1\/1\" style=\"aspect-ratio:1\/1\"><\/img><div class=\"relpost-block-single-text\"  style=\"height: 75px;font-family: Arial;  font-size: 12px;  color: #333333;\"><h2 class=\"relpost_card_title\">Essential Windows Services: Microsoft Defender Antivirus Service \/ WinDefend<\/h2><\/div><\/div><\/a><a href=\"https:\/\/www.coretechnologies.com\/blog\/windows-services\/startup-types-explained\/\"class=\"relpost-block-single\" ><div class=\"relpost-custom-block-single\"><img decoding=\"async\" loading=\"lazy\" class=\"relpost-block-single-image\" alt=\"Windows Services Startup Types Explained\"  src=\"https:\/\/www.coretechnologies.com\/blog\/wp-content\/uploads\/windows-service-startup-types-150x150-1.webp\" style=\"aspect-ratio:1\/1\" style=\"aspect-ratio:1\/1\"><\/img><div class=\"relpost-block-single-text\"  style=\"height: 75px;font-family: Arial;  font-size: 12px;  color: #333333;\"><h2 class=\"relpost_card_title\">Windows Services Startup Types Explained<\/h2><\/div><\/div><\/a><a href=\"https:\/\/www.coretechnologies.com\/blog\/alwaysup\/vs-custom-windows-service\/\"class=\"relpost-block-single\" ><div class=\"relpost-custom-block-single\"><img decoding=\"async\" loading=\"lazy\" class=\"relpost-block-single-image\" alt=\"Why Should I Buy AlwaysUp Instead of Writing My Own Windows Service?\"  src=\"https:\/\/www.coretechnologies.com\/blog\/wp-content\/uploads\/build-vs-buy-150x150.png\" style=\"aspect-ratio:1\/1\" style=\"aspect-ratio:1\/1\"><\/img><div class=\"relpost-block-single-text\"  style=\"height: 75px;font-family: Arial;  font-size: 12px;  color: #333333;\"><h2 class=\"relpost_card_title\">Why Should I Buy AlwaysUp Instead of Writing My Own Windows Service?<\/h2><\/div><\/div><\/a><\/div><!-- close relpost-block-container --><div style=\"clear: both\"><\/div><\/div><!-- close filter class --><\/div><!-- close relpost-thumb-wrapper -->","protected":false},"excerpt":{"rendered":"<p>In this article&#8230; What is the Security Accounts Manager (SamSs) service? What happens if I stop SamSs? Is it OK to disable the Security Accounts Manager service? What happens if I kill the SamSs process (lsass.exe)? The SamSs service isn\u2019t &hellip; <a href=\"https:\/\/www.coretechnologies.com\/blog\/windows-services\/samss\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":11162,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[78,133,287,217,196],"class_list":["post-11018","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-windows-services","tag-essential-windows-services","tag-rpc-service","tag-samss-service","tag-server-service","tag-windows-services-2"],"_links":{"self":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts\/11018","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/comments?post=11018"}],"version-history":[{"count":12,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts\/11018\/revisions"}],"predecessor-version":[{"id":11309,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts\/11018\/revisions\/11309"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/media\/11162"}],"wp:attachment":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/media?parent=11018"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/categories?post=11018"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/tags?post=11018"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}