!!! Overview
[{$pagename}] ([LSASS]) stores [credentials] in memory on behalf of users with active [Microsoft Windows] [sessions]. 

[{$pagename}] allows [Single Sign-On] and [Access Control] to [network] [resources], such as file shares, Exchange Server mailboxes, and SharePoint sites, without re-entering their [credentials] for each remote service.

[{$pagename}] can store credentials in multiple forms, including:
* Reversibly encrypted plaintext
* [Kerberos] tickets ([TGTs], service tickets)
* [NT hash|NTLM]
* [LM hash]

If the user logs on to Windows by using a smart card, [LSASS] will not store a plaintext [password], but it will store the corresponding [NTLM] [hash] value for the account and the plaintext [PIN] for the [Smart Card]. 

If the [User-Account-Control Attribute Value] attribute is enabled for a [SMARTCARD_REQUIRED] for interactive logon, a random [NTLM] [hash] value is automatically generated [{$pagename}] for the account instead of the original password [hash]. The password hash that is automatically generated when the attribute is set does not change.

If a user logs on to Windows with a password that is compatible with [LM hash], this authenticator will be present in memory.

Beginning with [Windows Server 2008 R2] and [Windows 7], the storage of plaintext credentials in memory cannot be disabled, even if the credential providers that require them are disabled.

The stored credentials are directly associated with the [LSASS] logon sessions that have been started since the last restart and have not been closed. 

For example, [LSA] sessions with stored [LSA] [credentials] are created when a user does any of the following:
* Logs on to a local session or [RDP] session on the computer
* Runs a task by using the RunAs option
* Runs an active Windows service on the computer
* Runs a scheduled task or batch job
* Runs a task on the local computer by using a remote administration tool

!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]