Windows 10: LSA Protection

What exactly is LSA and is it a default on the Windows Home Edition?Kenneth

:)

 

Disabling LSA protection

We have an internal issue causing something not to work when the LSA protection is enabled.

As we also have "Block credential stealing from the Windows local security authority subsystem (lsass.exe)" ASR rule, and following this recommendation that "having both running at the same time would be redundant" we want to turn off the LSA protection.

The problem starts with the fact that all our devices support Secure Boot and since years we use UEFI based devices.

On those machines the task of disabling LSA protection seems like very cumbersome and not straight forward.

Is there more easy and centralized way to disable LSA protection on a few thousands windows machines?

Thanks in advance

 

How to fix LSA package is not signed as expected event log entries?

Solved.

Here is the article on whats happening: Configuring Additional LSA Protection | Microsoft Learn

If you are on a work computer under a domain you should probably use the Group Policy as instructed in the article.

On a local computer:

Using the Registry

1. Open the Registry Editor (RegEdit.exe), and navigate to the registry key that is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
   
2. Set the value of the registry key to:
   
   1. "RunAsPPL"=dword:00000001 to configure the feature with a UEFI variable.
      
   2. "RunAsPPL"=dword:00000002 to configure the feature without a UEFI variable (only on Windows 11, 22H2).
      
3. Restart the computer.
   

If the registry key RunAsPPL does not exist create it as a New DWORD (32-bit) Value and set the Hexadecimal value to 00000002

The device that was causing the issue for me was a G935 Gaming Headset, which re-prompted to select the device after I created the key and rebooted.

 

Local Security Authority Protection is on, but Windows Security says it's off? ****?

Hi Rob,

It's a fix. I heard the value is enabled by default in the recent Insider Preview builds.

Verifying LSA protection

"To discover if LSA was started in protected mode when Windows started, search for the following WinInit event in the System log under Windows Logs:"

• Event ID 12: LSASS.exe was started as a protected process with level: 4
  

Src: Configuring Additional LSA Protection | Microsoft Learn