How to Check If Your Windows 11 PC Is Protected by LSA
Local Security Authority (LSA) protection stops malware and bad apps from stealing your passwords and login details on Windows 11. It guards a core part of your operating system that handles your sign-in information and user accounts.
You can check if this security feature is active in less than 60 seconds by opening the Windows Security app and looking under the Core isolation settings. Turning on LSA protection gives your PC an extra layer of defense against credential theft.
You can check LSA Protection in Windows Security under Device security Core isolation details If the setting is toggled on, your system is protected. Alternatively, open Event Viewer and filter for Event ID 12 from the Wininit source to see if LSASS.exe is running as a protected process.
What is LSA Protection?
LSA Protection (Local Security Authority Protection) is a Windows 11 security feature that stops malicious programs from stealing your passwords and account details. It locks down a core system process so unauthorized apps and hackers cannot read or tamper with your stored login credentials.
LSA Protection strengthens computer security by running the Local Security Authority process in a special protected mode. This protected mode prevents unauthorized programs from accessing or changing sensitive security information on the computer. The LSA Protection security feature makes it much harder for hackers to tamper with the computer's security functions.
Windows also has another protection called Core Isolation, which works in a similar way to keep your PC safe.
How to Check if LSA Protection is On
You can check if LSA Protection Windows 11 is turned on by looking at your system logs in Event Viewer. Open the Start menu , type eventvwr.msc, and press Enter. Once the tool opens, filter your system logs for specific security events to see if this protection is running.
- Open Event Viewer: Click the Start button, type
eventvwr.msc, and press Enter.
Event Viewer System View - Find System Logs: In the left panel, click the arrow next to Windows Logs to expand it. Then click on System.
- Filter the Logs: Right-click on System and choose Filter Current Log...
Filter Current Log in Event Viewer - Enter Filter Details: In the filter box, type
12in the Event IDs box. Then click the dropdown for Event sources and select Wininit. Click OK.
Set Event ID and Source Filter - Check the Log Message: Look for a message that says: "LSASS.exe was started as a protected process with level 4". This message means LSA Protection is active on your PC.
LSASS Protected Process Log
Local Security Authority (LSA) protection safeguards your computer from attacks that target the security process. Seeing a confirmation message indicates your Windows 11 PC has this valuable protection active, preventing unauthorized access to sensitive security information and data.
Why Does This Matter?
LSA Protection matters because credential theft is one of the most common ways hackers take over computers. Keeping this security feature active stops malicious software from grabbing your password hashes out of computer memory, which protects your whole network from further attacks.
Checking this yourself gives you peace of mind that your PC is secure. It's a good habit to check security features regularly to stay protected.
Windows security features offer protection by using safeguards like Core Isolation. Core Isolation, a feature introduced with Windows 10 and present in Windows 11, creates a secure area in your computer's memory. This protected memory prevents malware from accessing sensitive data.
Summary
LSA Protection is a vital Windows security feature that shields your passwords and login details, and you can confirm it's active using Event Viewer.
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard is a writer at Geek Rewind who turns complex IT tasks into clear, step-by-step guides. He draws on years of hands-on experience in system administration and enterprise IT operations, focusing on Windows, Linux and WordPress: the problems people actually run into, and the fixes that work. His server and WordPress guides come from systems he runs himself. Richard builds and maintains the platform behind Geek Rewind, from its Ubuntu servers and Nginx configuration to its custom WordPress plugins. Many new tutorials start with readers' questions, and he's always glad to answer them in the comments.
No comments yet — be the first to share your thoughts!