MSRPC/LSARPC is the Microsoft Remote Procedure Call interface for the Local Security Authority, which handles local security policy and account-related lookups on Windows systems. It is used for tasks such as policy queries and name or SID translation, so access to it reflects the host's security boundary and local trust relationships.
What MSRPC/LSARPC Does
msrpc/LSARPC is the Windows RPC path that exposes Local Security Authority functions for local policy queries and name or SID translation. Because those lookups sit close to the host’s security boundary, the interface matters whenever software needs to resolve security context on the machine.
In practical terms, LSARPC is less about application data and more about trust decisions on the endpoint. A caller using it is asking the local security subsystem to interpret identities, policy state, or account metadata, which means the interface can reveal or influence information that should remain tightly controlled.
Why LSARPC Is Security-Sensitive
The sensitive part of LSARPC is not the RPC mechanism itself, but what it can disclose or mediate. Name-to-SID and SID-to-name translation can help an attacker map accounts, groups, and local security relationships, while policy queries can expose how the host is configured to interpret trust and authorization.
That makes the interface valuable for administrators and equally useful to an intruder who already has a foothold. If the local security boundary is weakly protected, LSARPC can become a reconnaissance path into the machine’s authority model rather than a benign lookup service.
Common Operational Uses and Boundaries
Administrators and trusted system components use LSARPC for routine security lookups, especially when software must determine how a Windows host represents users, groups, and policy state. Those lookups are normal parts of Windows operation, but they are only safe when access stays within the intended trust boundary.
Because the interface depends on local authority, exposure tends to become a design problem when systems assume that any authenticated caller should be able to query it. The right mental model is that LSARPC is a host security service, not a general-purpose discovery API.
How to Think About Exposure
When reviewing MSRPC/LSARPC exposure, the key question is whether remote or unintended callers can reach a service that was meant to serve only local, trusted components. Network reachability, host hardening, and the identity of the caller all matter because the interface’s value comes from its privileged view of local security state.
That is why this interface is often discussed alongside access control and endpoint trust rather than ordinary application integration. If a system can ask the Local Security Authority to interpret security relationships, you should treat that path as part of the host’s trust architecture.
Risk and Threat Considerations
LSARPC can create meaningful exposure when hostile or overprivileged callers use it to enumerate security-relevant information or interact with local trust logic. The risk is greatest when the endpoint boundary is porous, because translation and policy lookups can aid reconnaissance and support later abuse of local authority.
Failure mechanism: An attacker or unintended caller reaches LSARPC on a host where access is broader than intended, then uses security lookups to map identities, policies, or trust relationships.
Impact: The result can be improved target knowledge, weaker isolation between trusted and untrusted code, and a clearer path to follow-on abuse of the Windows security boundary.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | LSARPC exposure is governed by who may access privileged host security functions. |
| IA-9 — Identification and Authentication (Non-Organizational Users) | Remote access to local security services depends on strong authentication of the caller. | |
| SC-7 — Boundary Protection | The interface sits at a host trust boundary and benefits from network and segmentation controls. | |
| Recommendation — Restrict LSARPC access to only the identities and processes that genuinely need local security lookups. Authenticate remote callers before allowing access to host security policy and account lookup services. Segment or filter access paths so LSARPC is reachable only from trusted management contexts. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Access to local security lookups should be limited to approved users and services. |
| Recommendation — Limit who can reach Windows security lookup interfaces and remove unnecessary exposure paths. | ||
| MITRE ATT&CK | T1087 — Account Discovery | SID and name translation can support account discovery and host reconnaissance. |
| Recommendation — Monitor for account discovery activity that uses Windows security lookup interfaces to enumerate identities. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org