How to Check if Your Windows 11 PC is Protected by LSA
Windows 11 LSA Protection confirms if your PC actively defends against attackers trying to steal your login details.
LSA Protection, which stands for Local Security Authority Protection, is a key security feature that stops bad software from messing with important security information.
This protection is especially important against malware that tries to steal passwords and other login data the Local Security Authority Subsystem Service (LSASS) handles.
You can easily check if LSA Protection is on by opening Windows Security, then going to Device security, and finally looking at Core isolation details.
If the setting is turned on, your computer has this extra layer of security working.
You can check LSA Protection in Windows Security under Device security Core isolation details If the setting is toggled on, your system is protected. Alternatively, open Event Viewer and filter for Event ID 12 from the Wininit source to see if LSASS.exe is running as a protected process.
What is LSA Protection?
LSA Protection in Windows 11 is a security feature designed to keep your sensitive information, like passwords, safe from theft. It works by running a key security process in a special protected mode. This makes it much harder for bad programs to access or change important security details on your computer.
LSA Protection strengthens computer security by running the Local Security Authority process in a special protected mode. This protected mode prevents unauthorized programs from accessing or changing sensitive security information on the computer. The LSA Protection security feature makes it much harder for hackers to tamper with the computer's security functions.
Windows also has another protection called Core Isolation, which works in a similar way to keep your PC safe.
How to Check if LSA Protection is On
You can check if LSA Protection is enabled on your Windows 11 PC using the Event Viewer tool to look at system logs. First, open Event Viewer by clicking Start, typing eventvwr.msc, and pressing Enter. Then, in the left panel, expand Windows Logs and click on System. Right-click on System and select Filter to proceed.
- Open Event Viewer: Click the Start button , type
eventvwr.msc, and press Enter.
Event Viewer System View - Find System Logs: In the left panel, click the arrow next to Windows Logs to expand it. Then click on System.
- Filter the Logs: Right-click on System and choose Filter Current Log…
Filter Current Log in Event Viewer - Enter Filter Details: In the filter box, type
12in the Event IDs box. Then click the dropdown for Event sources and select Wininit. Click OK.
Set Event ID and Source Filter - Check the Log Message: Look for a message that says: “LSASS.exe was started as a protected process with level 4”. This message means LSA Protection is active on your PC.
LSASS Protected Process Log
Local Security Authority (LSA) protection safeguards your computer from attacks that target the security process. Seeing a confirmation message indicates your Windows 11 PC has this valuable protection active, preventing unauthorized access to sensitive security information and data.
Why Does This Matter?
LSA Protection is important because it significantly increases the difficulty for hackers trying to steal your passwords and other security details from your Windows 11 computer. Regularly checking that this feature is active gives you confidence in your PC’s security. It’s a smart habit to keep your system protected by verifying security features periodically.
Checking this yourself gives you peace of mind that your PC is secure. It’s a good habit to check security features regularly to stay protected.
Windows security features offer protection by using safeguards like Core Isolation. Core Isolation, a feature introduced with Windows 10 and present in Windows 11, creates a secure area in your computer's memory. This protected memory prevents malware from accessing sensitive data.
Summary
LSA Protection is a vital Windows security feature that shields your passwords and login details, and you can confirm it’s active using Event Viewer.
Should I turn on LSA in 🪟 Windows 11?
LSA protection makes LSASS more secure. This security feature runs LSASS as a protected process (PPL), which prevents untrusted code (even with administrative rights) from injecting into it.
What is LSA in 🪟 Windows 11?
Local Security Authority (LSA) protection Windows has several critical processes to verify a user's identity. Verification processes include Local Security Authority (LSA), which is responsible for authenticating users, and verifying Windows sign-ins.
What does LSA protection do?
LSA performs security related tasks such as the verification of logon attempts and password changes. It also creates access tokens, enforces local security policies, and protects and adds security protection for stored credentials.
What is LSA protection set to enabled?
Enabling this setting provides added security for the credentials that LSA stores and manages. Impact: If additional LSA protection is enabled, Administrators will not be able to debug a custom LSA plugin. A debugger cannot be attached to LSASS when it's a protected process.
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
No comments yet — be the first to share your thoughts!