How to Fix 'Local Security Authority Protection Is Off' on Windows - Make Tech Easier

Local Security Authority (LSA) protection is a crucial security feature designed to safeguard a user's credentials on a Windows computer, preventing unauthorized access. Some users have encountered an error message stating that "Local Security Authority protection is off. Your device may be vulnerable." If you are facing this issue and unable to reactivate it via Windows Security, this guide will help you enable LSA protection again.

Useful tip: If the Windows Security app fails to open, consider these troubleshooting steps.

Table of Contents

• Basic Troubleshooting Steps
• 1. Activating LSA Protection Using PowerShell
• 2. Activating LSA Protection Through the Local Group Policy Editor
• 3. Activating LSA Protection Via the Registry Editor
• Frequently Asked Questions

Basic Troubleshooting Steps

Before delving into advanced methods to enable the Local Security Authority feature and eliminate the error, consider these preliminary troubleshooting steps:

• Run a malware scan: The error might be due to malware altering your system settings. Use Windows Security or another antivirus to scan your system, ensuring both Windows and your antivirus are up to date.
• Initiate an SFC scan: Corrupt or damaged system files might also trigger this error. An SFC scan can identify and repair such issues.
• Utilize a system restore point: If you regularly create system restore points, you can revert your system to a state before the error appeared.

1. Activating LSA Protection Using PowerShell

To enable LSA protection, execute a single command in PowerShell:

1. Open the Terminal (Admin) by pressing Win X and selecting it from the menu.

2. In the PowerShell tab, paste the following command and press Enter to execute it:

<code>reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 2 /f;reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPLBoot /t REG_DWORD /d 2 /f</code>

3. Restart your computer to apply the changes and check if the error persists.

Note: Windows Home users must first enable the Local Group Policy Editor.

2. Activating LSA Protection Through the Local Group Policy Editor

Alternatively, you can enable LSA protection using the Local Group Policy Editor (LGPE):

1. Search for "group policy" in the taskbar, then click on "Edit group policy."

2. Navigate to "Computer Configuration -> Administrative Templates -> System -> Local Security Authority," and double-click "Configure LSASS to run as a protected process."

3. If set to "Disabled," change it to "Not Configured."

4. Click "OK" to save the changes and restart your computer to check if the error remains.

Note: Regularly cleaning your Windows Registry can prevent error messages.

3. Activating LSA Protection Via the Registry Editor

The final method involves using the Registry Editor, which requires caution. Always back up the Registry before making changes to avoid system issues:

1. Search for "registry editor" in the taskbar, then open "Registry Editor."

2. Confirm the UAC prompt by clicking "Yes."
3. Navigate to:

<code>Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa</code>

and double-click "RunAsPPL."

4. If "RunAsPPL" is missing, create it by right-clicking "Lsa," selecting "New -> DWORD (32-bit) Value."

5. Open the new value, set "Value data" to "2," and click "OK."

6. Restart your PC to verify if the issue is resolved.

Tip: Enhance your Windows Registry skills with these optimization hacks.

Frequently Asked Questions

How can I confirm that LSA protection is enabled?

If you can't verify LSA protection in Windows Security, use the Event Viewer. Go to "Windows Logs -> System," and look for an event ID of 12. It should indicate, "LSASS.exe was started as a protected process with level: 4," when you open it.

How do I identify plug-ins and drivers that fail to run as LSA-protected processes?

Check the Event Viewer in audit mode. Navigate to "Applications and Services Logs -> Microsoft -> Windows -> CodeIntegrity," and look for events with IDs 3065 or 3066.

How do I enable audit mode on Windows?

For Windows 11 22H2, audit mode is already enabled. For other versions, use the Registry Editor to navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe, double-click "AuditLevel," set "Value data" to "8," and click "OK."

Image credit: DepositPhotos. All screenshots by Chifundo Kasiya.

The above is the detailed content of How to Fix 'Local Security Authority Protection Is Off' on Windows - Make Tech Easier. For more information, please follow other related articles on the PHP Chinese website!