Suspicious "Secure System" Process in Task Manager

Your discussion with Dave including especially the Secure System and Hyper-V virtualization fit with other discussions we've had here recently with others asking questions about the Core Isolation and Memory Integrity features of Windows 10.

Since enabling Memory Integrity requires that virtualization be enabled so that a Hyper-V virtual machine can be opened to contain the core Windows operating system components, the addition of a Secure System service to monitor this process seemed reasonable as well.

Enable virtualization-based protection of code integrity - Windows security | Microsoft Docs

Since I've got this operating on my own Windows Home based Microsoft Surface Go tablet running in S Mode, I looked and found both the Secure System and Lsalso.exe processes running on this system as well.

I checked for the Secure System process both before and after disabling the Memory Integrity option in Core isolation found under Device security in the Windows Security at a glance console and it disappeared and returned as expected. However, I forgot to look for the Lsalso.exe process before returning Memory Integrity to enabled, so you'll need to test this yourself if you want to be certain this is related to the same setting as well.

You'll notice under Windows Security - Device security - Core isolation that Virtualization-based security is specifically mentioned, so the above all makes perfect sense.

So you two were very close, just hadn't made the final leap to the primary reason behind these virtualization-based elements of Windows 10 being enabled on any system capable of operating with Memory integrity enabled.

Rob

Hi Leif76,

Rest assured they are genuine and many people have reported those processes running on the home version, usually that is caused by a VM or Emulator that was running at some time on the PC and that initiated those services in the Home version, either way, you have nothing to worry about.

Hi Leif76

I am Dave, an Independent Advisor, I will help you with this.

Open the Settings App, then go to Update and Security - Activation, what version of Windows 10 do you have installed on your PC, is that Home, Pro or Enterprise?

All the processes you list are genuine Windows processes, though they usually are only running in the Enterprise version, though Microsoft are constantly making IWndows10 more secure, but you can rest assured, those are legitimate processes

Hi Dave,

The settings say I'm running Windows 10 Home (winver specifies build 19043.1052, if it matters).

I was just worried that, since these are typically Enterprise processes (not Server, oops), they could have been fake or hijacked processes (don't know if that's even possible), but seems like that isn't the case then huh?

If you say they're all genuine, then that's that.

But just out of curiosity, what could be a possible reason for these processes to be running on Home Edition, and is there any way to disable them? Would there be any benefit in doing so?

In any case, thanks for the reply.

Hi Leif76, glad to help!